Washington My Health My Data Act Compliance: Exemptions and Guidelines for Non-Healthcare Businesses
The Washington My Health My Data Act (MHMDA) applies to almost any business that collects consumer health data, including fitness apps and e-commerce stores. Failing to update your privacy policies or using geofencing near healthcare clinics can trigger devastating consumer lawsuits.
Navigating the Washington My Health My Data Act (MHMDA)
For decades, medical privacy was largely governed by federal HIPAA laws, which only applied to doctors, hospitals, and traditional insurance companies. Washington State has drastically changed the landscape by passing the My Health My Data Act under Wash. Rev. Code § 19.373. This is one of the strictest privacy laws in the country, and it was designed specifically to target non-traditional businesses that collect consumer health data. If your business collects information about a consumer's physical or mental health status, biometric data, or reproductive health, you are likely regulated by this act, even if you are just a small retail website.
Because the MHMDA grants a 'private right of action'-meaning everyday consumers can sue your business directly for violations-compliance is not optional. Whether your startup is based in Seattle or you run a nationwide website serving Washington residents, you must take immediate action. We highly recommend using our USA directory to hire a privacy attorney to audit your data practices and protect you from class-action lawsuits.
How the MHMDA Impacts Non-Healthcare Businesses
Many business owners mistakenly believe that because they are not a doctor's office, this law does not apply to them. The MHMDA defines 'consumer health data' incredibly broadly. Here is how it impacts specific micro-niches.
Fitness App Developers
If you run a fitness app that tracks a user's daily steps, heart rate, sleep cycles, or diet plans, you are squarely in the crosshairs of the MHMDA. Because this data can be used to infer a user's overall health status, it is highly protected. You must obtain explicit, affirmative consent from the user before collecting this data, and you are strictly prohibited from selling it to third-party data brokers without a separate, highly specific written authorization.
E-commerce Sites Selling Wellness Products
Selling vitamins, dietary supplements, or non-prescription wellness products online seems harmless, but under the MHMDA, tracking those purchases can be a violation. If your website uses cookies or tracking pixels to analyze a user's purchase of prenatal vitamins or weight-loss supplements, you are collecting consumer health data. You must update your online infrastructure to ensure Washington residents opt-in before you share their purchase history with advertising platforms like Google or Meta.
Marketing Agencies Tracking Consumer Biometrics
Marketing agencies that utilize advanced tracking tools to analyze consumer facial expressions, eye tracking, or precise location data regarding health habits are heavily restricted. The law specifically protects biometric data. If your agency serves Washington consumers, you must completely overhaul how you build customer profiles and ensure you are not inadvertently categorizing them based on inferred medical conditions.
Strict Bans: Geofencing Healthcare Facilities
One of the most rigid provisions of the MHMDA is the absolute ban on geofencing healthcare facilities. Under Wash. Rev. Code § 19.373.080, it is illegal to implement a virtual boundary (geofence) around any facility that provides in-person healthcare services for the purpose of identifying, tracking, or sending targeted advertisements to consumers. For example, a personal injury lawyer or a chiropractor cannot use GPS tracking to send push notifications to cell phones belonging to people currently sitting inside a local hospital or reproductive health clinic.
Mandatory Privacy Policy Updates and Consent
The MHMDA requires complete transparency. Standard privacy policies are no longer enough. Your business is now legally required to maintain a separate 'Consumer Health Data Privacy Policy.' This policy must feature a clear, conspicuous link on your website's homepage. The document must explicitly state the categories of health data collected, the purpose of collection, and the specific third parties with whom the data is shared. Most importantly, you cannot use pre-checked boxes to gain consent; the consumer must take an affirmative action to allow data collection.
Step-by-Step: Updating Your Compliance Protocols
Protecting your business requires a proactive legal and technical strategy.
Step 1: Conduct a Data Mapping Audit
Your attorney will work with your IT team to map exactly what data your website collects. They will identify any data points that could remotely be considered 'health data' under Washington's broad definitions.
Step 2: Draft the Required Policies
A lawyer must draft your specific Consumer Health Data Privacy Policy. Generic templates will not hold up in court. This document must align perfectly with your actual data practices.
Step 3: Implement Opt-In Consent Mechanisms
You must update your website's user interface. If a Washington IP address accesses your site, they must be presented with clear opt-in banners before any health-adjacent data is tracked or shared with third parties.
Fines, Penalties, and Costs of Non-Compliance
A violation of the MHMDA is automatically considered an unfair or deceptive act under the Washington Consumer Protection Act (CPA). This gives the Washington State Office of the Attorney General, Seattle the power to file lawsuits against you, demanding massive fines.
Worse, private citizens can sue you. If a consumer sues you under the CPA, they can seek actual damages, treble (triple) damages up to $25,000, and you will be forced to pay their attorney fees, as established in enforcement precedents like Panag v. Farmers Ins. Co. of Washington, 166 Wash. 2d 27 (WA Supreme Court 2009). Defending a class-action privacy lawsuit can easily cost your business between $50,000 and $250,000 in legal fees alone.
How Long Does Compliance Take?
The MHMDA is already fully in effect. If you have not updated your policies, you are currently at risk. Hiring a privacy attorney to audit your systems and draft a compliant privacy policy generally takes 2 to 4 weeks. Implementing the technical changes (like blocking specific tracking pixels for Washington users) can take your web development team an additional 1 to 2 months.
Frequently Asked Questions (FAQ)
Does this law apply if my business is located in California?
Yes. The MHMDA applies to any legal entity that conducts business in Washington State or produces products or services targeted to consumers located in Washington.
Are employee records covered by the MHMDA?
No. The law specifically exempts data collected from individuals acting in an employment context. It is strictly focused on consumers purchasing goods or services.
If I am HIPAA compliant, am I automatically MHMDA compliant?
No. While data that is strictly regulated by HIPAA is exempt, any other health data you collect outside of your capacity as a covered healthcare provider (such as a marketing mailing list) falls under the MHMDA.
What is considered 'affirmative consent'?
Affirmative consent requires a clear, active action by the user, such as checking an empty box or clicking a button that clearly explains what data is being collected. Pre-ticked boxes or implied consent by continuing to use the website are strictly illegal.
Can consumers demand that I delete their data?
Yes. Under Wash. Rev. Code § 19.373.040, consumers have the right to request the deletion of their health data. Once you receive the request, you must delete it within 45 days (with a possible 45-day extension when reasonably necessary). For data stored on archive or backup systems, deletion may be delayed for up to six months after the request is authenticated.
No reviews yet. Be the first to share your experience!