MHMDA Consumer Rights (Washington)

Washington's My Health My Data Act (MHMDA), chapter 19.373 RCW, gives consumers four core rights over their consumer health data: the right to confirm whether a regulated entity collects, shares, or sells it, the right to access it, the right to withdraw consent, and a broad right to have it deleted. These rights are set out in RCW 19.373.040 and the consent rules in RCW 19.373.030.

As of 2026, what makes these rights unusually powerful is the enforcement behind them. Under RCW 19.373.090, a regulated entity that ignores a valid request is committing a per se violation of the Washington Consumer Protection Act (chapter 19.86 RCW), which the Attorney General enforces and which gives the individual consumer a private right of action under RCW 19.86.090.

Jurisdiction scope: This covers Washington's My Health My Data Act (chapter 19.373 RCW). It is general legal information, not legal advice.

The four core consumer rights

MHMDA's consumer rights live in RCW 19.373.040. The Act gives a Washington consumer four rights that, together, let them find out what health data an entity holds, control its use, and have it erased.

The first is the right to confirm. A consumer may confirm whether a regulated entity or small business is collecting, sharing, or selling their consumer health data. The second is the right to access: the consumer may access that data, including a list of all third parties and affiliates with whom the entity has shared or sold the data, along with an active email address or other online mechanism the consumer can use to contact those parties.

The third is the right to withdraw consent. A consumer may withdraw consent from the entity's collection and sharing of their consumer health data. The fourth is the right to delete, which is the broadest of the four and is covered in detail below. As of 2026, all four rights are fully available because every category of covered entity passed its compliance date in 2024.

For how these rights fit into Washington's wider privacy framework, see the Washington data privacy laws parent page.

The right to confirm and access

The confirmation and access rights work together. Under RCW 19.373.040, a consumer first has the right to learn whether an entity collects, shares, or sells their consumer health data at all. This is meaningful on its own, because many of the entities covered by MHMDA, such as apps, advertisers, and data brokers, are not ones a consumer would normally associate with their health information.

The access right then lets the consumer see the data itself and, critically, learn where it went. The statute requires the entity to provide a list of all third parties and affiliates with whom the consumer health data was shared or sold. This is a recipient-level disclosure, not merely a list of categories.

The access right also requires a way to reach those recipients. The entity must give the consumer an active email address or other online mechanism that the consumer may use to contact each third party or affiliate. That detail matters for the deletion right, because it gives the consumer a path to follow their data downstream.

The right to withdraw consent

Consent is the engine of MHMDA. Under RCW 19.373.030, a regulated entity generally may not collect or share consumer health data without first obtaining the consumer's consent, and the consent to share must be separate and distinct from the consent to collect. The right to withdraw consent in RCW 19.373.040 lets a consumer turn that engine off.

When a consumer withdraws consent, the entity must stop collecting and sharing the consumer's health data on that basis. Consent under RCW 19.373.010 must be a clear affirmative act that is freely given, specific, informed, opt-in, voluntary, and unambiguous, so it cannot be buried in general terms of use or inferred from a consumer hovering over, closing, or muting a banner.

Withdrawing consent is distinct from deletion. Withdrawal stops future collection and sharing going forward; it does not by itself erase data the entity already holds. A consumer who wants existing data removed needs to use the deletion right as well. The two are often exercised together.

The broad deletion right

The deletion right is MHMDA's most far-reaching consumer right. Under RCW 19.373.040, a consumer has the right to have consumer health data concerning them deleted, and the entity must honor that request by deleting the data from its records.

What makes the right broad is its downstream reach. The entity must delete the consumer health data from all parts of its own system, including archived and backup systems. The statute does allow deletion from archived or backup systems to be delayed to enable restoration of those systems, but that delay may not exceed six months from the point the entity authenticates the deletion request. The statute sets no other condition on the data during that window.

The deletion obligation also runs to everyone the data was shared or sold to. The entity must notify all affiliates, processors, contractors, and other third parties with which it shared the consumer health data of the deletion request. Those recipients must then honor the request and delete the consumer health data from their own records, including their archived and backup systems on the same terms.

This is a meaningfully stronger deletion right than many privacy laws provide, because it does not stop at the first company. It is designed to pull the data back out of the chain of recipients, not just the original collector. For consumers, that is the closest a state law comes to a true erase-everywhere right for health data.

How to exercise your MHMDA rights

To exercise a right, a consumer submits a request to the regulated entity. RCW 19.373.040 directs entities to provide one or more secure and reliable means for consumers to submit requests, and those methods must take into account how consumers normally interact with the entity, the need for secure identity verification, and accessibility for consumers with disabilities. An entity cannot require a consumer to create a new account just to make a request, though it may require use of an existing account.

The response clock is set by statute. The entity must act on a request without undue delay and in all cases within 45 days of receiving it. That period can be extended once by an additional 45 days when reasonably necessary, as long as the entity tells the consumer about the extension and the reason within the first 45 days. Information must be provided free of charge, up to twice per consumer per year.

If the entity declines to act, what RCW 19.373.040 requires is an appeal route rather than a separate reason-giving step at that first stage. The entity must establish a process for the consumer to appeal a refusal to take action, and that process must be conspicuously available and similar to the process for submitting the original request. Within 45 days of receiving an appeal, the entity must inform the consumer in writing of any action taken or not taken, including a written explanation of the reasons for the decision. If the appeal is denied, the entity must also give the consumer an online mechanism, if available, or another method for contacting the Washington Attorney General to submit a complaint. The step-by-step duties on the business side are detailed in the MHMDA business compliance guide.

A consumer rights and deadlines table

What the private right of action means for consumers

MHMDA's enforcement is what gives these rights real force. Under RCW 19.373.090, a violation of the Act is a violation of the Washington Consumer Protection Act, chapter 19.86 RCW. The Washington Attorney General has confirmed that this makes any MHMDA violation a per se Consumer Protection Act violation, enforced by the Attorney General and through private action.

The private channel runs through RCW 19.86.090, the Consumer Protection Act's long-standing private right of action, and it is narrower than it first sounds. The statute opens the courthouse to a person who is "injured in his or her business or property" by the violation, so the harm a plaintiff pleads has to be an injury to business or property rather than a purely personal one such as emotional distress. A plaintiff who meets that requirement may recover actual damages together with the costs of the suit and a reasonable attorney fee, and the court may in its discretion increase the award up to three times the actual damages. That enhancement is capped at $25,000 for a violation of RCW 19.86.020, the section that makes unfair or deceptive acts unlawful and that RCW 19.373.090 routes MHMDA violations into.

This is the feature that distinguishes MHMDA from almost every other US privacy law. Comprehensive laws in states like Virginia, Colorado, and Oregon reserve enforcement to the attorney general and bar private suits. MHMDA does not. A Washington consumer who believes a company collected, shared, or sold their health data without consent, ignored a deletion request, or geofenced a health facility has a path to court, not just a complaint to the state, so long as they can show the business or property injury RCW 19.86.090 requires.

As of 2026, a consumer cannot, of course, be promised any particular outcome from a lawsuit, and whether a given violation caused compensable injury is a fact-specific legal question. But the existence of the private remedy means consumers are not solely dependent on the Attorney General to act, and it is why companies treat MHMDA compliance as a litigation-risk issue.

Related guides

• Washington data privacy laws parent hub
• What is MHMDA?
• MHMDA business compliance
• State data privacy law comparison
• What is the CCPA?

More Washington Laws

• Washington Deepfake Laws
• Washington Employee Monitoring Laws
• Washington GPS Tracking Laws
• Washington Recording Laws

Frequently Asked Questions

What rights do consumers have under MHMDA?

Under RCW 19.373.040, Washington consumers have the right to confirm whether a regulated entity collects, shares, or sells their consumer health data; the right to access that data and a list of the third parties and affiliates it was shared or sold to; the right to withdraw consent to collection and sharing; and the right to have the data deleted. The deletion right reaches the entity's backups and the third parties that received the data.

How do I delete my health data under MHMDA?

Submit a deletion request to the regulated entity through the secure request method it provides. Under RCW 19.373.040, the entity must delete the consumer health data from its records, including archived and backup systems (with a limited delay of up to six months for backups), and must notify all affiliates, processors, contractors, and third parties that received the data so they delete it from their records too.

How long does a company have to respond to a MHMDA request?

Under RCW 19.373.040, a regulated entity must act on a request without undue delay and within 45 days of receiving it. It may extend that once by an additional 45 days when reasonably necessary, as long as it notifies the consumer of the extension and the reason within the first 45 days. Information must generally be provided free of charge, up to twice per consumer per year.

What is the difference between withdrawing consent and deleting data?

Withdrawing consent under RCW 19.373.040 stops the entity from collecting and sharing your consumer health data going forward, but it does not by itself erase data the entity already holds. The deletion right requires the entity to actually remove the data it has, including from backups, and to tell the third parties that received it to delete it too. Many consumers exercise both rights together.

Can I find out who my health data was shared with?

Yes. The access right in RCW 19.373.040 requires the entity to provide a list of all third parties and affiliates with whom it shared or sold your consumer health data, along with an active email address or other online mechanism you can use to contact each of them. This is a recipient-level disclosure, not just a list of categories.

What happens if a company refuses my MHMDA request?

Under RCW 19.373.040, the entity must establish a process for you to appeal its refusal to take action, and that process must be conspicuously available and similar to the process for making the original request. Within 45 days of receiving your appeal, it must inform you in writing of any action taken or not taken, including a written explanation of the reasons for the decision. If the appeal is denied, it must also give you an online mechanism, if available, or another method for contacting the Washington Attorney General to submit a complaint. Because RCW 19.373.090 ties violations to the Consumer Protection Act, you may also have a private claim.

Can I sue a company under MHMDA?

Potentially, yes. RCW 19.373.090 makes a MHMDA violation a per se violation of the Washington Consumer Protection Act (chapter 19.86 RCW), which carries a private right of action under RCW 19.86.090. That section is limited to a person who is injured in his or her business or property by the violation, which excludes a purely personal harm such as emotional distress. A consumer who meets that requirement may sue for actual damages, the costs of the suit, and a reasonable attorney fee, and the court may increase the award up to three times actual damages, capped at $25,000. Whether a specific violation caused a compensable injury is a fact-specific legal question, and this is general information, not legal advice.

Does MHMDA cover health data from apps and websites?

Yes. That is the core reason MHMDA exists. Its definition of consumer health data in RCW 19.373.010 reaches health information held by apps, websites, advertisers, and data brokers that HIPAA does not cover. So your rights to confirm, access, withdraw consent, and delete apply to those entities when they handle the consumer health data of Washington consumers, with no size threshold to exempt them.