Most provisions of Washington’s My Health My Data Act (MHMDA) come into force today, creating new protections for consumer health data not covered by HIPAA.
Key points
- Separate consent is required to collect and to share consumer health data.
- Selling health data requires a signed authorisation.
- A dedicated consumer health data privacy policy must be published.
- Geofencing around healthcare facilities is prohibited, and consumers can sue under the Consumer Protection Act.
The Act applies to organisations outside Washington that process data of Washington consumers. UK providers of health, wellness and fitness apps should review their consent flows.
Source: Chapter 19.373 RCW, Washington My Health My Data Act (Washington State Legislature)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
