Definitive reference · Continuously updated · v1.0 — Sep 2026
The WMHMDA Compliance Map: Requirements, Examples, Documents, and Implementation Checklist
In short: Every regulated entity needs 5 things on file — a privacy policy, opt-in consent (collection + sharing, separately), a sale authorization if you sell data, a retention/disposal schedule, and a consumer-rights process — plus a ban on geofencing near health facilities. Jump to any section below, or generate your documents now.
Jump to a section
Terminology · Data categories · Collect vs. share vs. sell · Provision-by-provision map · Consent examples · Consumer request workflow · Geofencing · Operational steps · Downloadable checklist · Version history
Generate My Compliance Pack — $99.99Read the full compliance map
Terminology: WMHMDA, MHMDA, HB 1155, and common misspellings
The Washington My Health My Data Act is most often abbreviated WMHMDA, and sometimes shortened further to MHMDA (dropping the state initial). It's codified at RCW 19.373, and it started life in the legislature as House Bill 1155 (HB 1155) — the bill Washington's governor signed into law on April 27, 2023. If you've seen the law referenced only by its bill number, HB 1155 and WMHMDA/MHMDA are the same statute. Because the acronym is unusual, it's frequently mistyped — you may see it written as WMHDA, WHMDA, MHDA, or even "Washington Health My Data Act." All of these refer to the exact same statute. Throughout this map we use WMHMDA and MHMDA interchangeably and note RCW 19.373 wherever a specific provision is cited, so you can verify each claim against the statute directly. For the statutory wording itself, section by section, see the full My Health My Data Act text (RCW 19.373).
Data categories and examples
| Category | Real-world examples |
|---|---|
| Fitness & activity data | Step counts, workout logs, heart-rate zones, exercise streaks |
| Sleep data | Sleep-cycle phases, hours slept, snoring detection |
| Nutrition & diet data | Calorie tracking, weight-loss goals, meal-plan subscriptions |
| Reproductive / sexual health data | Period and fertility tracking, contraception purchase history |
| Mental health data | Mood journaling, stress scores, therapy-adjacent app usage |
| Medication data | Medication reminders, dosage adherence, pharmacy refill history |
| Biometric data | Heart rate, gait analysis, fingerprint/voiceprint identification |
| Health-related precise location | GPS data revealing a visit to a clinic, hospital, or pharmacy |
| Inferences from other data | Purchasing patterns used to infer pregnancy or a health condition |
See our full consumer health data examples guide for the complete breakdown, category by category.
Collection vs. sharing vs. sale — three different rules
One of the most common compliance mistakes is treating "collect," "share," and "sell" as interchangeable. WMHMDA treats them as three distinct triggers, each with its own consent requirement:
- Collection requires disclosure in your privacy policy plus opt-in consent before collecting beyond what's strictly necessary for the product or service requested.
- Sharing with any third party or affiliate requires a separate opt-in consent from the consent to collect — you cannot bundle them into a single checkbox.
- Sale — defined broadly as any exchange of data for money or anything of value — requires a specific, signed, revocable authorization naming the purchaser, expiring within one year, entirely separate from ordinary sharing consent.
Provision-by-provision map
| Provision | Plain-language requirement | Document that satisfies it |
|---|---|---|
| Privacy policy disclosure | Post categories collected, sources, purposes, third parties, and consumer rights | Consumer Health Data Privacy Policy |
| Opt-in consent to collect | Unambiguous, separate consent before collecting beyond what's necessary | Opt-in Consent Form |
| Opt-in consent to share | A second, separate consent before sharing with third parties | Opt-in Consent Form, Part B |
| Authorization to sell | Signed, revocable, 1-year authorization naming the purchaser | Valid Authorization to Sell |
| No dark patterns | No pre-checked boxes, repeated prompts after decline, or confusing UI | Consent Form design + internal policy |
| Geofencing ban | No geofence around health facilities to track/message/collect data | Internal SDK audit (see geofencing guide) |
| Consumer rights | Access, deletion, withdrawal, appeal, non-discrimination, 45-day response | Consumer Rights Request Form |
| Retention & disposal | Documented retention period and disposal/de-identification method | Data Retention & Disposal Schedule |
Consent examples: compliant vs. non-compliant
Non-compliant: "By using this app, you agree to our Terms of Service and Privacy Policy, which may include collection and sharing of health-related data." (Bundled, buried, not opt-in, not separated between collection and sharing.)
Compliant: A standalone screen stating exactly which categories of data will be collected (e.g., "sleep data, heart rate"), for what specific purpose, with an unchecked box the user must actively check — followed by a separate, distinct unchecked box for sharing with named categories of third parties, with no penalty for declining either.
See our WMHMDA consent form guide for the full required structure, and the required consumer-facing acknowledgments.
Consumer request workflow
- Log the request with a timestamp on receipt.
- Verify identity using the minimum information necessary.
- Locate all consumer health data across production, backup, and vendor systems.
- Action the specific right requested (access, deletion, withdrawal, appeal).
- For deletion, cascade the instruction to every third party that received the data.
- Respond within 45 days (extendable once by 45 more, with notice).
- Log the full resolution for your audit trail.
Full detail in our consumer rights request process guide.
Geofencing restriction, summarized
No geofence (roughly 2,000 feet) around a mental health, reproductive/sexual health, or other health care facility may be used to identify/track a consumer, collect their consumer health data, or send them related notifications, messages, or ads. This is frequently violated unintentionally through third-party advertising SDKs. Full explainer: WMHMDA geofencing ban.
Required vs. recommended operational steps
| Required by statute | Recommended best practice |
|---|---|
| Posted privacy policy with specific disclosures | Plain-language summary above the legal text |
| Opt-in consent (collection + sharing, separately) | Granular per-category consent toggles |
| Signed authorization before any sale | Annual re-confirmation even if you don't currently sell data |
| 45-day rights-request response | Dedicated privacy inbox monitored daily |
| Documented retention/disposal method | Automated deletion pipelines, not manual |
| No geofencing around health facilities | Full SDK/vendor location-data audit annually |
Downloadable checklist
We publish a free, no-email-required 12-point PDF checklist you can use to self-audit today: WMHMDA 12-Point Compliance Checklist.
Turn this map into your actual documents
The WMHMDA Compliance Pack generates all 5 documents referenced throughout this map — privacy policy, consent form, sale authorization, retention schedule, and rights request form — built from RCW 19.373, with your business's specifics filled in. Read everything free before you pay.
Generate My Compliance Pack — $99.99Version history
- v1.0 — September 2026: Initial publication of the WMHMDA Compliance Map, covering all core provisions, data categories, consent examples, the consumer rights workflow, and the geofencing restriction.
FAQ
What is the WMHMDA Compliance Map?
A single, continuously updated reference mapping every RCW 19.373 provision to plain-language requirements, examples, and the documents needed to comply.
Is WMHMDA the same as MHMDA or WMHDA?
Yes — WMHMDA and MHMDA both refer to the Washington My Health My Data Act. WMHDA and WHMDA are common misspellings of the same law.
Who is this compliance map for?
Founders and product teams determining scope, privacy consultants and attorneys mapping obligations, and developers implementing consent flows.
Does this replace legal advice?
No — it's a structured reference and starting point, not legal advice. Have a qualified attorney review your specific implementation.
Is WMHMDA the same law as House Bill 1155 (HB 1155)?
Yes — HB 1155 was the bill number before it was signed into law April 27, 2023. Once enacted it became RCW 19.373, commonly called WMHMDA or MHMDA. All four names refer to the identical statute.