Regulatory advisory service

Washington MHMDA Compliance Memo: Fixed-Price Regulatory Review for SaaS, AI, and Health Apps

If your product touches Washington consumers and any data plausibly counts as "consumer health data," Chapter 19.373 RCW (the Washington My Health My Data Act) applies. This is the first US health-privacy law outside HIPAA, with a per se Consumer Protection Act hook and a private right of action. Compliance is a regulatory question I can review under my California license today, no Washington admission required. The three tiers below productize the work into fixed-price written memos so you know the deliverable and the price before you engage.

What MHMDA actually requires

MHMDA applies to any "regulated entity" or "small business" that conducts business in Washington or targets products or services to Washington consumers, and that determines the purpose and means of processing consumer health data. The scope, definitions, and small-business cutoff sit in and . "Consumer health data" reaches anything reasonably linkable to a consumer that identifies past, present, or future physical or mental health status, including inferences drawn from non-medical signals. The Act has been operative against regulated entities since March 31, 2024 and against small businesses since June 30, 2024.

The five operative compliance obligations: (1) a standalone Consumer Health Data Privacy Policy prominently linked from the homepage, under ; (2) a two-layer affirmative consent regime, separate consent for collection and separate consent for sharing, under ; (3) a binding-instructions processor contract regime under ; (4) a HIPAA-style nine-element authorization before any sale of consumer health data, under ; and (5) a flat prohibition on geofences within 2,000 feet of in-person healthcare facilities for tracking, data collection, or advertising, under .

The reason the stakes are high is . That section declares every MHMDA violation a per se Consumer Protection Act violation under Chapter 19.86 RCW. A private plaintiff does not need to plead the public-interest element separately; the statute supplies it. Combined with discretionary treble damages capped at $25,000 on the enhancement, the one-way fee shift, and the four-year statute of limitations under RCW 19.86.120, MHMDA is the highest-leverage state consumer-health-privacy statute in the United States.

The exemptions at are narrower than they look. They are data-specific, not entity-blanket. A HIPAA-covered hospital is exempt for its PHI but not for marketing-pixel data on its public website. Wellness apps outside a covered-entity offering, consumer fitness trackers, direct-to-consumer mental-health apps, period and fertility apps, sleep apps, AI symptom checkers, and general-purpose apps that infer health from non-medical signals are not HIPAA-covered and are not exempt.

The three memo tiers

Tier 1, MHMDA Scope Memo, $499

Tier 2, MHMDA Memo plus DPA and Vendor Language, $900

Tier 3, MHMDA Memo plus Drafted Consumer Health Data Privacy Policy, $1,500

Why I can do this work under my California license

Washington's My Health My Data Act can reach out-of-state companies if they conduct business in Washington or target products or services to Washington consumers and determine the purposes and means of collecting, processing, sharing, or selling consumer health data. A SaaS company in Texas with Washington users, a wellness app in California targeting Washington consumers, or an AI health tool collecting consumer health data from Washington users may need MHMDA review depending on targeting, data categories, and control over processing. Compliance review is regulatory advisory work, not Washington representation. I am California-licensed (CA Bar #279869) with Washington admission pending; an MHMDA memo is a regulatory analysis of how a Washington statute applies to your product, not "Washington representation." If a matter escalates into Washington-specific litigation, an Attorney General enforcement action, or a private CPA claim filed in Washington courts, I would coordinate with Washington counsel or refer the litigation work out.

What I need from you to scope and deliver

What is not in scope

Three things sit outside these tiers and should be priced separately if you need them. First, defending an active Washington Attorney General inquiry or a filed private CPA complaint is litigation-adjacent work that I would scope hourly and, if needed, coordinate with Washington counsel. Second, a multi-state harmonization memo that maps MHMDA against CCPA / CPRA, the Connecticut Data Privacy Act, the Nevada SB 370 health-data law, or GDPR is broader than the single-statute scope here and would be quoted separately. Third, drafting a general privacy policy or terms of service from scratch is a different product; the Tier 3 deliverable is the MHMDA-specific standalone document, not a complete general privacy policy.

Authority notes

Statutory sources retrieved 2026-05-18 from app.leg.wa.gov:

Dollar amounts, statutory amendments, and any subsequent Washington Attorney General guidance, agency forms, or regulations issued under MHMDA should be checked against the current publications on app.leg.wa.gov and atg.wa.gov before relying on them in a specific matter. Each memo I write re-verifies the operative text on the day it is drafted.

Educational and service-information resource. Sergei Tokmakov is a California attorney (CA Bar #279869) currently seeking admission to the Washington State Bar. Nothing on this page creates an attorney-client relationship or is legal advice for a specific matter. An MHMDA memo under any of these tiers is regulatory advisory work product, not Washington-specific representation. Related: Washington My Health My Data Act hub; Washington Consumer Protection Act hub; Washington Data Breach Notification Guide; Washington SaaS Terms Guide.