Free download · No email required
WMHMDA 12-Point Compliance Checklist
Run through these 12 items to see where you stand under the Washington My Health My Data Act (RCW 19.373). Generate the one-page PDF below instantly — no email, no signup.
- Posted privacy policy — Consumer Health Data Privacy Policy covering categories, sources, purposes, third parties, and rights.
- Opt-in, unambiguous consent — obtained before any collection beyond what's strictly necessary.
- Separate consent for sharing — sharing consent obtained apart from collection consent.
- No dark patterns — no pre-checked boxes, repeated prompts after decline, or confusing choice language.
- Valid, signed authorization before any sale — naming the purchaser, expiring within 1 year.
- Retention schedule documented — per category, with a defined disposal or de-identification method.
- Deletion process + cascading third-party notification — delete or de-identify on request, and require recipients to delete too.
- Rights-request intake published — 45-day (+45-day extension) response process, no fee for the first request per year.
- No geofencing around health facilities — WMHMDA bans geofencing mental health, reproductive/sexual health, or other health care facilities.
- No retaliation for rights exercise — no discrimination, denial of service, or price difference for exercising rights.
- Vendor contracts require deletion flows — agreements with processors/third parties include deletion obligations.
- Annual review — compliance program reviewed at least yearly, and after any law change or enforcement action.
No email required · One page · Print it and tick it off
Failing any item? Generate the documents.
The WMHMDA Compliance Pack produces your privacy policy, opt-in consent form, sale authorization, retention schedule, and rights request form from RCW 19.373 — read everything free before you pay.
Generate My Compliance Pack — $99FAQ
Is the WMHMDA checklist really free?
Yes. The 12-point checklist PDF downloads instantly with no email address or signup required.
What if I'm failing several items on the checklist?
The WMHMDA Compliance Pack generates the actual documents — privacy policy, consent form, sale authorization, retention schedule, and rights request form — built from RCW 19.373, for $99 one-time.
Does this checklist cover the private right of action risk?
Yes — items like opt-in consent, sale authorization, and non-retaliation directly address the obligations most often cited in WMHMDA private lawsuits and AG enforcement.