WMHMDA Consumer Rights: How to Handle Access, Deletion & Withdrawal Requests

The five consumer rights WMHMDA creates

1. Right to confirm and access. Consumers can confirm whether you're collecting, sharing, or selling their consumer health data, and receive a list of the third parties and affiliates it has been shared with or sold to — including an active email or other online mechanism to contact each recipient.
2. Right to withdraw consent. Consumers can withdraw consent to collection or sharing at any time, at no cost.
3. Right to deletion. Consumers can have their consumer health data deleted from your records — and you must instruct any third party or affiliate that received it to delete it too, unless retention is legally required.
4. Right to appeal. Consumers can appeal a decision you make on their request.
5. Right to non-discrimination. You may not deny goods or services, or charge a different price, because a consumer exercised any of these rights — except to the extent the data was genuinely necessary for the specific product or service they requested.

The 45-day response clock

Once you receive a verified request, you have 45 days to respond. If reasonably necessary, you may extend that once by an additional 45 days — but only if you notify the consumer of the extension and the reason for it within the original 45-day window. Silence past the deadline, or an unexplained extension, is itself a compliance failure independent of how you ultimately resolve the request.

Identity verification: required, but limited

You're allowed to ask for reasonably necessary additional information solely to verify the requester's identity before acting on a request. Two important limits: that verification information cannot be used for any other purpose, and it should be deleted once verification is complete. Asking for excessive or irrelevant information as a de facto barrier to filing requests is a red flag both to regulators and to plaintiffs' attorneys.

Step-by-step: what to do when a request arrives

1. Log the request immediately with a timestamp — this is what your 45-day clock is measured against.
2. Verify identity using the minimum information reasonably necessary.
3. Locate all consumer health data associated with that consumer — across production databases, backups, logs, analytics platforms, and any vendor or processor systems.
4. Determine the specific right(s) being exercised (access, deletion, withdrawal, or appeal) and act on each accordingly.
5. For deletion requests, delete or de-identify the data per your documented disposal method, then notify every third party and affiliate that received the data and instruct them to delete it as well.
6. For access requests, compile the confirmation and the list of recipients with active contact mechanisms for each.
7. Respond to the consumer within the 45-day window (or the extended 90-day window, with notice given in time).
8. Document everything — the request, the verification steps, the actions taken, the systems and vendors involved, and the completion date — for your own audit trail.

Why "we'll just handle it case by case" is a losing strategy

Ad hoc handling creates two separate risks. First, without a documented process, it's very easy to miss the 45-day deadline on a request that arrives through an unusual channel (a support ticket, a social media DM, a generic contact form) rather than a clearly labeled privacy request. Second, in litigation, having a written, consistently followed rights-request process is direct evidence of good-faith compliance — while having no process at all invites the inference that no request has ever been properly honored.