The deadline is fast approaching for Washington “small businesses” to comply with the state's My Health My Data Act (MHMDA).

The MHMDA, signed by Gov. Jay Inslee on April 27, 2023, provides stronger privacy protections to the consumer health data of Washington residents and individuals whose consumer health data is collected in Washington state. Compliance was phased, and the law was first applied to larger legal entities—but smaller ones must now adhere by the end of this month.

The MHMDA applies to any legal entity that both:

• Conducts business in Washington or produces or provides products or services targeted at Washington consumers
• Alone or with others, determines the purpose and means of collecting, processing, sharing, or selling consumer health data

On March 31, 2024, the state began requiring compliance from large legal entities that do either of the following: 

• Collect, process, sell, or share the consumer health data of at least 100,000 consumers per calendar year; or
• Derive at least 50% of their gross revenue from collecting, processing, selling, or sharing of at least 25,000 consumers' health data.

Now, by June 30, 2024, even businesses falling below those thresholds are required to comply with §§ 4-9 of MHMDA.

To learn more about the MHMDA and how to achieve compliance, read our recent client alert found here.