Law / United States / 
Washington
Washington My Health My Data Act (MHMDA)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence, User location
- Audit expectation
- none
What it requires
- Washington's My Health My Data Act reaches consumer health data broadly: personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status, including inferences and non-health data that indicate a health status, such as location data suggesting an attempt to obtain reproductive or gender-affirming care.
- Do not implement a geofence around an entity that provides in-person health care services to identify or track consumers seeking care, collect their health data, or send them related notifications, messages, or advertisements.
- A violation of this Act is per se an unfair or deceptive act under the Washington Consumer Protection Act, which carries its own private right of action; a federal class action alleging SDK-based location and biometric data harvesting in violation of this Act is reported pending by secondary commentary, not independently confirmed against the court docket.
These lines are LexLint's reading of the law's text. Also read by: Washington State Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy
- Guidance body
- Washington State Office of the Attorney General
- Open questions
- Must both prongs of "publicly available information" in RCW 19.373.010(22) be met, so that information posted by someone other than the consumer is not publicly available even when it appears in "widely distributed media"?
- What counts as biometric data "collected about a consumer by a business without the consumer's consent" under RCW 19.373.010(22) when a business derives it from images the consumer posted publicly?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Event time, Actor identity, Affected person reference, Consent or opt-out state, Data lineage
Log retention
RCW 19.373.070(5): six years from the date of signature or the date the authorization was last in effect, whichever is later.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
A person may not sell or offer to sell consumer health data without a signed valid authorization, separate from the consent to collect or share, that names the data, the seller, the purchaser, the purpose, a one-year expiration and the consumer's signature and date (070(1) and (2)); the consumer is given a copy (070(4)); and both seller and purchaser keep a copy for six years from signature or from the day it was last in effect, whichever is later (070(5)). A small business complies from (070(6)). The chapter requires a consumer health data privacy policy (020) and a data security programme (050), and has the processor work under a binding contract (060), but none of those sections states a log, audit or production duty. Enforcement is through the consumer protection act (090); no power to demand records is stated in the chapter. The scope hook is stated in the definitions of regulated entity and consumer.
- Kind
- Explicit
- As of
- Provision
- RCW 19.373.070(5) (the seller and the purchaser of consumer health data each retain a copy of every valid authorization for sale for six years)
- Trigger
- consent_or_optout
What this law does
MHMDA defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, a definition that reaches inferences and non-health data indicating health status, such as precise location data that could indicate an attempt to obtain reproductive or gender-affirming care.
Because 'consumer health data' is itself defined as a subset of 'personal information,' and 'personal information' does not include publicly available information (RCW 19.373.010(18)(b)) or deidentified data, scraped health-indicating data that fits MHMDA's own publicly-available definition falls outside its coverage; that carve-out, however, does not extend to biometric data, which MHMDA's 'publicly available information' definition expressly excludes even when otherwise public (RCW 19.373.010(22)).
RCW 19.373.080 makes it unlawful to implement a geofence around an entity providing in-person health care services to identify or track consumers, collect their health data, or send them related notifications, messages, or advertisements. RCW 19.373.090 provides that any violation of the chapter is per se an unfair or deceptive act under the Washington Consumer Protection Act, chapter 19.86 RCW, which carries a long-standing private right of action, giving MHMDA its own enforcement mechanism.
MHMDA's private right of action has already been tested: Maxwell v. Amazon.com, Inc., No. 2:25-cv-261 (W.D. Wash., filed ), a putative class action alleging Amazon harvested location and biometric data via SDKs without consent in violation of MHMDA, was consolidated by court order into In re Amazon Ads SDK Litigation, No. 2:25-cv-00252-BJR (W.D. Wash.), effective .
When LexLint raises it
When your app profile says your app crawls the web, trains models or sends automated outreach.
Back to the example · Lint your app
Page updated .