Washington's My Health My Data Act: America's strictest health-privacy law

A period-tracking app. A search for a clinic's opening hours. A phone that lingered forty minutes in a particular parking lot. After the Supreme Court's Dobbs decision in June 2022, it became uncomfortably clear that all three could reconstruct one of the most sensitive facts about a person's life — and that none of them was protected by HIPAA.

Washington State answered first. In April 2023, the legislature passed the My Health My Data Act, and it remains the strictest health-privacy law in the United States. If you want to know where American health privacy is heading, this is the text to read.

The gap the law was built to fill

HIPAA does not protect health data. It protects health data held by a specific list of organizations — health plans, clearinghouses, providers who bill electronically, and their contractors — as the HHS overview of the rules lays out. The same blood-pressure reading is federally protected inside your cardiologist's EHR and essentially unregulated inside a wellness app's cloud, where it can be scored, shared, and brokered.

That second life of health data is a real market, and it runs on the gap: apps, wearables, advertisers, and data brokers trade in exactly the information HIPAA never touches. We map that economy in how health data gets bought and sold. My Health My Data was written to close the gap at the state line — not by extending HIPAA, but by regulating the data itself.

What counts as consumer health data

The definition is the law's engine, and it is deliberately broad. Consumer health data is information that identifies a consumer's past, present, or future physical or mental health status. The act then spells out what that includes: diagnoses and treatments, reproductive and gender-affirming care, biometric and genetic data, precise location information that could indicate an attempt to obtain care, and — the clause with teeth — inferences derived from non-health data.

The inference clause matters most. A pattern of purchases, a sequence of searches, a recurring location: none of these is medical data on its own, but together they can say pregnant, depressed, or in treatment with unsettling confidence. MHMD says the conclusion is health data even when every input was mundane. That single move pulls a large share of the modern advertising stack into scope.

The law's reach is wide too: it applies to entities doing business in Washington or targeting its consumers, and it protects not only residents but anyone whose consumer health data is collected in the state.

Consent to collect, a signature to sell

MHMD builds a two-tier wall. The first tier is consent: a business needs affirmative, voluntary consent to collect or share consumer health data beyond what is necessary to provide a service the consumer actually asked for. Pre-ticked boxes, bundled terms, and dark patterns do not qualify.

The second tier guards the sale of data, and it is closer to a notarized act than a click. Selling consumer health data requires a valid authorization: a separate document, signed by the consumer, naming the specific data sold, the buyer, and the purpose — valid for at most one year, revocable, with a copy that goes to the consumer. It cannot be folded into other paperwork. The structure quietly mirrors what research ethics has long required for HIPAA research authorizations: specificity, a real signature, an expiry.

The practical effect is that selling this data in Washington is no longer something that can happen to you in the background. It has to happen with you, in writing, recently.

The geofencing ban

One provision took effect ahead of all the others, in July 2023, and it allows no consent exception at all: it is unlawful to operate a geofence around any facility that provides in-person health services where the purpose is to identify or track consumers, collect their health data, or send them messages or ads. The statute defines a geofence as a virtual perimeter of up to 2,000 feet.

This was written against a documented practice — advertisers drawing digital circles around clinics and pushing targeted messages to the phones inside. Under MHMD there is no version of that business in Washington. Not with consent, not de-identified, not at all.

A private right of action changes the math

Most state privacy laws are enforced only by the attorney general, which means enforcement is rationed by one office's budget and priorities. MHMD is different: a violation counts as an unfair practice under Washington's Consumer Protection Act, so individuals can sue directly. Plaintiffs' firms, not just regulators, now read privacy policies — and that, more than any fine schedule, is what moved compliance teams nationwide.

Why MHMD-grade consent is a sane default

Washington is no longer alone — Nevada and Connecticut followed within months, and the broader pattern is the subject of the new wave of US state health-privacy laws. With no comprehensive federal privacy law on the books — Congress has seen proposals come and go for years — the realistic strategy for anyone handling health data is to build to the strictest state and apply it everywhere. Today, the strictest state is Washington.

That is roughly how Mithras Health approached it, with MHMD named alongside HIPAA, GDPR, UK GDPR, and the EHDS in the platform's design targets. Two of the act's hardest requirements simply never trigger: Mithras never buys or sells data, so the valid-authorization-to-sell machinery has nothing to attach to. And where MHMD demands affirmative consent, the platform already runs ahead of it — each study gets a revocable, scope-limited consent of its own, recorded as two documents and one decision, with revocation honored as a first-class event on an append-only audit trail.

Patients are paid fair-market participation fees when IRB-approved research uses their data — which is the inverse of the transaction MHMD polices. The law exists because companies sold data about people. A platform can instead route value to them, with the patient as the signing party rather than the merchandise.

My Health My Data is sometimes described as a burden on the health-data economy. It is more honest to say it priced that economy correctly: if a business cannot survive asking people, in writing, whether it may sell their health data, the data was never the business's to sell.