WMHMDA FAQ

If you conduct business in Washington or target Washington consumers, and you collect, process, share or sell data that identifies or allows inference of someone's health status, it likely applies — regardless of size or industry. Because inferences count, businesses that don't consider themselves health companies are frequently in scope. Run the free scope check.

Very likely yes if you serve Washington consumers. The act follows the consumer, not your location — no Washington office, employees or servers required. See WMHMDA outside Washington.

No. There's no revenue or headcount exemption. The act defines "small business" only to set a later compliance deadline — that delayed when obligations started, it didn't remove them. See WMHMDA for solo founders.

Signed in 2023; main obligations began 31 March 2024 for most entities and slightly later for small businesses as defined. The geofencing ban started earlier, in July 2023. It's fully live now.

There's no broad non-profit exemption, so a non-profit collecting consumer health data from Washington residents may well be in scope. Certain data remains excluded, such as HIPAA-regulated information. Don't assume exemption on status alone.

The act focuses on consumer data, and pure employment-context data is generally treated differently. But wellness programs, benefits platforms and third-party vendors often process health data that can fall in scope — see employee wellness programs. Fact-specific; worth counsel review.

Obligations apply to ongoing processing, so data you continue to hold, use, share or sell after the effective date is in scope even if collected earlier. Businesses typically re-obtain consent, restrict processing, or delete what they can't justify keeping.

Personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status — conditions, treatments, medications, bodily functions, vital signs, reproductive and sexual health, gender-affirming care, biometrics, precise location suggesting an attempt to obtain health services, and inferences from non-health data. See the full examples list.

Generally yes. Step counts, heart rate, sleep, workouts, calories, mood tracking and cycle data are all consumer health data when linked to an identifiable person. See fitness apps and wellness apps.

No. HIPAA covers providers, plans, clearinghouses and business associates. WMHMDA was written to cover what HIPAA leaves out — most apps, retailers, wellness vendors and adtech. HIPAA-regulated data is generally excluded from WMHMDA. See WMHMDA vs HIPAA.

They can. If an SDK, pixel or tag receives events revealing or allowing inference of a health condition, that's likely sharing — and possibly a sale if value is exchanged. Most exposure hides in third-party tags nobody audited. See analytics & SDKs.

Yes, and this is the provision that catches people out. Deriving a likely condition from shopping history, browsing, or location creates regulated data even though the consumer never told you anything medical.

No. Consent must be a clear affirmative act — freely given, specific, informed — and can't come from accepting general terms covering unrelated matters. Pre-ticked boxes, inactivity and dark patterns don't work. Collection and sharing consents are separate.

Sharing is disclosure to a third party and needs separate opt-in consent. Selling is exchange for monetary or other valuable consideration and needs a distinct authorization on top. "Other valuable consideration" is broad — referral fees, data-for-services trades and cross-marketing swaps can all count.

Yes. A valid authorization must identify the specific purchaser, describe the data and purpose, state the revocation right, warn that data may lose protection once sold, and expire after one year. Both parties keep a copy for six years.

Sale authorizations: six years from signature or last processing, whichever is later. For ordinary collection and sharing consents the act sets no single fixed period, but you must be able to evidence valid consent — most businesses retain comparably, alongside a documented retention schedule.

You may not geofence around an entity providing in-person health care services to identify or track consumers seeking care, collect their health data, or send them health-related ads. It's an outright ban — consent can't cure it. See the geofencing explainer.

A separate consumer health data privacy policy distinctly linked from your homepage; an opt-in consent mechanism unbundled from your terms; a valid written authorization before any sale; and a documented rights-request process. Most businesses also keep a retention and disposal schedule to evidence minimisation.

Disclose the categories of health data collected, purposes and uses, categories of sources, categories of third parties receiving it, a list of specific affiliates and processors, and how consumers exercise rights. It must be a separate policy with its own homepage link. See the policy guide.

No. The act requires a separate consumer health data privacy policy, distinctly linked. Burying the disclosures inside a general policy fails the separate-link requirement even if all the content is technically present.

45 days from receipt, with one 45-day extension where reasonably necessary if you notify the consumer and give a reason within the first period. First request in any 12 months is free, and you can't retaliate. See the rights request process.

Yes — including from archives and backups — and you must notify affiliates, processors, contractors and third parties you shared it with, instructing them to delete too. Limited exceptions exist, such as retention required by other law.

Here: the My Health My Data Act text page reproduces all twelve sections of RCW 19.373 verbatim — from the findings in §.005 to the short title in §.900 — each with a plain-English note and the document that satisfies it. The authoritative version is the Legislature's own chapter 19.373 page.

Violations may be treated as Consumer Protection Act violations — enabling Attorney General enforcement and, as generally understood, private consumer claims. Exposure can include civil penalties, damages, injunctive relief and attorney fees. For most businesses the realistic risk is a class action. See penalties.

Washington's act is generally understood to allow individual claims via the state Consumer Protection Act — unusual among state privacy laws, and the main reason it carries more risk than Nevada's or Connecticut's. The first significant matter was a private class action.

There is no private-right-of-action section inside RCW 19.373 itself. Instead RCW 19.373.090 makes a violation of the chapter an unfair or deceptive act in trade or commerce for purposes of the Consumer Protection Act, chapter 19.86 RCW — and that act does carry a private right of action. That is why the law is generally understood to be enforceable by consumers as well as by the Attorney General. See penalties.

Potentially civil penalties recoverable by the AG, actual damages, treble damages in certain circumstances subject to statutory caps, injunctive relief and attorney fees. Amounts depend on the nature and number of violations; in a class action the aggregate across many consumers is the bigger number.

Yes — HB 1155 is the bill number the act passed under in 2023, codified as chapter 19.373 RCW. HB 1155, MHMDA, WMHMDA and "My Health My Data Act" all mean the same law. See the terminology section.

Those are comprehensive laws with size thresholds and (in California) no general private right of action outside breaches. WMHMDA is narrow but deep: health data only, no size exemption, opt-in rather than opt-out, and private claims generally available. GDPR or CCPA compliance doesn't give you WMHMDA compliance.

Nevada (SB 370) and Connecticut (CTDPA as amended by PA 23-56). Both share Washington's structure but neither creates a private right of action. Other states have introduced bills. See health data laws by state.

No legal requirement to use one, and many small businesses don't. But no generator can assess your real data flows, judge whether an exemption applies, or advise on risk. Generating a draft then paying for a review is usually far cheaper than commissioning from scratch.

Attorney drafting commonly runs into the low thousands. General policy generators are typically annual subscriptions. This pack is $99.99 one-time. DIY costs only your time — usually several days for a non-lawyer. See the options comparison.

Free general templates are widely available, and our checklist and compliance map are free with no email required. Harder to find free is the complete Washington set — especially the unbundled consent record and the authorization to sell.

Some include Washington clauses. Check whether the output goes beyond a website policy to include unbundled opt-in consent, a separate sale authorization, a retention schedule and a rights-request process — verify rather than assume.