Privacy Map

Washington. Health data. Act

MHMDAWashington My Health My Data Act (RCW 19.373)

In force
Partly verifiedMedium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Requires separate consent to collect and to share consumer health data, a signed authorisation to sell it, a dedicated health data privacy policy, and bans geofencing around health facilities.

Key themes
  • consumer health data
  • separate consent
  • authorisation for sale
  • geofencing ban
  • private right of action
Unique features

Very broad 'consumer health data' definition (can include inferences) with no volume threshold and a private right of action.

SaaS relevance

Any SaaS handling health-adjacent data of Washington consumers, including fitness and wellness or inferred data, is caught; processors must follow controller instructions.

§2Obligations

Extraterritorial
Yes
Breach notification
None (see RCW 19.255)
DPO
No
Cross-border transfers
None
Maximum penalty
Consumer Protection Act remedies (AG up to $7,500 per violation; private actual damages, trebling up to $25,000)

§3Dates

Key dates
  • Adopted
  • In force
  • Geofencing ban effective 2023-07-23; small businesses from 2024-06-30.

§4Text and authority

Text
Authority
Washington Attorney General; private litigants

§5Where it applies

Domestic law of
Washington

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.