Washington My Health My Data Act (MHMD)
The Washington My Health My Data Act (SB 5693, effective March 31, 2024 for regulated entities; June 30, 2024 for small businesses) protects consumer health data not covered by HIPAA. It applies to regulated entities conducting business in Washington or targeting Washington consumers that collect, share, or sell consumer health data. Notable for its broad definition of health data, private right of action, and geofencing prohibition near healthcare facilities.
Washington My Health My Data Act (MHMD) is a compliance framework from United States — Washington with 12 domains and 18 controls. The largest domains are Consumer Rights (3 controls), Processors and Record Keeping (3 controls), Consent, Authorisation and Sale (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (12)
Consent
Consent, Authorisation and Sale
| Code | Title |
|---|---|
| MHMD-MKT.1 | Marketing and advertising governance |
| MHMD-SAL.1 | Valid authorization to sell Consumer Health Data |
Consumer Rights
| Code | Title |
|---|---|
| MHMD-NDR.1 | Non-discrimination for exercising rights |
| MHMD-RTS.1 | Consumer right to access Consumer Health Data |
| MHMD-RTS.2 | Consumer right to withdraw consent and delete data |
Data Minimisation and Minors
| Code | Title |
|---|---|
| MHMD-MIN.1 | Data minimisation and purpose limitation |
| MHMD-SMI.1 | Special handling of minors |
Enforcement
| Code | Title |
|---|---|
| WAMHMD-6 | Enforcement (CPA + Private Right of Action) |
Incident Detection and Notification
| Code | Title |
|---|---|
| MHMD-INC.1 | Incident detection and notification |
Notice and Transparency
| Code | Title |
|---|---|
| MHMD-NOT.1 | Consumer Health Data Privacy Policy |
Privacy Notice
Processors and Record Keeping
| Code | Title |
|---|---|
| MHMD-PRO.1 | Processor contractual obligations |
| MHMD-PRO.2 | Processor compliance support obligations |
| MHMD-REC.1 | Record keeping and demonstrability |
Rights
Scope
Security
What is Washington My Health My Data Act (MHMD) and who does it apply to?
Washington My Health My Data Act (MHMD) is a compliance framework from United States — Washington with 12 domains and 18 controls. The Washington My Health My Data Act (SB 5693, effective March 31, 2024 for regulated entities; June 30, 2024 for small businesses) protects consumer health data not covered by HIPAA. It applies to regulated entities conducting business in Washington or targeting Washington consumers that collect, share, or sell consumer health data. Notable for its broad definition of health data, private right of action, and geofencing prohibition near healthcare facilities. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Washington My Health My Data Act (MHMD) actually require?
Washington My Health My Data Act (MHMD) has 18 controls organised across 12 domains. The largest domains are Consumer Rights (3 controls), Processors and Record Keeping (3 controls), Consent, Authorisation and Sale (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Washington My Health My Data Act (MHMD) do I already cover?
Washington My Health My Data Act (MHMD) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Washington My Health My Data Act (MHMD)?
Start your Washington My Health My Data Act (MHMD) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Washington My Health My Data Act (MHMD) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 18 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required