This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
header image


My Health My Data Act (MHMDA)

Passed April 27, 2023
Effective Date March 31, 2024
Who it applies to

Entities doing business in Washington or targeting products or services to Washington consumers that collect, process, share, or sell consumer health data. Exempt entities include government agencies, indigenous tribe, and financial institutions subject to the Gramm-Leach-Bliley Act (GLBA).

Penalties Not specified

What’s notable about it:

While focused on health, Washington’s MHMDA is arguably the strictest privacy law in the whole of the US. The law defines “consumer health data” broadly, imposes very strict requirements over its collection, sharing, and sale, applies to companies of all sizes, and has a “private right of action” enabling consumers to claim up to three times any damages they experience due to a company’s violation of the law—so expect many class action lawsuits.

The Strict Spectrum

Less Strict