Washington My Health My Data Act
In force Washington · In force Mar 31, 2024 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Regulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.
- Who it applies to
- Any legal entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data, with no revenue threshold. Small businesses (health data of fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers) got a later compliance date.
- Penalties
- A violation is a per se violation of the Washington Consumer Protection Act: AG civil penalties up to $7,500 per violation (RCW 19.86.140). Private right of action for actual damages, with possible treble damages and attorney fees.
- Enforced by
- Washington Attorney General; private right of action
- Official name
- Washington My Health My Data Act (HB 1155, Laws of 2023, ch. 191; RCW 19.373)
- Citation
- RCW 19.373; Laws of 2023, ch. 191 (HB 1155)
- Topics
- health, privacy
Research notes
The treble-damages cap for private actions (RCW 19.86.090) was not re-verified for this record.
Related
Questions about Washington My Health My Data Act
- What are the Washington My Health My Data Act compliance deadlines?
- Apr 27, 2023: HB 1155 signed. Jul 23, 2023: Geofencing ban (Section 10) effective. Mar 31, 2024: Regulated entities must comply. Jun 30, 2024: Small businesses must comply.
- When does Washington My Health My Data Act take effect?
- Washington My Health My Data Act took effect on Mar 31, 2024.
- Who does Washington My Health My Data Act apply to?
- Any legal entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of processing consumer health data, with no revenue threshold. Small businesses (health data of fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers) got a later compliance date.
- What are the penalties under Washington My Health My Data Act?
- A violation is a per se violation of the Washington Consumer Protection Act: AG civil penalties up to $7,500 per violation (RCW 19.86.140). Private right of action for actual damages, with possible treble damages and attorney fees.