Washington My Health My Data Act for health and wellness apps: consent, geofencing and the private right of action

As of October 2026, Washington’s My Health My Data Act applies to almost any app that collects health-related data from people in Washington and isn’t already covered by HIPAA: you need opt-in consent to collect it, a separate consent to share it, a signed authorization to sell it, and you may not geofence health care locations. Consumers can sue under the state Consumer Protection Act, not just the Attorney General. The first class action, against Amazon, was voluntarily dismissed in 2025 without a ruling, so the law’s limits are still untested in court. This guide covers scope, consent, consumer rights, enforcement, the similar laws in Nevada and Connecticut, and a build checklist.

1. Who and What the Act Covers

The My Health My Data Act (MHMDA) is codified at chapter 19.373 RCW. Its definitions are broad, and they are why it reaches so many apps.

• Consumer: a Washington resident, or any natural person whose consumer health data is collected in Washington. Employees acting in that role are excluded.
• Regulated entity: any legal entity that does business in Washington, or offers products or services targeted at Washington consumers, and decides why and how consumer health data is processed. There is no revenue threshold. Government agencies are excluded.
• Small business: a regulated entity that handles the data of fewer than 100,000 consumers a year, or that gets less than half its gross revenue from consumer health data and handles fewer than 25,000 consumers. Same duties, later start date.
• Consumer health data: personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status.

The statute lists what counts as consumer health data, and the list goes well beyond medical records. It includes health conditions, treatments and diagnoses; use or purchase of medication; bodily functions, vital signs and symptoms; reproductive and sexual health information; gender-affirming care information; biometric and genetic data; precise location (within 1,750 feet) that could indicate an attempt to get health services; and data that identifies someone seeking health care. It also covers inferences: information derived from non-health data, for example by an algorithm or machine learning, that links a person to a health status.

The Attorney General’s FAQ gives useful examples. Buying toilet paper or deodorant is ordinarily not consumer health data. An app that tracks digestion or perspiration does collect it. A retailer’s “pregnancy prediction score” built from shopping data is consumer health data.

The HIPAA exemption, and where it stops

Under RCW 19.373.100, information that is protected health information under HIPAA is exempt, as is health care information under Washington’s own medical records law (chapter 70.02 RCW). The exemption covers the information, not the company. So:

• A clinic’s EHR and patient portal data is PHI and outside the Act.
• The same clinic’s marketing website, symptom quiz or newsletter sign-up may collect health data that is not PHI, and that data can fall under the Act.
• A direct-to-consumer wellness, fertility, mental health or fitness app that isn’t working for a covered entity usually handles no PHI at all. MHMDA is its main health privacy law.

The business claiming an exemption must prove it applies. Our GDPR guide for US healthcare apps covers similar consent mechanics, and one consent system can serve both.

This is a summary for product teams, not legal advice. Confirm how the Act applies to your product with counsel.

2. Two Consents: Collection and Sharing

RCW 19.373.030 sets the core rule. You may collect consumer health data only with the consumer’s consent for a specified purpose, or to the extent necessary to provide a product or service the consumer has requested. You may share it only with a separate and distinct consent, or to the extent necessary to provide what the consumer requested.

“Consent” is defined strictly in RCW 19.373.010. It must be a clear affirmative act that is freely given, specific, informed, opt-in and unambiguous. It cannot be obtained by:

• accepting general terms of use or a broad privacy notice;
• hovering over, muting, pausing or closing a piece of content;
• deceptive designs (dark patterns).

Each consent request must say what categories of data are collected or shared, the purpose, the categories of recipients, and how the consumer can withdraw consent. The necessary-for-the-service route is real but narrow: storing the heart-rate data a user asked your app to track is necessary; sending it to an analytics or advertising SDK is not.

The consumer health data privacy policy

RCW 19.373.020 requires a separate consumer health data privacy policy, linked prominently from your homepage. It must list the categories of data collected and why, the sources, the categories shared, the categories of third parties and the specific affiliates you share with, and how consumers exercise their rights. New categories or purposes need updated disclosure and fresh consent first.

3. Selling Data Needs a Signed Authorization

“Sale” means exchanging consumer health data for money or other valuable consideration, which can include some advertising and data-broker arrangements. Under RCW 19.373.070, a sale requires a valid authorization signed by the consumer, separate from any collection or sharing consent. The authorization must include:

• the specific data to be sold;
• the names and contact details of the seller and the buyer;
• the purpose of the sale, including how the data will be gathered and used;
• a statement that goods or services can’t be conditioned on signing;
• the consumer’s right to revoke, and how;
• a warning that the buyer may redisclose the data, which may then lose protection;
• an expiration date one year after signing, plus the consumer’s signature and date.

Seller and buyer must keep it for six years. For most teams the safer decision is not to sell at all, and to check that no SDK or ad integration does it for you.

4. The Geofencing Ban

RCW 19.373.080 makes it unlawful for any person to set up a geofence around an entity that provides in-person health care services where the geofence is used to identify or track consumers seeking health care, collect consumer health data from them, or send them notifications, messages or ads about consumer health data or health services. A geofence here means a virtual boundary of 2,000 feet or less around a physical location.

This section took effect on 23 July 2023, earlier than the rest of the Act, and has no small-business exception and no consent exception. If your app uses location to send “you’re near a clinic” prompts, or a marketing partner targets ads around hospitals or pharmacies, that is the feature to remove.

5. Consumer Rights and Deadlines

You can’t require a consumer to create an account to make a request, and you must authenticate requests with commercially reasonable effort. Deletion is the hard one to build: it means knowing every place a user’s health data lives, including logs, analytics exports, backups and vendors.

6. Enforcement, the Private Right of Action and the Amazon Case

RCW 19.373.090 makes a violation of the Act an unfair or deceptive act under Washington’s Consumer Protection Act (chapter 19.86 RCW). That has two consequences:

• The Attorney General can bring enforcement actions.
• Individuals can sue. Under RCW 19.86.090, a person injured in their business or property can recover actual damages, costs and reasonable attorney’s fees, and the court may increase damages up to three times, capped at $25,000 for that enhancement. Class actions are possible.

That private right of action is what makes Washington’s law different from most state privacy laws, including Nevada’s and Connecticut’s.

What happened to the Amazon lawsuit

The first class action under the Act, Maxwell v. Amazon.com, Inc., was filed on 10 February 2025 in the Western District of Washington (No. 2:25-cv-00261). It alleged that Amazon’s advertising SDK, embedded in third-party apps, collected precise location data that could indicate attempts to get health services, without the consent the Act requires. Amazon denied the allegations.

Many articles still describe this case as pending. The federal docket shows otherwise. The case was consolidated with others into In re Amazon Ads SDK Litigation (No. 2:25-cv-00252). On 29 May 2025, Maxwell voluntarily dismissed her claims without prejudice. The remaining consolidated plaintiff voluntarily dismissed on 5 June 2025, and the court closed the case on 6 June 2025. The court did not rule on the merits of the MHMDA claim.

So as of October 2026 we are not aware of any published court decision interpreting the Act’s key terms, such as what location data “could reasonably indicate” an attempt to get health services, or what injury a plaintiff must show. Until a court rules, assume the broad reading.

7. Similar Laws: Nevada and Connecticut

Nevada’s SB 370 is closely modelled on Washington’s Act and took effect on 31 March 2024, with enforcement by the Attorney General and no private right of action. Connecticut took a different route: it folded consumer health data into its general privacy law. The Connecticut Attorney General explains that consumer health data controllers are covered with no revenue or processing thresholds, need consent to process or sell consumer health data, and may not geofence mental, reproductive or sexual health facilities. The Attorney General has exclusive enforcement power, with civil penalties of up to $5,000 per violation under the state’s unfair trade practices law.

If you build one consent and rights system to Washington’s standard, you will meet most of Nevada’s and Connecticut’s consumer health data rules too.

8. Implementation Checklist for App Developers

1. Map your health data. List every field, event and inference that could reveal health status, including location, purchase history and anything a model derives. Mark which is PHI under a BAA and which is not.
2. Classify each use. For each data flow, decide whether it is necessary to deliver what the user asked for, or needs consent. Anything for marketing, analytics, research or model training needs consent.
3. Build two consent screens. One for collection, one for sharing, each naming data categories, purpose, recipients and how to withdraw. No pre-ticked boxes, no consent bundled into terms of use.
4. Store consent as records. Who, what version of the text, when, which categories, and withdrawal events, so you can prove consent later.
5. Gate the data, not just the UI. Make the backend refuse to send data to a recipient unless the matching consent exists. Front-end checks alone are not enough.
6. Audit every SDK. Remove or reconfigure ad, analytics and session-replay SDKs that transmit health-related events or precise location without sharing consent.
7. Remove geofencing near health care locations. No location-triggered messages, ads or data collection around clinics, hospitals or pharmacies.
8. Don’t sell. Treat any data-for-value arrangement as a sale unless counsel says otherwise.
9. Publish the health data privacy policy and link it from the homepage.
10. Build the rights workflow. Request intake without requiring an account, identity verification, access export including the third-party list, deletion that reaches backups and processors, a 45-day clock and an appeal path.
11. Sign processor contracts that limit vendors to your instructions.
12. Restrict internal access with role-based permissions, and log who views health data.

9. Where VertiComply Fits

VertiComply generates full-stack healthcare apps (web, plus native iOS and Android) with HIPAA safeguards on every plan: encryption, audit logging, role-based access control and session timeouts. Those cover items 11 and 12 above and give you the audit trail that consent and deletion records depend on. Washington-specific pieces, such as two-step consent wording, the health data privacy policy and SDK choices, are product and legal decisions you still need to make. For apps that handle PHI, we sign a business associate agreement on request on paid plans (Pro $89/month, Business $249/month, Enterprise $349/month), not on the Free plan; see pricing. VertiComply does not hold a SOC 2 or HITRUST attestation.

If your app also uses AI, our guides to HIPAA-compliant AI and state AI-in-healthcare laws cover the rules that sit alongside this one.

10. Frequently Asked Questions

Does the Washington My Health My Data Act apply to HIPAA-covered apps?

Partly. Protected health information under HIPAA is exempt, but the exemption covers the data, not the company. A covered entity’s marketing site, symptom quiz or wellness features can collect health data that isn’t PHI, and that data falls under the Act. Direct-to-consumer health and wellness apps that don’t work for a covered entity usually handle no PHI at all.

Is there a private right of action under the My Health My Data Act?

Yes. A violation is an unfair or deceptive act under Washington’s Consumer Protection Act, so an injured person can sue for actual damages, costs and attorney’s fees, and the court can increase damages up to three times, with the increase capped at $25,000. Nevada’s and Connecticut’s similar laws have no private right of action.

What happened to the Amazon My Health My Data lawsuit?

The first class action under the Act, Maxwell v. Amazon.com, was filed in February 2025 and consolidated into In re Amazon Ads SDK Litigation in the Western District of Washington. The federal docket shows the plaintiffs voluntarily dismissed their claims without prejudice in May and June 2025, and the case closed on 6 June 2025 with no ruling on the merits.

Do small businesses have to comply with the My Health My Data Act?

Yes. The Act has no revenue threshold. Small businesses, those handling fewer than 100,000 consumers a year, or under 50% of revenue from health data and fewer than 25,000 consumers, had until 30 June 2024 rather than 31 March 2024, but the duties are the same.

What counts as consumer health data under the Act?

Personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status. That includes conditions, symptoms, medications, vital signs, reproductive and sexual health, biometric and genetic data, precise location suggesting a visit for health services, and health inferences drawn from non-health data, for example by machine learning.

Can I use one consent for collecting and sharing health data?

No. The Act requires consent for sharing that is separate and distinct from consent for collection, unless sharing is necessary to provide the product or service the consumer asked for. Selling health data needs a third, signed authorization that expires after one year.

Last reviewed 12 October 2026. Court decisions or amendments may change how the Act is read; check the current RCW text and the Attorney General’s guidance. Nothing here is legal advice.