Washington tool

Washington MHMDA Scope Analyzer

My Health My Data Act (Chapter 19.373 RCW) is the most aggressive U.S. state health-privacy statute. It reaches wellness apps, fertility trackers, mental-health adjacent platforms, AI assistants that infer health, and almost every adtech vendor that collects location near healthcare facilities. Most operators do not know they are in scope. This tool walks the regulated-entity definition under , the consumer-health-data definition under , and the per-se CPA exposure under , and returns a risk score and the top compliance gaps.

Answer the nine questions below. The tool returns a regulated-entity determination, a list of likely compliance gaps, a risk score, and the CPA exposure note under RCW 19.373.090.

1Washington users

Do you have any Washington users right now?

Per , "consumer" includes a Washington resident OR a natural person whose consumer health data is collected in Washington. A single Washington user can trigger the statute.

2Targeting Washington consumers

Do you target products or services to Washington consumers?

Per , a regulated entity is any legal entity that conducts business in Washington OR produces or provides products or services targeted to Washington consumers AND determines the purposes and means of processing consumer health data.

3Data plausibly counts as consumer health data

Which of these data categories do you collect?

Per , "consumer health data" is broad and includes biometric data, mental-health information, reproductive or gender-affirming care information, location near healthcare facilities, and inferences from any of the above.

4Purpose and means determination

Do you control the purposes and means of processing?

The "regulated entity" definition requires determining the purposes and means of processing. A pure processor (acting only on a controller's documented instructions) is governed by the processor flow-down obligations under instead.

5Sale or sharing

Do you sell or share consumer health data?

Per , sharing requires a SEPARATE consent distinct from the collection consent. Per , sale requires a written authorization with all nine elements; missing one invalidates the authorization.

6Separate Consumer Health Data Privacy Policy

Do you have a separate Consumer Health Data Privacy Policy?

Per , a regulated entity must maintain a consumer-health-data privacy policy that discloses categories of data collected and purpose, sources, sharing, third parties, and rights mechanisms. A general privacy policy is usually not enough.

7Homepage link to the separate policy

Is the separate policy prominently linked from your homepage?

Per , the consumer-health-data privacy policy must be prominently published with a link on the homepage. A footer-only link on a busy homepage is often inadequate.

8Opt-in consent for collection

Do you obtain opt-in consent for collection?

Per , you may not collect consumer health data except with a consumer consent that specifies the purpose, or where collection is necessary to provide a requested product or service.

9Geofencing around healthcare facilities

Do you use geofencing around healthcare facilities?

Per , it is unlawful to implement a geofence within 2,000 feet of an in-person healthcare facility to identify or track consumers, collect consumer health data, or send notifications. This is a categorical ban; there is no consent override.

How the score is calculated

The score weighs the elements that drive MHMDA exposure. Weights total 100 points.

The four verdict bands are 80 to 100 (Significant exposure), 60 to 79 (Material gaps), 30 to 59 (Mostly compliant), and 0 to 29 (Compliant or out of scope).

Authority notes

Statutory citations come from RCW 19.373.010 (consumer, consumer health data, regulated entity, geofence), RCW 19.373.020 (privacy policy with homepage link), RCW 19.373.030 (separate consents for collection and sharing), RCW 19.373.040 (consumer rights: access, deletion, withdraw consent), RCW 19.373.050 (data security), RCW 19.373.060 (processor flow-down obligations), RCW 19.373.070 (nine-element sale authorization), RCW 19.373.080 (2,000-foot geofence prohibition), RCW 19.373.090 (per-se CPA pathway under Chapter 19.86 RCW), and RCW 19.373.100 (exemptions, including HIPAA PHI, GLBA, FCRA, FERPA).

For background on Washington MHMDA, see my Washington My Health My Data Act resource. For other Washington tools, see my Washington Business Law Resources hub.