language: en · status: in-force · last checked: 2026-09-19

Washington My Health My Data Act

Enacted by 2023 c 191 (SHB 1155) and in force from 31 March 2024 (30 June 2024 for a small business), MHMD is the broadest consumer-health-data statute in the United States and the only privacy act in this corpus outside the biometric statutes that a private plaintiff can enforce. It binds a regulated entity with no revenue or volume threshold at all: any legal entity that conducts business in Washington, or produces products or services targeted to Washington consumers, and determines the purpose and means of collecting, processing, sharing or selling consumer health data.

Applicability to EdTech

Read the "regulated entity" exclusion before anything else. §19.373.010(23) provides that the term "does not mean government agencies, tribal nations, or contracted service providers when processing consumer health data on behalf of the government agency". A Washington school district is a government agency, so a vendor processing consumer health data under a district contract is outside the Act for that processing. This is the reverse of the usual district-out/vendor-in split, and it is the single most consequential provision here.

What the exclusion does not cover is everything else: a direct-to-consumer or direct-to-parent surface, a free tier a family signs up to themselves, data a vendor holds outside the district contract, and anything a processor does beyond its instructions. The boundary is the contract, and it is drawn per processing activity, not per company.

The FERPA exemption is at the level of the data. §19.373.100(2)(d) exempts personal information governed by and collected, used or disclosed pursuant to FERPA. Student data handled as education records is out; a vendor's other personal data is not.

Biometric data is consumer health data. §19.373.010(8) defines consumer health data as personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status, and (8)(b) enumerates what that includes — among them biometric data ((b)(ix)), genetic data, precise location that could indicate an attempt to obtain health services, and, in (b)(xiii), any information processed to associate or identify a consumer with the listed data that is derived or extrapolated from non-health information, expressly including by algorithms or machine learning. That last limb is the one to watch: a wellbeing, SEL, behaviour or engagement-analytics feature that infers a mental-health signal from ordinary product telemetry produces consumer health data even though no health data was ever collected.

Consent is doubled and separate. §19.373.030 forbids collecting consumer health data without consent for a specified purpose or necessity to provide what the consumer requested — and forbids sharing it without a separate and distinct consent. Selling requires more again: a signed valid authorization meeting the content requirements of §19.373.070, valid for at most one year.

The geofence ban binds "any person". §19.373.080 makes it unlawful for any person — not merely a regulated entity, and with no government-contractor carve-out — to implement a geofence around an entity providing in-person health care services in order to identify or track consumers seeking health care, collect their consumer health data, or send them related messages. Any product with campus- or location-based triggers needs to be checked against this.

Key obligations at a glance

• Consumer health data privacy policy — §19.373.020: a separate policy, linked from the homepage, listing categories collected, sources, categories shared, the third parties and specific affiliates shared with, and how to exercise rights. Collecting or using a category or purpose not disclosed requires fresh affirmative consent, and contracting with a processor to process inconsistently with the policy is itself a violation ((1)(e)).
• Consumer rights — §19.373.040: confirmation, access including a list of third parties the data was shared with, withdrawal of consent, and deletion, with the deletion duty running to affiliates, processors, contractors and other third parties that received the data.
• Security — §19.373.050: need-to-know access restriction plus administrative, technical and physical practices meeting a reasonable standard of care for the industry.
• Processors — §19.373.060: processing only under a binding contract setting out instructions and limits, plus a duty to assist the regulated entity. A processor that departs from its instructions, or processes outside the contract's scope, becomes a regulated entity as to that data ((1)(c)).

Enforcement

There is no enforcement section in the chapter. Instead §19.373.090 declares a violation to be an unfair or deceptive act in trade or commerce for the purposes of the Consumer Protection Act, chapter 19.86 RCW — which carries the Attorney General's powers and a private right of action under RCW 19.86.090, with treble damages up to a statutory cap and attorney fees. The Act also states in terms that the practices covered are "matters vitally affecting the public interest" and that a violation "is not reasonable in relation to the development and preservation of business", pre-establishing two of the elements a private CPA plaintiff would otherwise have to prove.

Contents

Licence

The reproduced text is RCW 19.373, enacted by the Washington State Legislature and served by the Legislature on app.leg.wa.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The site footer reads "Copyright 2025. All Rights Reserved." (read 2026-10-01). That is a site-wide notice; under the holding above it cannot reach the statute text, which is the work of the Legislature in the course of its official duties. It may cover the site's own design, which the corpus does not reproduce.

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Washington State Legislature endorses the corpus.

Related

• Washington RCW 19.375 — the state's other biometric regime: narrower (enrolment in a database for a commercial purpose), AG-only, and expressly excluding photographs and video, where MHMD reaches inferred data
• Illinois BIPA — the other privately enforceable regime over biometric identifiers
• Montana Consumer Data Privacy Act and Oregon Consumer Privacy Act — the comprehensive acts of the neighbouring states, both AG-only
• Texas TDPSA — the comparator with the same data-level FERPA exemption
• FERPA — the federal education-records regime §19.373.100(2)(d) exempts data under

Sources

• RCW chapter 19.373 — the Washington State Legislature's own RCW pages (per-section capture dates are listed in the fact document)