Key Facts
Overview
Washington's My Health My Data Act is a sector-specific health data privacy law with the broadest health data definition among US laws. It requires opt-in consent for ALL consumer health data and uniquely prohibits geofencing within 2,000 feet of healthcare facilities. A private right of action enables individual lawsuits.
What This Means for Your Website
- Opt-in consent is required for ALL consumer health data collection, sharing, and sale
- Separate consent is needed for each category of health data
- Geofencing is prohibited within 2,000 feet of healthcare facilities
- No small business exemption — applies to businesses of any size
- A private right of action allows consumers to sue directly (treble damages up to $25,000)
Key Requirements
The Washington AG and private plaintiffs enforce the MHMDA. AG penalties reach $7,500 per violation. Private actions allow actual damages plus treble damages capped at $25,000. The broad health data definition covers far more than HIPAA. No revenue or data volume thresholds apply.
How ConsentStack Handles This
ConsentStack helps healthcare-adjacent websites obtain opt-in consent per health data category for Washington visitors, reducing exposure to both AG enforcement and private lawsuits.
Penalties
$7,500 per violation (AG); Private action: actual damages + treble damages (cap $25,000).
Key Requirements
- Opt-in consent for ALL consumer health data collection, sharing, and sale
- Geofencing prohibited within 2,000 feet of healthcare facilities
- Separate consent for each category of health data
- Consumer rights: access, delete, withdraw consent
- No small business exemption for core requirements
Notable Provisions
- Private right of action — unique among most US privacy laws
- Geofencing prohibition around healthcare facilities (2,000 ft)
- Broadest health data definition among US laws
- No size-based exemptions
US State Specifics
Other North America Regulations
Frequently Asked Questions
What is the MHMDA?
The My Health My Data Act is Washington's health data privacy law requiring opt-in consent for all consumer health data with the broadest health data definition among US laws.
Can consumers sue under the MHMDA?
Yes. The MHMDA provides a private right of action — consumers can recover actual damages plus treble damages up to $25,000.
What is the MHMDA geofencing ban?
The MHMDA prohibits geofencing within 2,000 feet of healthcare facilities — preventing location-based targeting near medical facilities.
Does the MHMDA have size-based exemptions?
No. The MHMDA applies to businesses of any size that collect, share, or sell consumer health data of Washington residents.
Stay compliant with MHMDA
ConsentStack helps you implement Opt-in consent for Washington, United States automatically.