What is the Washington My Health My Data (MHMD) Act? | UpGuard

Washington’s My Health My Data Act (MHMD Act) is a broad consumer health data privacy law that extends beyond HIPAA and applies to any entity doing business in or targeting Washington residents; it defines consumer health data widely, grants consumers rights to notice, access, correction, deletion, and opt-out, and requires entities to implement transparent privacy policies, obtain consent/authorization, enforce access controls and data processing contracts, and prohibits geofencing. The law exempts certain government, HIPAA, GLBA, employee, and de-identified data, is enforceable by the Washington Attorney General and district attorneys with civil penalties (up to $7,500 per consumer) and a private right of action (actual damages up to $25,000), and becomes effective March 31, 2024 for most entities (June 30, 2024 for small businesses).