Key points

• The My Health My Data Act (MHMDA) regulates consumer health data collected by businesses that are not covered by HIPAA, including apps, retailers, wearables and advertisers.
• It applies broadly: it covers data that identifies past, present or future physical or mental health status, and it reaches businesses that handle data about Washington residents wherever the business is located.
• It requires a separate consumer health data privacy policy, consent to collect and separate consent to share, and valid authorization to sell. Geofencing around health care facilities is restricted.
• Unlike most state privacy laws, it can be enforced through private lawsuits under the Washington Consumer Protection Act.
• Other states have followed with similar laws. A single compliance approach that meets the strictest standard is the practical answer.

Why the Act matters

HIPAA protects health information held by covered entities, such as providers and health plans, and their business associates. Much health-related data sits outside that framework: a fitness app, a retailer tracking pregnancy-related purchases, a fertility tracker, a pharmacy loyalty program, an advertising platform. Washington enacted the MHMDA to fill the gap. It took effect for most businesses in March 2024, with a later date for small businesses, and it has become a reference point for state health privacy legislation.

Companies in healthcare and life sciences should not assume that HIPAA compliance is enough. A digital health company can be a covered entity for some data and a regulated entity under the MHMDA for the rest.

What counts as consumer health data

The Act defines consumer health data as personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present or future physical or mental health status. The definition includes obvious categories, such as health conditions, treatments, medication and reproductive or sexual health information, and also biometric data, genetic data, precise location information that could indicate an attempt to obtain health care, and data that is inferred from non-health information. That last category matters for marketing. An algorithm that infers a health condition from browsing or purchasing behavior can create regulated data.

There are exemptions, including for protected health information under HIPAA, certain clinical research data and data governed by other federal laws. Careful scoping is needed because the exemptions are specific.

Core obligations

A regulated entity must publish a separate consumer health data privacy policy, linked from its homepage, rather than burying the information in a general privacy notice. It must obtain consent before collecting or sharing consumer health data, other than as necessary to provide a product or service the consumer requested, and the consent to share must be separate from the consent to collect. Selling consumer health data requires a signed valid authorization with prescribed content, and the authorization expires after a year.

Consumers have rights to confirm whether data is collected, to access it, to withdraw consent and to delete it, and the deletion right extends to data held by processors and affiliates. Regulated entities must restrict access to employees and processors who need it, and adopt reasonable data security practices. Processors need a binding contract.

The Act also prohibits geofencing within 2,000 feet of a facility that provides in-person health care services if it is used to identify consumers seeking care, to collect data or to send notifications and advertising related to health data.

Private enforcement

A violation is treated as an unfair or deceptive practice under the Washington Consumer Protection Act, which allows enforcement by the attorney general and by private plaintiffs. This is the aspect that most concerns companies. Plaintiffs’ lawyers have begun to bring claims against companies whose websites and apps use tracking technology that may collect health-related data without the required consent. Courts have only begun to define the standards, including what injury is needed to sue under the state statute, and the answers will shape the risk.

Other states

Nevada has enacted a consumer health data law in a similar form, but without a private right of action. Connecticut amended its privacy act to add protections for consumer health data, and a number of other states have added sensitive health data provisions, including for reproductive health information, to their comprehensive privacy laws. Companies operating nationally will find that the MHMDA is the highest watermark, and aligning to it avoids a state-by-state patchwork.

A practical program

Begin with a data inventory that identifies where health-related data is collected, including inferred data, and the third parties who receive it, including advertising and analytics vendors. Review tracking technologies on sites and apps, since the sharing of health-related data with advertising networks is the most common source of claims.

Draft and publish the consumer health data privacy policy, and implement consent flows that separate collection from sharing. Update vendor contracts so that processors are bound by the required terms. Build the rights request process so that deletion reaches processors and affiliates. Train marketing and product teams on what counts as health data and on the limits on geofencing and inferred data.

Document the analysis. If your position is that data falls under an exemption, record why.

Life sciences and digital health considerations

Digital health companies, pharmacy retailers, medical device makers with consumer-facing apps and clinical trial recruiters should look carefully at the boundary between HIPAA and the MHMDA. Patient support programs, wellness features and direct-to-consumer services often involve data that moves between regulated and unregulated settings, and the controls must travel with it.

Tomás Ellery-Vance in Washington, D.C. advises healthcare, life sciences and consumer companies on health privacy, tracking technology litigation and regulatory engagement. See also our work with clients in the Healthcare & Life Sciences industry group.