On this page
The Washington My Health My Data Act (MHMDA) represents the most restrictive health data privacy legislation in the United States, fundamentally reshaping how healthcare organizations can advertise in Washington state. Effective March 31, 2024, for regulated entities and June 30, 2024, for small businesses, with its geofencing ban in force since July 23, 2023, this groundbreaking law establishes unprecedented restrictions on health data collection and introduces a complete prohibition on geofencing around healthcare facilities.
Unlike other state privacy laws that focus primarily on general personal data, the Washington My Health My Data Act specifically targets health-related information with surgical precision. The law's most dramatic provision bans geofencing within 2,000 feet of any healthcare facility, creating an advertising dead zone that extends far beyond the physical boundaries of hospitals, clinics, and pharmacies across Washington state.
Understanding MHMDA Requirements and Timeline
The Washington My Health My Data Act establishes a two-phase implementation schedule that healthcare marketers must navigate carefully. Regulated entities that are not small businesses faced compliance deadlines beginning March 31, 2024. Small businesses, as the Act defines them, had until June 30, 2024. HIPAA-covered protected health information is exempt from the Act.
The law applies to any entity that conducts business in Washington state or produces products or services targeted to Washington residents and collects health data. This broad jurisdictional reach means that healthcare advertisers operating from other states but targeting Washington consumers fall under MHMDA's requirements.
MHMDA requires businesses to obtain valid consent before collecting, sharing, or selling health data. This consent must be separate from other agreements, clearly explain how the data will be used, and allow consumers to withdraw consent at any time. The law also mandates that businesses honor consumer requests to delete health data and confirm that such data has been deleted by third parties.
The Revolutionary 2,000-Foot Geofencing Prohibition
The most striking aspect of the Washington My Health My Data Act is its absolute ban on geofencing around healthcare facilities. This prohibition extends 2,000 feet from any healthcare facility and applies whenever a geofence is used to identify or track people seeking care, collect their health data, or send them health-related ads or messages.
The geofencing ban has no consent exception. Unlike other privacy regulations that provide carve-outs for certain types of advertising or specific circumstances, MHMDA's geofencing restriction applies to any person, though only to geofences used for its three listed purposes. Healthcare facilities covered under this prohibition include hospitals, clinics, medical offices, mental health facilities, reproductive health clinics, pharmacies, and any other location where healthcare services are provided.
This 2,000-foot radius creates significant coverage areas, particularly in urban environments where healthcare facilities are densely clustered. A single hospital complex could create a geofencing exclusion zone covering roughly half a square mile or more, effectively eliminating location-based advertising opportunities across entire neighborhoods.
The practical impact extends beyond traditional geofencing campaigns. Advertisers cannot use location data to target individuals who have visited healthcare facilities within the restricted zones, regardless of whether the targeting occurs in real-time or uses historical location data. This restriction applies even when consumers have previously consented to location tracking for other purposes.
Transforming Healthcare Advertising Strategies
The Washington My Health My Data Act forces healthcare advertisers to completely rethink their digital marketing approaches. Traditional strategies that relied on proximity targeting to reach potential patients near healthcare facilities are now prohibited throughout Washington state.
Mobile advertising campaigns that previously targeted users within hospital parking lots, near specialist clinics, or around pharmacy locations must be completely redesigned. This affects not only direct healthcare providers but also pharmaceutical companies, medical device manufacturers, health insurance companies, and wellness service providers who used geofencing to reach relevant audiences.
Social media advertising faces similar restrictions. Platforms like Facebook, Instagram, and Google Ads that offer location-based targeting options cannot be used to reach users based on their proximity to healthcare facilities in Washington. This eliminates common advertising strategies such as targeting diabetes medication ads to users near endocrinology clinics or promoting mental health services to individuals near psychiatric facilities.
Healthcare marketers must shift toward demographic, behavioral, and interest-based targeting methods that do not rely on location data connected to healthcare facilities. This transition requires new creative approaches, different audience segmentation strategies, and alternative methods for measuring campaign effectiveness.
MHMDA's Expansive Definition of Health Data
The Washington My Health My Data Act defines health data far more broadly than HIPAA or other federal regulations. Under MHMDA, health data includes any personal information that identifies or could reasonably be linked to a consumer and relates to the consumer's past, present, or future physical or mental health status.
This definition encompasses traditional medical records, prescription information, and test results, but extends much further to include location data near healthcare facilities, purchase history for health-related products, internet search history related to health topics, app usage data from health and fitness applications, and biometric data collected by wearable devices.
The broad scope means that seemingly innocuous data points become regulated health information under MHMDA. A consumer's purchase of over-the-counter medications, their fitness tracker data showing heart rate patterns, or their search history for medical symptoms all constitute health data requiring special protection.
For healthcare advertisers, this expansive definition significantly impacts how they can collect and use consumer information. Marketing teams must carefully evaluate every data point they collect to determine whether it qualifies as health data under MHMDA's broad standards.
Consent Requirements Under MHMDA
The Washington My Health My Data Act establishes stringent consent requirements that go beyond typical privacy law standards. Valid consent under MHMDA must be freely given, specific, informed, and unambiguous. Consumers must actively opt in to health data collection; pre-checked boxes or implied consent are not permitted.
Consent requests must clearly describe the specific health data being collected, explain how the data will be used and shared, identify all parties who will have access to the data, and provide a simple method for withdrawing consent. The law requires that consent mechanisms be presented in plain language that average consumers can easily understand.
Healthcare advertisers must obtain consent to collect health data for a specified purpose and a separate, distinct consent to share it. Selling health data requires a further signed authorization.
The law also mandates ongoing consent management. Businesses must provide easy mechanisms for consumers to withdraw consent at any time and must honor withdrawal requests promptly. When consent is withdrawn, businesses must stop collecting the specified health data and delete previously collected information unless retention is required by law.
Private Right of Action and Consumer Enforcement
MHMDA includes a private right of action that allows individual consumers to sue businesses directly for violations of the law. This enforcement mechanism sets the law apart from many other state privacy regulations that rely solely on attorney general enforcement.
Consumers sue under Washington's Consumer Protection Act and can recover actual damages, which a court may increase up to three times, capped at $25,000 for the added amount. They may also recover attorney's fees and costs, making it financially viable for consumers to pursue legal action even for smaller violations. The law allows class action lawsuits, potentially creating significant financial exposure for businesses that violate MHMDA requirements.
The private right of action creates immediate accountability for healthcare advertisers. Unlike regulatory enforcement that may take years to develop, consumer lawsuits can emerge quickly after violations occur. This dynamic encourages proactive compliance rather than reactive responses to regulatory investigations.
Attorney general enforcement provides an additional layer of oversight. The Washington Attorney General can investigate violations, issue cease and desist orders, and pursue civil penalties. This dual enforcement structure ensures that violations face scrutiny from both individual consumers and state regulators.
MHMDA and HIPAA: Complementary Protection Frameworks
The Washington My Health My Data Act operates alongside HIPAA but covers significantly more entities and data types. While HIPAA applies primarily to healthcare providers, health plans, and their business associates, MHMDA covers any business that collects health data in Washington state, regardless of whether they provide healthcare services.
MHMDA's health data definition extends far beyond HIPAA's protected health information (PHI) to include consumer-generated data, commercial health data, and information that would not be covered under federal healthcare privacy laws. This means that businesses already compliant with HIPAA may still need extensive modifications to meet MHMDA requirements.
The laws work together to create layered protection for health information. Healthcare entities subject to both laws must comply with the more restrictive requirements in each situation. In many cases, MHMDA's consent requirements and data handling restrictions exceed HIPAA's standards, requiring additional safeguards beyond federal compliance measures.
For healthcare advertisers, this dual compliance requirement means that existing HIPAA compliance programs provide a foundation but not complete coverage for MHMDA obligations. Marketing teams must develop additional policies and procedures specifically addressing MHMDA's unique requirements, particularly regarding consumer consent and the geofencing prohibition.
Practical Compliance Steps for Healthcare Marketers
Healthcare advertisers operating in Washington state must implement comprehensive compliance programs addressing all aspects of the Washington My Health My Data Act. The first step involves conducting a thorough audit of all data collection practices to identify what information qualifies as health data under MHMDA's broad definition.
Marketing teams should review their current advertising campaigns to identify any that use geofencing or location-based targeting near healthcare facilities. These campaigns must be modified or discontinued to comply with the 2,000-foot prohibition. Advertisers should work with their platform partners to implement geographic exclusions that prevent targeting within restricted zones.
Consent mechanisms require immediate attention. Businesses must review all consent forms, privacy policies, and data collection notices to ensure they meet MHMDA's specific requirements. This includes implementing granular consent options that allow consumers to approve or deny different uses of their health data.
Data sharing agreements with third parties, including advertising platforms and analytics providers, must be updated to address MHMDA compliance. These agreements should specify how health data will be handled, ensure that third parties understand their obligations under the law, and provide mechanisms for data deletion when required.
Staff training is essential for successful compliance. Marketing teams, legal departments, and data management personnel must understand MHMDA requirements and how they apply to daily operations. Regular training updates should address new developments and enforcement actions as the law's implementation evolves.
National Implications and Spreading Adoption
The Washington My Health My Data Act represents the beginning of a national trend toward stricter health data privacy regulation. Nevada has enacted similar legislation, and multiple other states are considering comparable laws that would extend MHMDA-style protections beyond Washington's borders.
This expanding regulatory landscape means that healthcare advertisers may soon face patchwork compliance requirements across multiple states. Each jurisdiction may implement slightly different restrictions, consent requirements, and enforcement mechanisms, creating complex compliance obligations for national marketing campaigns.
The geofencing prohibition, in particular, may become a standard feature of state health privacy laws. As more states adopt similar restrictions, location-based healthcare advertising could become increasingly limited across large portions of the United States.
Healthcare organizations should prepare for this evolving regulatory environment by developing flexible compliance frameworks that can adapt to new state laws as they emerge. This proactive approach will minimize disruption as additional states implement health data privacy requirements similar to MHMDA.
Technology Solutions for MHMDA Compliance
Complying with the Washington My Health My Data Act requires sophisticated technology solutions that can prevent health data from flowing to advertising platforms while maintaining effective marketing capabilities. Traditional compliance approaches often rely on manual processes that cannot keep pace with the complex data flows involved in modern digital advertising.
Healthcare advertisers need solutions that can identify and block health data in real-time, ensuring that protected information never reaches advertising platforms or third-party analytics providers. These systems must operate seamlessly with existing marketing technology stacks while providing the granular control necessary for MHMDA compliance.
Advanced tracking solutions can help healthcare organizations maintain marketing effectiveness while respecting consumer privacy. By implementing intelligent data filtering and alternative measurement methodologies, businesses can continue running successful advertising campaigns without violating MHMDA's strict requirements.
Curve provides specialized HIPAA-compliant tracking solutions designed specifically for healthcare advertisers navigating complex privacy regulations like the Washington My Health My Data Act. Our technology prevents health data from reaching advertising platforms while maintaining the analytics capabilities healthcare organizations need to optimize their marketing investments.
Frequently Asked Questions
Does the Washington My Health My Data Act apply to businesses located outside Washington state?
Yes, MHMDA applies to any business that conducts business in Washington state or produces products or services targeted to Washington residents and collects health data. This means out-of-state healthcare advertisers targeting Washington consumers must comply with the law's requirements, including the geofencing prohibition and consent requirements.
Can healthcare facilities obtain exemptions from the 2,000-foot geofencing ban?
No, there is no exemption process. The prohibition covers any entity that provides in-person health care services, regardless of the type of services provided, whenever a geofence within 2,000 feet is used to track people seeking care, collect their health data, or send them health-related ads. This absolute ban applies to hospitals, clinics, mental health facilities, reproductive health centers, pharmacies, and all other healthcare locations.
How does MHMDA's health data definition differ from HIPAA's protected health information?
MHMDA defines health data much more broadly than HIPAA's protected health information (PHI). While HIPAA covers medical records and information transmitted by healthcare entities, MHMDA includes any personal information that could be linked to a consumer's health status, including location data near healthcare facilities, health-related purchase history, fitness app data, and internet search history related to health topics.
What are the potential penalties for violating the Washington My Health My Data Act?
MHMDA allows consumers to sue directly for violations, seeking actual damages, which a court may increase up to three times (capped at $25,000 for the added amount), plus attorney's fees and costs. The law permits class action lawsuits, which could result in significant financial exposure. Additionally, the Washington Attorney General can pursue enforcement actions, including civil penalties and cease and desist orders.