Washington State's My Health My Data Act FAQ, Part Two – Requirements

In Part Two of our FAQ series on Washington state's My Health My Data (MHMD) Act, we answer questions related to some of the act's substantive requirements. As we explained in our previous FAQ, given the MHMD's breadth – both to which entities and data it applies – regulated entities should be mindful of their attendant obligations and risk profile.

A key takeaway for regulated entities is that, in comparison to other US state consumer privacy laws, the MHMD imposes some of the most stringent privacy-compliance obligations, including opt-in consent for certain consumer health data (CHD) processing activities, deletion rights with potentially no exceptions, etc.

General overview