The My Health My Data Act (MHMDA) is a Washington state law that protects consumer health data not covered by HIPAA. The Washington Attorney General describes it as the first privacy-focused law in the country aimed at personal health data outside HIPAA’s reach.
For treatment center marketing, it matters because the definition of consumer health data reaches the kind of data ad platforms and tracking tools collect: signals that someone is seeking health care, and location data near a facility.
It applies to businesses that conduct business in Washington or target Washington consumers. Targeting and tracking choices sit inside our paid media practice.
This entry is general information, not legal advice. Confirm your obligations with counsel.
Key Takeaways
- MHMDA applies to entities that do business in Washington or target Washington consumers, and it’s enforced by the Attorney General and through private lawsuits.
- Consumer health data includes data that identifies someone seeking health care, precise location that could indicate an attempt to get care, and inferences drawn from other data.
- Collecting consumer health data and sharing it each require separate consent. Selling it requires a signed authorization.
- A consumer health data privacy policy must be linked separately from the homepage.
- Geofencing within 2,000 feet of a facility that provides in-person health care, to track visitors or send them ads, is banned.
What counts as consumer health data
Under RCW 19.373, consumer health data is personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status. The definition lists examples, including:
- Social, psychological, behavioral, and medical interventions.
- Precise location that could reasonably indicate an attempt to acquire or receive health services.
- Data that identifies a consumer seeking health care services.
- Information derived or inferred from non-health data.
That reach is what makes MHMDA relevant to marketing. A website visit, an ad click, or an audience segment can count if it identifies someone seeking care.
Who it applies to
A “regulated entity” is one that conducts business in Washington, or produces or provides products or services targeted to Washington consumers, and that determines the purpose and means of handling consumer health data. Small businesses, defined by thresholds based on how many consumers’ data they handle, had a later compliance date.
HIPAA and Part 2 exemptions. The law exempts HIPAA protected health information and patient-identifying information covered by 42 CFR Part 2. Information held by a HIPAA covered entity is also exempt when it’s intermingled with PHI to the point of being indistinguishable.
The statute doesn’t exempt every piece of data a treatment center holds. Data that isn’t PHI and isn’t intermingled with it, such as some website or advertising data, may fall under MHMDA. That’s a reading of the statute, not an official interpretation, so confirm with counsel.
Consent, privacy policy, and sale
The law sets three separate requirements for how a regulated entity handles consumer health data:
- Consent. Collecting consumer health data requires consent, and sharing it requires a separate consent, distinct from the consent to collect.
- Sale. Selling consumer health data requires a valid authorization signed by the consumer, which expires after one year.
- Privacy policy. Regulated entities must publish a consumer health data privacy policy and link to it prominently from the homepage. The Attorney General’s guidance says it must be a separate and distinct link.
The geofencing ban
MHMDA makes it unlawful to implement a geofence around an entity that provides in-person health care services when it’s used to identify or track consumers seeking care, collect their consumer health data, or send them notifications or advertisements. The statute defines a geofence as a virtual boundary 2,000 feet or less from the facility’s perimeter.
For treatment center advertising, that rules out location-based targeting around facilities, including competitors’ facilities, for audiences in Washington.
Dates and enforcement
The geofencing ban took effect July 23, 2023. Most other requirements applied from March 31, 2024, and from June 30, 2024 for small businesses.
Violations are treated as violations of Washington’s Consumer Protection Act, enforced by the Attorney General and through private lawsuits. The first class action under the law was filed in February 2025, as reported by the Washington State Standard.
Related terms
For tracking that stays on the right side of health privacy rules, see our guides to HIPAA-compliant Meta ads for addiction treatment, HIPAA-safe conversion tracking, and the Meta Conversions API for treatment centers. For how paid media fits the rest of your marketing, see the complete guide to behavioral health marketing.
Frequently Asked Questions
Does the My Health My Data Act apply to treatment centers outside Washington?
It can. The law applies to entities that conduct business in Washington or target Washington consumers, not only to businesses based there.
A treatment center that advertises to Washington residents may be in scope.
Confirm with counsel based on where you market and admit patients.
Are HIPAA covered entities exempt?
Partly. HIPAA protected health information and 42 CFR Part 2 records are exempt, as is information intermingled with PHI to the point of being indistinguishable.
Data that isn’t PHI and isn’t intermingled with it, such as some marketing data, isn’t clearly exempt.
That’s a reading of the statute, so get a legal review of your tracking and advertising data.
Can we geofence competitor facilities or our own?
Not for Washington audiences. The law bans geofences of 2,000 feet or less around facilities that provide in-person health care when used to track consumers seeking care or send them ads.
That covers your own facility and others’.
Location-based targeting elsewhere still raises the same privacy concerns, so treat it carefully.
What does the law require on our website?
A consumer health data privacy policy, linked from the homepage with its own separate link.
Consent is required before collecting consumer health data, and separate consent before sharing it.
Selling it requires a signed authorization that expires after one year.