Personal health data is collected more widely than ever, often outside traditional healthcare settings. From fitness trackers to mental health apps, sensitive information is being gathered, stored, and sometimes sold without clear consumer consent. Recognizing this growing concern, Washington State passed the My Health My Data Act (RCW 19.373), a groundbreaking privacy law that expands protections for consumer health data far beyond federal standards.
What Is the My Health My Data Act?
The My Health My Data Act (MHMDA) is a comprehensive privacy law enacted to protect Washington residents from unauthorized collection and misuse of their health-related data. Unlike HIPAA, which only applies to specific healthcare entities, RCW 19.373 covers a much broader range of businesses, including those not traditionally considered part of the healthcare system.
This law applies to any entity that conducts business in Washington or targets Washington consumers, regardless of where the company is based. That includes small businesses, nonprofits, and digital platforms that collect or infer health data through apps, websites, or online services.
Why This Law Is Important
The MHMDA addresses a major gap in consumer protection. Many digital platforms collect health-related data without being subject to HIPAA regulations. This includes apps that track menstrual cycles, mental health platforms, online pharmacies, and even retailers selling health-related products.
Under RCW 19.373, Washington residents now have legal protections over data such as:
- Reproductive health information;
- Gender-affirming care data;
- Biometric identifiers (e.g., fingerprints, facial recognition);
- Location data that reveals attempts to seek healthcare.
This law ensures that consumers have control over how their health data is collected, used, and shared
Key Definitions in RCW 19.373
To understand the scope of the law, it’s essential to grasp how it defines consumer health data. This includes any personal information that is linked or reasonably linkable to a consumer and that identifies their physical or mental health status.
Importantly, this definition also includes inferred data, such as information derived from purchases, location tracking, or online behavior. Biometric data and information related to reproductive or gender-affirming care are explicitly covered.
Consumer Rights Under the My Health My Data Act
Washington residents now have several powerful rights under RCW 19.373:
Right to Know
Consumers can request a detailed account of what health data is being collected, how it’s being used, and with whom it’s being shared.
Right to Delete
Consumers have the right to request deletion of their health data from a company’s systems. This includes data held by third parties with whom the company has shared the information.
Right to Withdraw Consent
If a consumer previously consented to data collection or sharing, they can revoke that consent at any time. Businesses must honor this request promptly.
Right to Appeal
If a company denies a consumer’s request, the consumer has the right to appeal the decision. Businesses must provide a clear process for handling appeals.
Business Obligations Under RCW 19.373
Businesses that collect or process consumer health data must comply with strict requirements under the law. These include:
Why AB 2426 Matters for Consumers
This legislation is a major win for consumer rights. It ensures that buyers are not misled by false advertising into believing they own digital products when they are actually subject to licensing restrictions. By requiring transparency, AB 2426 empowers consumers to make informed decisions and protects them from unexpected loss of access.
For California residents, this law reinforces the state’s commitment to holding businesses accountable for deceptive marketing practices. It also sets a precedent that other states may follow as digital commerce continues to evolve.
Clear Privacy Policies
Companies must publish a consumer health data privacy policy on their homepage. This policy must clearly disclose:
- What data is collected;
- Why it’s collected;
- How it’s used;
- Who it’s shared with;
- How consumers can exercise their rights.
Affirmative Consent
Businesses must obtain clear, opt-in consent before collecting, using, or sharing consumer health data. Consent must be separate from general terms of service and cannot be obtained through deceptive design.
Restrictions on Data Sharing and Selling
Health data cannot be sold without a valid, signed authorization from the consumer. Sharing data with third parties also requires explicit consent unless it’s necessary to provide a requested service.
Geofencing Restrictions
It is illegal to use geofencing technology to target consumers near healthcare facilities for advertising or data collection purposes. This provision is especially important for protecting individuals seeking sensitive care, such as reproductive or mental health services.
Enforcement and Legal Remedies
Violations of RCW 19.373 are considered per se violations of Washington’s Consumer Protection Act. This means they are automatically deemed unfair or deceptive practices under the law.
Consumers can pursue:
- Private lawsuits;
- Class action litigation;
- Enforcement actions by the Washington Attorney General.
This gives Washington residents strong legal standing to hold companies accountable for mishandling their health data.
Impact on Digital Goods and Services
The My Health My Data Act has significant implications for companies offering digital goods and services that involve health-related data. This includes:
- Fitness and wellness apps;
- Online mental health platforms;
- E-commerce sites selling health supplements or medical devices.
If these platforms collect or infer health data, they must comply with RCW 19.373, even if they are not physically located in Washington. Businesses must now audit their data practices and ensure they meet the law’s requirements.
What You Should Know
At Emery | Reddy, PC, we are committed to protecting Washington workers and consumers from deceptive and unlawful practices. If you believe your health data has been collected, shared, or sold without your consent, you may have a claim under RCW 19.373.
Our legal team can help you:
- Understand your rights under the My Health My Data Act;
- File complaints or legal claims against violators;
- Pursue compensation for privacy violations.
Whether your data was collected by a fitness app, a telehealth platform, or a retail website, you deserve transparency and control over your personal health information.
Protect Your Rights
Washington’s My Health My Data Act marks a new era in consumer privacy. By expanding protections beyond HIPAA and targeting deceptive data practices, the law empowers consumers and holds businesses accountable.
For consumers, this means greater control over sensitive health data. For businesses, it means a new standard of transparency and compliance. And for legal advocates like Emery | Reddy, it provides a powerful tool to fight for justice on behalf of Washington residents.
Concerned about a Privacy Violation?
Contact Emery | Reddy today for a free case review. We’re here to help you protect your rights and pursue justice under Washington’s consumer protection laws.
have your rights been violated?
Contact Us Today
Contact Us for a FREE Case Review.
No Fee Unless We Recover for You.
Want More Information?
A data breach occurs when sensitive or confidential information is accessed, stolen, or exposed without authorization. If you have been the victim of a data breach, contact Emery | Reddy today.
A document review is a comprehensive consultation and analysis of your document’s legal language, context, and impact on your worker’s rights as an employee of Washington state.
In today’s digital landscape, cyberattacks and data breaches have become alarmingly common, compromising the personal and financial information of millions of individuals.
We fight for you
Meet the Team
If you’ve been injured on the job or are dealing with a difficult Washington state L&I claim, the experienced L&I Attorneys at Emery | Reddy, PC are here to help. We represent Washington state workers in Labor and Industries (L&I) claims and Employment Law disputes.
With over 80 years of combined experience, our L&I Lawyers understand how the Washington State Department of Labor & Industries (L&I) — and large employers — operate. We use that knowledge to help injured workers recover time-loss, medical benefits, vocational rehabilitation, PPD awards, and L&I pensions. Our legal team also holds employers accountable for wrongful termination, retaliation, and wage violations.
Don’t navigate your L&I claim alone. Contact the trusted L&I Attorneys at Emery | Reddy for a Free Case Review with an experienced Intake Specialist to learn more about how Emery | Reddy may be able to help. No fee unless we recover for you.
Serving Seattle, Tacoma, Spokane, Everett, and workers across Washington state.
“Excellent help and dedication. Thank you for standing up for those that get taken advantage of. It matters.”
— John B.
Receive a
FREE Case Review