Washington My Health My Data Act (MHMDA)

What Is the Washington My Health My Data Act?

The Washington My Health My Data Act (MHMDA), codified at RCW 19.373, is a Washington state law that protects "consumer health data". The MHMDA requires opt-in consent before consumer health data is collected, a separate consent before it is shared, and a signed authorization before it is sold.

When Did the MHMDA Take Effect?

• March 31, 2024 for most regulated entities.
• June 30, 2024 for small businesses.

Who Does the MHMDA Apply To?

The law applies to regulated entities that do business in Washington or that target Washington consumers, and that collect, share or otherwise process consumer health data.

"Consumer health data" is defined broadly, so check whether any of the data your website or app collects could fall within it.

Consent Requirements

The MHMDA sets two separate consent requirements:

The consent to collect and the consent to share cannot be combined into one request. A single "I agree" for both does not meet the law.

Consent must be a clear affirmative act. It must be freely given, specific, informed, opt-in, voluntary and unambiguous, so ask with a choice the consumer has to actively select.

Each consent request must also include disclosures similar to a privacy policy, such as:

• the categories of consumer health data collected or shared,
• the purpose of the collection or sharing,
• the categories of entities the data is shared with, and
• how the consumer can withdraw consent.

Selling Consumer Health Data

Selling consumer health data needs a valid authorization that the consumer signs. It is separate from the consents to collect and to share, so a consent banner choice is not enough on its own to allow a sale.

Consumer Health Data Privacy Policy

Regulated entities must publish a Consumer Health Data Privacy Policy and place a prominent link to it on their homepage. The policy must disclose, among other things:

• the categories of consumer health data collected,
• the purposes for which it is collected and used, and
• the sources from which it is collected.

Consumer Rights

Consumers have rights over their consumer health data, including the right to withdraw consent. Give consumers a simple way to change their choice at any time.

Enforcement

The MHMDA can be enforced by the Washington Attorney General. It also gives consumers a private right of action through the Washington Consumer Protection Act, which creates substantial legal exposure for businesses that get consent wrong.

How to Prepare for the MHMDA

1. Find your consumer health data. Review your forms, apps, analytics and advertising tags for data that can relate to a consumer's health.
2. Separate the two consents. Ask for consent to collect and consent to share as two different choices, both off by default.
3. Write clear disclosures. Explain in each consent request what you collect or share, why, with whom, and how to withdraw.
4. Publish your Consumer Health Data Privacy Policy. Link to it prominently from your homepage.
5. Block tags until consent. Do not let tags that collect or share consumer health data run before the consumer opts in.
6. Keep records. Store each consent and withdrawal so you can show what the consumer chose and when.
7. Handle sales separately. If you sell consumer health data, get a separate signed authorization.

Frequently Asked Questions

What is the Washington My Health My Data Act?

The My Health My Data Act (RCW 19.373) is a Washington state law that protects consumer health data. It requires opt-in consent to collect consumer health data, a separate consent to share it and a signed authorization to sell it.

When did the MHMDA take effect?

It has applied since March 31, 2024 for most regulated entities and since June 30, 2024 for small businesses.

Does the MHMDA require opt-in consent?

Yes. Collecting consumer health data needs opt-in consent and sharing it needs a separate consent, unless it is necessary to provide a product or service the consumer requested. Consent must be a clear affirmative act: freely given, specific, informed, opt-in, voluntary and unambiguous.

Can one consent cover both collecting and sharing health data?

No. The consent to collect and the consent to share must be requested separately and cannot be combined. Selling consumer health data needs a further, signed authorization.

What is a Consumer Health Data Privacy Policy?

It is a separate privacy policy that discloses the categories of consumer health data you collect, the purposes and the sources. You must publish it and place a prominent link to it on your homepage.

How is the MHMDA enforced?

By the Washington Attorney General and through a private right of action under the Washington Consumer Protection Act, which creates substantial legal exposure.

How UniConsent Helps with MHMDA Compliance

UniConsent lets you ask for the two MHMDA consents in your consent banner and keep proof of each choice:

• Washington consumer health data template. In the dashboard, the Washington consumer health data custom purpose template creates two separate purposes, health_data_collection and health_data_sharing. Both are marked as sensitive and mapped to IAB GPP sensitive data category 13 (consumer health data).
• Explicit opt-in for US visitors. US visitors must opt in to sensitive purposes explicitly. Accepting the banner does not grant them.
• IAB GPP signal. The choice is sent in the IAB GPP string, so your partners can read it.
• Proof of consent. Each choice is recorded in the Consent DB. See the Consent Audit Trail.
• Apps too. Use the same purposes in your apps through the mobile SDKs, with getCustomConsents() to read the choices and setCustomConsent to record a choice made in your own screens.
• Your own wording. Edit the template text to match your data and your Consumer Health Data Privacy Policy.

Learn how to set it up in the Custom Purposes guide, compare other US state privacy laws and the CCPA, or create a free UniConsent account.

This page is general information, not legal advice. Check how the MHMDA applies to your business with your legal advisers.