What is Washington My Health My Data Act (MHMD)?

MHMD was passed in 2023 to cover the health data that HIPAA does not: information held by apps, websites, retailers, and advertisers rather than by doctors and insurers. Its defining feature is breadth. 'Consumer health data' means personal information linked to a consumer that identifies their past, present, or future physical or mental health status — expressly including conditions and diagnoses, reproductive and gender-affirming care, biometric data, and even inferences about health derived from non-health data such as purchases or browsing.

The obligations invert the usual US model: regulated entities need opt-in consent before collecting consumer health data beyond what is necessary to provide a requested service, and a separate, distinct authorization before selling it. Consumers hold rights to access, withdraw consent, and have their health data deleted — a deletion right with unusually few exceptions. The law also bans geofencing within 2,000 feet of facilities that provide in-person health care services when used to track or message consumers about their care.

Scope extends past Washington's borders in two ways: it protects Washington residents and any person whose consumer health data is collected in Washington, and it covers businesses that merely target Washington consumers. There are no volume thresholds for regulated entities — small businesses simply got a later start date.

Enforcement is the sharp edge: violations are per se violations of Washington's Consumer Protection Act, enforceable by the Attorney General and by consumers directly through a private right of action. That structure has already generated class actions against retailers and ad-tech-heavy websites whose trackers touched health-adjacent data.