Washington My Health My Data Act (MHMDA)

MHMDA defines consumer health data as personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, a definition that reaches inferences and non-health data indicating health status, such as precise location data that could indicate an attempt to obtain reproductive or gender-affirming care.

Because 'consumer health data' is itself defined as a subset of 'personal information,' and 'personal information' does not include publicly available information (RCW 19.373.010(18)(b)) or deidentified data, scraped health-indicating data that fits MHMDA's own publicly-available definition falls outside its coverage; that carve-out, however, does not extend to biometric data, which MHMDA's 'publicly available information' definition expressly excludes even when otherwise public (RCW 19.373.010(22)).

RCW 19.373.080 makes it unlawful to implement a geofence around an entity providing in-person health care services to identify or track consumers, collect their health data, or send them related notifications, messages, or advertisements. RCW 19.373.090 provides that any violation of the chapter is per se an unfair or deceptive act under the Washington Consumer Protection Act, chapter 19.86 RCW, which carries a long-standing private right of action, giving MHMDA its own enforcement mechanism.

This is now live litigation risk, not theoretical: Maxwell v. Amazon.com, Inc., No. 2:25-cv-261 (W.D. Wash., filed February 10, 2025), a putative class action alleging Amazon harvested location and biometric data via SDKs without consent in violation of MHMDA, was reported pending by contemporaneous legal commentary as of the sources consulted; the docket itself was not independently read in this research, so treat its procedural posture as reported rather than verified.