Washington MHMDA for Mental Health SaaS: Compliance Outside HIPAA

MHMDA defines consumer health data at RCW 19.373.010 as personal information linked or reasonably linkable to a consumer that identifies past, present, or future physical or mental health status, including inferences. Mental health is named expressly. The definition reaches the obvious categories (diagnosis, treatment, symptoms, medication) and also reaches the inputs and outputs of most mental health SaaS products: mood logs, journal entries, sleep and stress markers, PHQ-9 / GAD-7 / PCL-5 questionnaire results, crisis-language flags, and any AI inference drawn from non-clinical inputs.

Three reasons this category carries more exposure than ordinary wellness SaaS. First, most mental health products explicitly invite users to disclose mental health status, which removes any "we never collect health data" argument. Second, third-party SDKs (analytics, session replay, attribution pixels, CRM, AI APIs, customer support tooling) commonly receive content that is consumer health data, which converts marketing pixels and AI-API calls into MHMDA sharing events. Third, the per se CPA bridge in RCW 19.373.090 means a plaintiff does not have to prove public-interest impact under Hangman Ridge; a private right of action with discretionary trebling capped at $25,000 and one-way fees attaches automatically.

HIPAA reaches covered entities (health plans, healthcare clearinghouses, healthcare providers transmitting health information electronically in HIPAA transactions) and their business associates. A consumer-facing mental health SaaS without a provider relationship is usually neither. Direct-to-consumer therapy chatbots, journaling apps, mood trackers, peer-support apps, and AI mental health assistants typically sit outside HIPAA. The exemption at RCW 19.373.100 is data-specific, not entity-blanket: even an app that has some HIPAA-covered relationships still owes MHMDA duties on any consumer health data that is not PHI in a covered transaction.

For a side-by-side analysis of overlap, exemptions, and the practical posture for hybrid products, see my HIPAA vs MHMDA for Mental Health SaaS.

• Separate Consumer Health Data Privacy Policy under RCW 19.373.020. Standalone document, prominently linked from the homepage, distinct from the general privacy policy. Five substantive disclosures including the specific affiliates list. Bundling MHMDA disclosures into a general privacy policy is the single most common failure pattern.
• Two-layer consent under RCW 19.373.030. Affirmative consent for collection plus a separate, distinct consent for sharing. Unbundled from general terms acceptance. A single "I agree to the privacy policy" checkbox is insufficient.
• Operational rights and deletion workflow under RCW 19.373.040. Confirmation, access with third-party recipient list, withdrawal, deletion (including downstream notification to processors and third parties), and an appeal process with a written decision within 45 days. This must be operational, not just policy text. A deletion request that cannot actually be executed against the AI vector store, the analytics warehouse, and the CRM is a violation in practice.
• Reasonable-care security under RCW 19.373.050. Restrict access to only the employees, processors, and contractors for whom access is necessary to further consented purposes. Administrative, technical, and physical controls at or above industry baseline.
• MHMDA-compliant processor contracts under RCW 19.373.060. Binding instructions, scoped permitted purposes, reasonable-assistance obligation. Standard GDPR DPAs and CCPA service-provider agreements usually need a Washington addendum. A processor that strays outside instructions converts into a regulated entity for the data at issue.
• Geofence prohibition under RCW 19.373.080. Flat prohibition on geofencing within 2,000 feet of an in-person healthcare facility for identifying or tracking consumers, collecting health data, or sending notifications. Behavioral health products with location-based ads or push triggers should audit ad-platform configurations against psychiatric facility, treatment center, and methadone clinic addresses.
• Per se CPA bridge under RCW 19.373.090. Any violation is automatically a Washington Consumer Protection Act violation. Public-interest prong is given by declaration; plaintiff still pleads injury and causation.

The exposure profile differs by sub-category. I keep an issue page for each so the gap analysis stays specific to your product.

• Therapy app MHMDA compliance: licensed-provider directories, asynchronous messaging, video sessions, and the HIPAA-MHMDA overlap analysis for hybrid models.
• Mood tracker MHMDA compliance: mood logs, sleep / stress markers, inference engines, and PHQ-9 style assessments outside any clinical relationship.
• Journaling app MHMDA compliance: free-text journal entries as the highest-sensitivity input category, AI summarization risk, and processor mapping for AI features.
• Substance use app MHMDA compliance: sobriety trackers, recovery community apps, and the 42 CFR Part 2 carve-out at RCW 19.373.100.
• Mental health AI chatbot privacy: AI model APIs, training-data posture, retention windows, crisis-flag transmission, and the licensed-professional branding line.
• Behavioral health SaaS privacy review: B2B and clinical-provider-facing products, provider portals, and HIPAA business associate analysis layered on MHMDA.
• HIPAA vs MHMDA for mental health SaaS: side-by-side coverage, exemption mechanics, and the practical posture for hybrid products.
• Does HIPAA apply to my startup: the covered-entity vs business-associate vs neither decision tree, and what governs your data when HIPAA does not.
• Senior-living and sensor-tech privacy: HIPAA status across care settings plus passive sensor data through a hardware cloud API.
• Minimum legal scope for a pilot: the short consent, disclaimer, and privacy-notice set to run a small or free pilot before launch.

• Current privacy policy URL plus a date-stamped capture; the consumer-health-data policy if you publish one separately.
• Homepage screenshot on desktop and mobile showing the policy link.
• Consent UX screenshots: signup, in-app consent banners, sharing toggles, AI-feature disclosures, withdrawal mechanism.
• Data inventory of consumer health data categories (mood logs, journal entries, assessment results, chat content, inferred categories).
• Vendor map: analytics, session replay, attribution, ad pixels, CRM, AI model APIs, support widgets, cloud processors, sub-processors, plus current DPA template.
• HIPAA posture: are you a covered entity, a business associate, or neither, and which data fields if any sit inside a HIPAA-covered relationship.
• Brief product description: what the product does, what data it collects, which Washington users it touches, what AI features it ships.

Payment

Flat fee, paid up front through a secure PayPal checkout, so the budget is fixed before any work starts. The flat fee for the Healthcare SaaS Legal Package is $2,500. There is no hourly meter and no surprise invoice. If a matter is unusually large or turns into extended negotiation, I tell you before any additional work and we agree on scope first.

Delivery

Drafts in 2 to 3 business days, even for complex agreements. I work weekends when a matter needs it and it is engaged. You receive the work product by email in an editable format, with brief written comments explaining the key issues and the reasoning behind the main choices.

Process

1. Send the materials. Email me your current documents, screenshots, and a short description of the product and the Washington consumers it touches.
2. I confirm scope and run a conflict check. Engagement begins only after that check and a written confirmation of what is included.
3. I draft or review. You get the deliverable with plain-language comments on the highest-risk items first.
4. We refine. Reasonable revision rounds are included so the final version fits how your product actually works.

Scope

This is attorney-supervised regulatory and document work under my California license: issue spotting, compliance planning, drafting, and review. It is not Washington court representation. For Washington filings, litigation, or any court appearance, I coordinate with Washington-admitted counsel. Nothing here creates an attorney-client relationship until a conflict check clears and an engagement is confirmed in writing.

Statutory sources retrieved 2026-05-19 from app.leg.wa.gov: RCW 19.373.010, .020, .030, .040, .050, .060, .080, .090, .100.