Understanding the Compliance Timeline for Regulated Entities Under Washington’s My Health My Data Act

Signed into law on April 27, 2023, by Governor Jay Inslee, the My Health My Data Act is the first law in the United States that focuses on consumer health data privacy beyond HIPAA’s rules. HIPAA mainly protects data handled by healthcare providers, insurers, and their business associates. MHMDA covers many types of entities that collect, process, share, or sell consumer health data. These include technology companies, retail stores, wellness providers, and small medical offices.

Health data under this law has a wide meaning. It includes usual health information like treatments or conditions. It also includes biometric data, genetic information, location data related to healthcare, and data guessed from non-health activities. For example, if a store uses a person’s purchase history of items like non-prescription medicine or certain toiletries to guess their health condition, that data is covered by the Act.

Who Are Regulated Entities?

The law applies to “regulated entities.” These are any legal businesses in Washington or those aiming at Washington residents that decide how consumer health data is collected, used, shared, or sold. This includes healthcare providers with offices in Washington, telehealth providers serving Washington customers, marketing firms that handle health-related data, fitness app creators, and even companies outside Washington that process Washington residents’ health data.

Entities that only store consumer data in Washington but do not actively use it are not regulated. Government agencies, tribal nations, and their contractors are also exempt. Unlike some privacy laws, MHMDA does not exempt nonprofits or HIPAA-covered groups if they handle health data outside HIPAA rules. For example, wellness or cosmetic services not covered by HIPAA must follow MHMDA.

Critical Compliance Deadlines to Note

• July 23, 2023: Everyone had to follow the rule against geofencing. This means no one can use geofencing technology to target or track people within 2,000 feet of places offering in-person healthcare services. This stops companies from tracking or advertising aggressively near these locations.
• March 31, 2024: Larger regulated entities must follow the main privacy and data rules in Sections 4 through 9 by this day. They must post a Consumer Health Data Privacy Policy on their homepage. They need clear opt-in consent from consumers to collect, share, and sell health data. They also must have agreements with third-party processors and respond to consumer requests about their data.
• June 30, 2024: Small businesses get an extra three months to meet the same rules. Small businesses are those processing data from fewer than 100,000 consumers a year or making less than half their money from health data activities, and that collect data from fewer than 25,000 consumers.

This timeline gives smaller businesses more time while keeping privacy rules consistent for all healthcare groups.

Core Responsibilities for Regulated Entities

By March 2024, or June 2024 for small businesses, regulated entities must do these things:

• Consumer Health Data Privacy Policy: They must post a clear and separate privacy policy on their homepage. This policy must say what health data is collected, why it is collected, who gets the data, and how people can use their rights. It must be only about consumer health data, not general privacy.
• Clear and Separate Consent: MHMDA needs explicit opt-in consent for collecting and sharing data. Selling health data requires a separate signed approval. Consent can’t be mixed with other agreements or assumed by action. Sale authorizations must clearly say what data is sold, who buys and sells it, why, and they must expire after one year. Sellers and buyers keep these for six years.
• Consumer Rights: Consumers have strong rights under the law. They can get their data, delete it from backups and third parties, take back past approvals, and appeal if their requests are denied. Entities have 45 days to respond, with one possible 45-day extension.
• Data Security and Access Controls: Entities must use standard security steps. Only people with good reason and proper consent can access health data.
• Processor Agreements: Contracts with data processors must limit how the data is used. If processors act outside these rules, they become regulated entities and must follow the law themselves.

Enforcement and Penalties

The Washington Attorney General enforces MHMDA. Breaking the law counts as a violation of the Washington Consumer Protection Act. Penalties can be fines up to $7,500 for each violation.

Consumers can also sue companies for violations. They can get damages up to $25,000 per affected person. Courts may triple the damages and add lawyer fees. This makes it much riskier for companies that don’t follow the rules.

Impact on Healthcare Organizations and Medical Practices

Healthcare leaders and medical office owners in Washington must know that MHMDA covers more than HIPAA. Practices offering services beyond regular treatments, like cosmetic work, wellness programs, or telehealth, must watch their data rules carefully.

Out-of-state practices offering telemedicine to Washington residents and third-party providers like billing firms, marketing agencies, and IT vendors handling health data for Washington consumers also must meet the rules. Healthcare groups across the country need to check if they handle Washington consumer data and how MHMDA affects them.

AI and Workflow Automation: Supporting Compliance with MHMDA

Using artificial intelligence (AI) and workflow automation can help medical practices follow MHMDA rules with better accuracy and speed. These tools can help in different ways:

• Automated Consent Management: AI can manage consumer consents and approvals as people interact. It can make sure proper opt-in consent is collected for data use and sales. It tracks when approvals expire and asks for renewals as needed.
• Consumer Rights Fulfillment: Manually processing access or deletion requests can take time and have mistakes. Automation helps confirm who is asking, collects all their data from many systems, and processes deletion within 45 days, including backups and third parties if needed.
• Data Privacy Policy Management: AI tools help update and post the required Consumer Health Data Privacy Policy. They keep the policy link clear and separate on websites as the law requires.
• Security Monitoring and Incident Detection: AI security platforms can spot unusual data access or transfers. This helps stop unauthorized sharing or selling of health data quickly with automatic alerts.
• Vendor and Processor Compliance Tracking: AI and automation keep track of all outside data processors. They check contracts for MHMDA compliance and watch for processors going beyond allowed uses. Automated audits flag problems for fixes.

Healthcare IT managers can add these AI tools to existing Electronic Health Records (EHR) systems, patient portals, and customer management software. This lowers manual work and helps follow MHMDA’s consent, data protection, and transparency rules.

Final Notes on Compliance Preparation

Following the Washington My Health My Data Act needs work on policies, system upgrades, and staff training. Medical office leaders should:

• Look carefully at what consumer health data they handle, including guessed health data.
• Check all consumer-facing systems to add clear and separate consent options.
• Update websites with separate Consumer Health Data Privacy Policies apart from general privacy information.
• Train staff on consumer rights and how to handle requests properly.
• Review all third-party partners to make sure contracts and data practices follow the law.
• Use or improve AI and automation tools to help manage data and respond to requests quickly.

Because of the penalties and rights to sue introduced by MHMDA, it is smart to work on compliance early. This lowers legal risks and helps build trust with patients.

Summary

Washington’s My Health My Data Act adds new rules for all organizations that handle consumer health data. Big and small groups must meet these rules by set deadlines. Medical office leaders and IT staff need to adjust how they work to follow the law and keep providing reliable care in today’s digital world.