What Is the My Health My Data Act?
The My Health My Data Act (MHMDA) is a comprehensive privacy law enacted to protect Washington residents from unauthorized collection and misuse of their health-related data. Unlike HIPAA, which only applies to specific healthcare entities, RCW 19.373 covers a much broader range of businesses, including those not traditionally considered part of the healthcare system.
This law applies to any entity that conducts business in Washington or targets Washington consumers, regardless of where the company is based. That includes small businesses, nonprofits, and digital platforms that collect or infer health data through apps, websites, or online services.
Why This Law Is Important
The MHMDA addresses a major gap in consumer protection. Many digital platforms collect health-related data without being subject to HIPAA regulations. This includes apps that track menstrual cycles, mental health platforms, online pharmacies, and even retailers selling health-related products.
Under RCW 19.373, Washington residents now have legal protections over data such as:
- Reproductive health information;
- Gender-affirming care data;
- Biometric identifiers (e.g., fingerprints, facial recognition);
- Location data that reveals attempts to seek healthcare.
This law ensures that consumers have control over how their health data is collected, used, and shared.
Key Definitions in RCW 19.373
To understand the scope of the law, it’s essential to grasp how it defines consumer health data. This includes any personal information that is linked or reasonably linkable to a consumer and that identifies their physical or mental health status.
Importantly, this definition also includes inferred data, such as information derived from purchases, location tracking, or online behavior. Biometric data and information related to reproductive or gender-affirming care are explicitly covered.
Business Obligations Under RCW 19.373
Businesses that collect or process consumer health data must comply with strict requirements under the law. These include:
Enforcement and Legal Remedies
Violations of RCW 19.373 are considered per se violations of Washington’s Consumer Protection Act. This means they are automatically deemed unfair or deceptive practices under the law.
Consumers can pursue:
- Private lawsuits;
- Class action litigation;
- Enforcement actions by the Washington Attorney General.
This gives Washington residents strong legal standing to hold companies accountable for mishandling their health data.
Impact on Digital Goods and Services
The My Health My Data Act has significant implications for companies offering digital goods and services that involve health-related data. This includes:
- Fitness and wellness apps;
- Online mental health platforms;
- E-commerce sites selling health supplements or medical devices.
If these platforms collect or infer health data, they must comply with RCW 19.373, even if they are not physically located in Washington. Businesses must now audit their data practices and ensure they meet the law’s requirements.
