MHMDA (Washington My Health My Data Act)

The My Health My Data Act is Washington State's 2023 law that regulates the collection, sharing and sale of "consumer health data" by any regulated entity, not only HIPAA covered entities, requires opt-in consent for collection and sharing and a separate signed authorization for sale, bans geofencing around in-person health-care facilities, and gives consumers a private right of action.

The act is codified at RCW 19.373 (Washington State Legislature, RCW 19.373). Its definition of consumer health data covers information that identifies a consumer's past, present or future physical or mental health status, including inferences drawn from non-health data, and expressly includes precise location data that could indicate an attempt to obtain health services. The geofencing provision prohibits a geofence within 2,000 feet of an entity that provides in-person health-care services where the purpose is to identify or track consumers, collect their health data or send them advertisements (RCW 19.373). Enforcement runs through the state's Consumer Protection Act, which is what creates the private right of action.

For ad tech the act matters in three ways. Inferring a health condition from purchases or browsing, which a retail media model can do without intending to, is collecting consumer health data. Sharing a segment that encodes such an inference with an ad platform is sharing, which needs consent, and selling it needs a signed authorization that names the buyer. And location-based campaigns near pharmacies, clinics and hospitals are off limits. Other states have passed laws with similar definitions; the comparison is maintained on the state health privacy laws tracker.

Example: a grocer's model builds a "likely pregnant" segment from purchases of prenatal vitamins and sells it to a nappy brand for offsite targeting; in Washington that is a sale of consumer health data requiring a signed authorization from each consumer, which no network has, so the segment cannot be sold.

Related: PHI, HIPAA, consent string, retail media network.

Source: RCW 19.373 (Washington My Health My Data Act).

1. RCW 19.373