Compliance guide · Updated 2026

The My Health My Data Act: Who It Applies To, Penalties, and How to Comply

RCW 19.373 · Washington's comprehensive consumer health data privacy law

The Washington My Health My Data Act (WMHMDA), codified at RCW 19.373, is one of the most aggressive state health-data privacy laws in the United States. Unlike HIPAA, it sweeps far beyond covered healthcare entities — it reaches apps, websites, wearable makers, wellness services, and online businesses of every size that handle health-related data of Washington residents.

Who it applies to — no threshold

WMHMDA applies to any legal entity that operates a commercial website, online service, online application, or similar product and collects or processes consumer health data of Washington residents. There is no revenue minimum, no number of users, and no employee threshold. A solo founder's fitness app is a regulated entity to the same extent as a national retailer — the first WMHMDA class action, filed against Amazon in February 2025, makes the point: plaintiffs' lawyers maximize exposure against big names, but the private right of action applies to every regulated entity.

What "consumer health data" means

Consumer health data is personal information linked or reasonably linkable to a consumer that relates to past, present, or future physical or mental health. The statute's definition includes:

• Fitness and activity data
• Sleep data
• Nutrition and diet data, and weight
• Reproductive health data
• Mental health data
• Biometric data (heart rate, gait, fingerprints, voice patterns)
• Medication data
• Health-related precise location data (visits to clinics, hospitals, or other health facilities)

The last item is why even non-health apps get sued: a location SDK can reveal fertility-clinic or urgent-care visits, turning ordinary location data into consumer health data.

The 5 core obligations

1. Privacy policy: post a Consumer Health Data Privacy Policy describing categories of health data collected, sources, purposes, categories of third parties with whom data is shared (including names), and how consumers may exercise rights.
2. Opt-in consent: obtain consent before collecting or sharing consumer health data — separate, informed, and not buried in terms of service. Consent to sharing must be obtained separately from consent to collection.
3. Valid authorization to sell: before selling consumer health data, obtain a separate authorization that identifies the purchaser, the data sold, and how it will be used, with revocation language. It expires one year after signature.
4. Consumer rights: honor requests to confirm collection, access data, delete data, withdraw consent, and receive a list of third parties with whom data was shared or sold.
5. Retention and deletion: implement a retention schedule, delete or de-identify when retention ends or on request, and require third parties to delete as well.

Penalties and the private right of action

Enforcement is two-track. Washington's Attorney General can pursue civil penalties of up to $7,500 per violation, plus injunctive and equitable relief. Separately, WMHMDA creates a private right of action: consumers can sue directly for actual damages, and courts may award statutory damages of up to $25,000 per violation plus attorney fees. See the full breakdown in our WMHMDA penalties guide.

First lawsuits

Enforcement began within months of the law's key provisions taking effect. The first class action (Maxwell v. Amazon) was filed on February 10, 2025, alleging collection and monetization of health-related location data through mobile-app SDKs without consent — the first major test of the statute.

FAQ