Washington Attorney General Publishes Updated FAQ For My Health My Data Act

Without much fanfare, the Washington attorney general's office updated its My Health My Data (MHMD) Act guidance FAQ in January 2024. Specifically, the updated guidance states that the consumer health data privacy policy must have its own "separate and distinct link" on a regulated entity's homepage and "may not contain additional information not required under the My Health My Data Act."

This updated FAQ means regulated entities likely will need to have a wholly separate consumer health data privacy policy that addresses only the MHMD Act's privacy policy requirements as the Washington Attorney General's guidance states that the consumer health data privacy policy may not contain any information not required under the MHMD Act. As a result, regulated entities likely won't be able to rely on a one-size-fits-all general privacy policy that also, for example, addresses the privacy policy requirements under the California Consumer Privacy Act and other state consumer