Washington's My Health, My Data Act

The law came into effect on July 23, 2023, but small businesses have until June 30, 2024, to become MHMDA-compliant;

Small businesses are defined as any regulated entity that collects, processes, sells, or shares consumer health data of fewer than 100,000 consumers during a calendar year; or derives less than 50 percent of gross revenue from the collection, processing, selling, or sharing of consumer health data, and controls, processes, sells, or shares consumer health data of fewer than 25,000 consumers;

Protected health information subject to the following is exempt from MHMDA provisions:

• The Health Information Portability and Accountability Act
• The Gramm-Leach-Bliley Act
• Social Security Act, title XI
• Fair Credit Reporting Act
• Family Educational Rights and Privacy Act
• Washington Health Benefit Exchange & Applicable Statutes and Regulations
• Privacy Rules Adopted by the Office of the Insurance Commissioner

MHMDA mandates opt-in consent, requiring businesses to obtain consent from consumers before they collect or share their health data;

MHMDA requires businesses to have consumer consent and authorization before selling their health data;

MHMDA violations will be considered unfair trade practices per Washington's Consumer Protection Act;

The Washington State Attorney General is responsible for enforcing the MHMDA with aggrieved consumers also having a private right of action.