Washington
What Is MHMDA? WA My Health My Data Act
Independently fact-checked against primary sources (last audited August 15, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 15, 2026. · 8 primary sources cited on this page. How we verify our legal content
Washington's My Health My Data Act (MHMDA), codified at chapter 19.373 RCW, is a consumer health data privacy law that protects sensitive health information falling outside HIPAA. Enacted as House Bill 1155 and signed by Governor Jay Inslee on April 27, 2023, it gives Washington consumers rights over their "consumer health data" and, unlike almost every other state privacy law, lets individuals sue over violations.
As of 2026, MHMDA is fully in force. Most regulated entities had to comply by March 31, 2024, small businesses by June 30, 2024, and the geofencing ban took effect July 23, 2023. Its headline feature is enforcement: under RCW 19.373.090, a violation is a per se violation of the Washington Consumer Protection Act (chapter 19.86 RCW), which the Attorney General enforces and which carries a private right of action.
Jurisdiction scope: This covers Washington's My Health My Data Act (chapter 19.373 RCW). It is general legal information, not legal advice.
What MHMDA is: statute, enactment, and effective dates
The My Health My Data Act is Washington's standalone consumer health data privacy law. It is codified at chapter 19.373 of the Revised Code of Washington and was enacted during the 2023 regular session as House Bill 1155, a measure championed by the Attorney General's office and sponsored by Representative Vandana Slatter and Senator Manka Dhingra. Governor Jay Inslee signed HB 1155 into law on April 27, 2023.
MHMDA is not a comprehensive privacy law in the mold of California's CCPA or Virginia's VCDPA. It is narrower in subject and broader in reach: it regulates one category of information, consumer health data, but it does so without the revenue or volume thresholds that limit comprehensive statutes. According to the Washington Attorney General, it is the first privacy-focused law in the country built to protect personal health data that sits outside the scope of HIPAA.
The Act phases in by entity type. Section 10 of the Act, the geofencing restriction now at RCW 19.373.080, took effect July 23, 2023. Regulated entities that are not small businesses had to comply with the core duties (sections 4 through 9) beginning March 31, 2024. Small businesses had until June 30, 2024. As of 2026, all of those dates have passed, so every category of covered organization is fully subject to the law.
For the broader picture of how MHMDA fits alongside Washington's other data rules, see the Washington data privacy laws parent page.
The broad "consumer health data" definition
The defined term that makes MHMDA so far-reaching is "consumer health data," set out in RCW 19.373.010. The statute defines it as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
That core definition is then expanded by a long, nonexclusive list of categories. It includes individual health conditions, treatments, diseases, or diagnoses; social, psychological, behavioral, and medical interventions; health-related surgeries or procedures; use or purchase of prescribed medication; bodily functions, vital signs, and symptoms; diagnoses or diagnostic testing; reproductive or sexual health information; and gender-affirming care information.
The definition reaches further still. It covers biometric data and genetic data, precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies, and data that identifies a consumer seeking health care services. It also covers any information that a regulated entity or its processor, or any third party, derives or extrapolates from other data to associate a consumer with health status.
This breadth is the point. Where HIPAA reaches only "protected health information" held by covered entities such as providers, plans, and clearinghouses, MHMDA reaches the same kinds of facts wherever they live: in a period-tracking app, a fitness platform, a web analytics log, an advertising profile, or a data broker's file. The data does not have to come from a doctor to be protected.
Who is a regulated entity: no threshold
MHMDA's applicability is unusually wide because it has no size threshold. RCW 19.373.010 defines a "regulated entity" as any legal entity that conducts business in Washington, or that produces or provides products or services targeted to consumers in Washington, and that, alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling consumer health data.
There is no minimum revenue figure and no minimum number of consumers. A comprehensive privacy law typically applies only above a revenue floor or a data-volume count, so a small company can escape it entirely. MHMDA has neither gate at the "regulated entity" level. If a business touches Washington consumers' health data and controls how that data is used, it is in scope.
The Act does carve out a "small business" subcategory, but only for timing and certain obligations, not to remove coverage. Under RCW 19.373.010, a small business is a regulated entity that during a calendar year collects, processes, shares, or sells the consumer health data of fewer than 100,000 consumers, or that derives less than half of its gross revenue from collecting, processing, sharing, or selling consumer health data and controls the data of fewer than 25,000 consumers. Small businesses got the later June 30, 2024 compliance date, but they are still bound by the law.
Government agencies and tribal nations are excluded from the "regulated entity" definition, and RCW 19.373.100 adds exemptions, including for protected health information processed by a HIPAA covered entity or business associate, certain GLBA and FCRA data, and information governed by other listed federal frameworks. Those are data-level and entity-level carve-outs that businesses must map carefully rather than assume.
The geofencing ban
One of MHMDA's most distinctive provisions is its outright ban on certain geofencing, in RCW 19.373.080. The statute makes it unlawful for any person to implement a geofence around an entity that provides in-person health care services where the geofence is used to do any of three things.
Those three prohibited uses are: to identify or track consumers seeking health care services; to collect consumer health data from consumers; or to send notifications, messages, or advertisements to consumers related to their consumer health data or health care services. A "geofence" is defined in RCW 19.373.010 as technology that uses location detection to establish a virtual boundary around a physical location, or to locate a consumer within that boundary, that is 2,000 feet or less from the perimeter of the location.
The geofencing ban is notable for two reasons. First, it applies to any person, not just to regulated entities, which is why it carried the earliest compliance date of July 23, 2023. Second, it is a flat prohibition rather than a consent-based rule: there is no version of geofencing a clinic, abortion provider, or mental health facility for these tracking and marketing purposes that the consumer can authorize away.
The private right of action: MHMDA's centerpiece
The feature that sets MHMDA apart from nearly every other US privacy law is private enforcement. RCW 19.373.090 provides that a violation of the chapter is a violation of the Washington Consumer Protection Act, chapter 19.86 RCW. The Consumer Protection Act, in turn, carries a long-standing private right of action under RCW 19.86.090, which lets an injured person sue, and recover actual damages, treble damages up to a statutory cap, costs, and attorney fees.
The Washington Attorney General has confirmed this reading. The AG's materials state that any violation of the Act is a per se violation of the Consumer Protection Act, which is "enforced by the Attorney General as well as through private action." So MHMDA has two enforcement channels running at once: state enforcement by the Attorney General, and private lawsuits, including the possibility of class actions, brought by consumers.
Most comprehensive state privacy laws deliberately exclude private suits and reserve enforcement to the attorney general. MHMDA does the opposite. For businesses, that means litigation exposure on top of regulatory risk, and it is the central reason MHMDA is treated as a high-risk compliance obligation. The MHMDA business compliance guide covers that exposure in depth.
MHMDA vs. HIPAA and comprehensive privacy laws
MHMDA is best understood by contrast with the two regimes around it: HIPAA, and comprehensive state privacy laws like California's CCPA.
| Feature | Washington MHMDA | HIPAA | CCPA / comprehensive laws |
|---|---|---|---|
| What it covers | Consumer health data, broadly defined | Protected health information held by covered entities | All personal data above thresholds |
| Who is covered | Any entity handling WA consumer health data; no threshold | Providers, plans, clearinghouses, business associates | Businesses above revenue or volume thresholds |
| Health data outside the clinic | Covered (apps, sites, brokers, ads) | Not covered | Often covered only as "sensitive data" |
| Geofencing health facilities | Banned (RCW 19.373.080) | Not addressed | Generally not addressed |
| Private right of action | Yes, via the Consumer Protection Act | No | Limited (CCPA, breaches only) |
The key gap MHMDA fills is the health data that HIPAA never touches. When a consumer enters symptoms into a wellness app, searches a clinic, or has their location logged near a provider, HIPAA usually does not apply because the app or advertiser is not a covered entity. MHMDA steps into that gap.
Against comprehensive laws, MHMDA is narrower in subject but stricter in two respects: it has no threshold to escape coverage, and it allows private suits. The state data privacy law comparison page covers the broader multistate picture, and California's CCPA is the standard comprehensive-law reference point.
What MHMDA means in practice
As of 2026, MHMDA's practical effect has been to push a wide range of consumer-facing companies, well beyond traditional health care, to rethink how they handle anything that could be health data. Advertising technology, analytics tracking, location data, and the sharing of app data with third parties all draw scrutiny under the Act because consumer health data is defined so broadly.
The combination of a no-threshold definition, a broad data definition, and a private right of action is what gives MHMDA its weight. A single tracking pixel that captures health-related browsing, or a data flow that shares health-adjacent information without consent, can become the basis for a Consumer Protection Act claim.
For consumers, MHMDA created rights that did not previously exist for non-HIPAA health data: the right to know whether an entity collects, shares, or sells their consumer health data, to withdraw consent, and to have that data deleted. Those rights are covered in the MHMDA consumer rights guide.
Related guides
-
Washington data privacy laws parent hub
More Washington Laws
Frequently Asked Questions
What is the My Health My Data Act?
The My Health My Data Act (MHMDA) is Washington's consumer health data privacy law, codified at chapter 19.373 RCW. It was enacted as HB 1155 and signed by Governor Jay Inslee on April 27, 2023. It protects 'consumer health data' that falls outside HIPAA, requires consent before collecting or sharing that data, bans certain geofencing of health facilities, and gives consumers rights to access, withdraw consent, and delete their data. Uniquely, violations are enforceable through private lawsuits under the Washington Consumer Protection Act.
When did MHMDA take effect?
MHMDA phases in by entity type. The geofencing ban (RCW 19.373.080) took effect July 23, 2023. Regulated entities that are not small businesses had to comply with the core duties by March 31, 2024, and small businesses by June 30, 2024. As of 2026, all of those dates have passed, so the Act is fully in force for every category of covered organization.
Does MHMDA have a revenue or size threshold?
No. Under RCW 19.373.010, a 'regulated entity' is any legal entity that conducts business in Washington or targets Washington consumers and that determines the purpose and means of processing consumer health data. There is no minimum revenue figure and no minimum consumer count. The Act defines a 'small business' subcategory for timing and certain obligations, but small businesses are still covered, just with a later June 30, 2024 compliance date.
What is 'consumer health data' under MHMDA?
Under RCW 19.373.010, consumer health data is personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status. It includes health conditions, diagnoses, treatments, medications, bodily functions and vital signs, reproductive and sexual health, gender-affirming care, biometric and genetic data, precise location that could indicate an attempt to obtain health services, and data identifying a consumer seeking health care. It is far broader than HIPAA's protected health information.
How is MHMDA different from HIPAA?
HIPAA protects 'protected health information' only when it is held by covered entities such as providers, health plans, and clearinghouses, or their business associates. MHMDA protects 'consumer health data' wherever it lives, including in apps, websites, advertising profiles, and data broker files that HIPAA never reaches. MHMDA was designed specifically to close the gap for health data that falls outside HIPAA's scope.
What is the geofencing ban?
Under RCW 19.373.080, it is unlawful to implement a geofence (a virtual boundary of 2,000 feet or less) around an entity that provides in-person health care services where the geofence is used to identify or track consumers seeking health services, to collect consumer health data, or to send them notifications, messages, or advertisements related to their health data or health care services. It applies to any person and is a flat ban, not something a consumer can consent away.
Can individuals sue under MHMDA?
Yes. Under RCW 19.373.090, a violation of MHMDA is a violation of the Washington Consumer Protection Act (chapter 19.86 RCW), which carries a private right of action under RCW 19.86.090. The Washington Attorney General also enforces the Act. This dual enforcement, including private and potential class action suits, is what distinguishes MHMDA from most state privacy laws, which reserve enforcement to the attorney general only.
Who enforces MHMDA?
MHMDA is enforced two ways. The Washington Attorney General enforces it under the Consumer Protection Act, and individual consumers can bring private lawsuits under RCW 19.86.090 because RCW 19.373.090 makes a MHMDA violation a per se Consumer Protection Act violation. That private right of action is the central reason businesses treat MHMDA as a high-risk obligation.
Does MHMDA apply to businesses outside Washington?
It can. RCW 19.373.010 covers any legal entity that conducts business in Washington or that produces or provides products or services targeted to consumers in Washington and that determines how consumer health data is processed. A company located elsewhere that markets to or collects health data from Washington consumers can be a regulated entity, with no revenue or volume threshold to escape coverage.
Updates
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Revised Code of Washington
§ 19.373.030Collection or sharing of consumer health data.In forcecited in 4 of our articles
(1)(a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity or a small business may not collect any consumer health data except: (i) With consent from the consumer for such collection for a specified purpose; or (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business. (b) A regulated entity or a small business may not share any consumer health data except: (i) With consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data; or (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at app.leg.wa.gov
Also relied on in: MHMDA Business Compliance (Washington), MHMDA Consumer Rights (Washington), Washington Data Privacy Laws: My Health My Data Act & More (2026)
§ 19.373.010Definitions.In forcecited in 6 of our articles
The definitions in this section apply throughout this chapter unless the context clearly requires otherwise. (1) "Abortion" means the termination of a pregnancy for purposes other than producing a live birth. (2) "Affiliate" means a legal entity that shares common branding with another legal entity and controls, is controlled by, or is under common control with another legal entity. For the purposes of this definition, "control" or "controlled" means: (a) Ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company; (b) Control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or (c) The power to exercise controlling influence over the management of a company. (3) "Authenticate" means to use reasonable means to determine that a request to exercise any of the rights afforded in this chapter is being made by, or on behalf of, the consumer who is entitled to exercise such consumer rights with respect to the consumer health data at issue.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Also relied on in: Washington Employee Monitoring Laws: Biometric Privacy, Social Media, and Surveillance (2026), Nevada Consumer Health Data Law (SB 370)
§ 19.373.080Geofence restrictions.In forcecited in 3 of our articles
It is unlawful for any person to implement a geofence around an entity that provides in-person health care services where such geofence is used to: (1) Identify or track consumers seeking health care services; (2) collect consumer health data from consumers; or (3) send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
§ 19.373.090Application of consumer protection act.In forcecited in 4 of our articles
The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Also relied on in: Washington Biometric Privacy Laws: Collection, Consent & Penalties (2026)
§ 19.86.090Civil action for damages—Treble damages authorized—Action by governmental entities.In forcecited in 5 of our articles
Any person who is injured in his or her business or property by a violation of RCW 19.86.020, 19.86.030, 19.86.040, 19.86.050, or 19.86.060, or any person so injured because he or she refuses to accede to a proposal for an arrangement which, if consummated, would be in violation of RCW 19.86.030, 19.86.040, 19.86.050, or 19.86.060, may bring a civil action in superior court to enjoin further violations, to recover the actual damages sustained by him or her, or both, together with the costs of the suit, including a reasonable attorney's fee. In addition, the court may, in its discretion, increase the award of damages up to an amount not to exceed three times the actual damages sustained: PROVIDED, That such increased damage award for violation of RCW 19.86.020 may not exceed twenty-five thousand dollars: PROVIDED FURTHER, That such person may bring a civil action in the district court to recover his or her actual damages, except for damages which exceed the amount specified in RCW 3.66.020, and the costs of the suit, including reasonable attorney's fees.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Cited in 529 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Hangman Ridge Training Stables, Inc. v. Safeco Title Insurance (Washington Supreme Court 1986, 105 Wash. 2d 778)“…izens would be encouraged to bring suit to enforce the CPA. RCW 19.86.090, as amended, first in 1971 and again in…”
- Washington State Physicians Insurance Exchange & Ass'n v. Fisons Corp. (Washington Supreme Court 1993, 122 Wash. 2d 299)“…any trade or commerce are hereby declared unlawful. *312 RCW 19.86.090 creates a private right of action by pr…”
- Bowers v. Transamerica Title Insurance (Washington Supreme Court 1983, 100 Wash. 2d 581)“…d its discretion in awarding attorney fees of $42,805 under RCW 19.86.090. We hold that: 1. An escrow agent i…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Washington Data Breach Notification Laws: Reporting Rules & Timelines (2026)
§ 19.373.100Exemptions.In forcecited in 2 of our articles
(1) This chapter does not apply to: (a) Information that meets the definition of: (i) Protected health information for purposes of the federal health insurance portability and accountability act of 1996 and related regulations; (ii) Health care information collected, used, or disclosed in accordance with chapter 70.02 RCW; (iii) Patient identifying information collected, used, or disclosed in accordance with 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2; (iv) Identifiable private information for purposes of the federal policy for the protection of human subjects, 45 C.F.R. Part 46; identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the international council for harmonization; the protection of human subjects under 21 C.F.R.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at app.leg.wa.gov
Explore the law
This article also draws on these acts and chapters (opening at their first section): Revised Code of Washington § 19.373.005 (Finding—Intent—2023 c 191.)
Related law for further reading — not part of this article’s citations.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Chapter 19.373 RCW: My Health My Data Act (Full Chapter)(app.leg.wa.gov).gov
- RCW 19.373.010: Definitions (consumer health data, regulated entity, geofence)(app.leg.wa.gov).gov
- RCW 19.373.080: Geofence restrictions(app.leg.wa.gov).gov
- RCW 19.373.090: Application of consumer protection act(app.leg.wa.gov).gov
- RCW 19.373.100: Exemptions(app.leg.wa.gov).gov
- Washington State HB 1155 (2023): My Health My Data Act(app.leg.wa.gov).gov
- RCW 19.86.090: Consumer Protection Act private right of action(app.leg.wa.gov).gov
- Washington Attorney General: Protecting Washingtonians' Personal Health Data and Privacy(atg.wa.gov).gov