Washington My Health My Data Act

Washington My Health My Data Act - consumer health data protection, consent, private right of action.


Short name	WA MHMDA
Region	Americas
Country or scope	United States
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers WA MHMDA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for WA MHMDA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for WA MHMDA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`WA-MHMDA-SEC` Health Data Security and Access Restriction	Regulated entities must restrict internal access to consumer health data to what is necessary and maintain administrative, technical and physical data security practices satisfying a reasonable standard of care; given the sensitivity and the private right of action, integrity verification is expected at a high bar (RCW ch. 19.373, data-security and access-restriction provisions)	Scan
`WA-MHMDA-INV` Health Data Processing Inventory	Consent-gating every collection and share of consumer health data presumes the entity knows exactly which software systems collect or process it; an enumerated component inventory is the prerequisite artifact (RCW ch. 19.373, consent and collection provisions)	Scan
`WA-MHMDA-SHARE` Sharing and Sale Flow Control	Sharing requires separate consent and any sale requires the consumer's signed authorization; enforcing these gates demands a documented map of how data-handling components feed one another (RCW ch. 19.373, sharing-consent and sale-authorization provisions)	Scan
`WA-MHMDA-PROC` Processor Oversight	Processors may process consumer health data only per binding contract and the regulated entity remains responsible for their conduct; each third-party component should carry a named supplier to demonstrate that chain (RCW ch. 19.373, processor provisions)	Scan
`WA-MHMDA-RIGHTS` Consumer Rights and Withdrawal Readiness	Consumers may access their health data including a list of third parties it was shared with, withdraw consent, and have data deleted: including from backups and by notifying downstream recipients; executing this requires unambiguous identification of every system holding the data (RCW ch. 19.373, consumer-rights provisions)	Scan
`WA-MHMDA-POLICY` Health Data Privacy Policy Documentation	Regulated entities must maintain and prominently link a consumer health data privacy policy describing categories collected, sources, sharing and rights; identified, timestamped system documentation keeps that policy verifiably accurate (RCW ch. 19.373, privacy-policy provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`RCW-70.372.010`	Consumer Health Data: Definition & Scope
`RCW-70.372.020`	Consent for Collection of Consumer Health Data
`RCW-70.372.030`	Consent for Sharing & Disclosure of Consumer Health Data
`RCW-70.372.040`	Prohibition on Sale of Consumer Health Data Without Consent
`RCW-70.372.050`	Geofencing Prohibition Near Healthcare Facilities
`RCW-70.372.060`	Consumer Rights: Access, Deletion & Withdrawal of Consent
`RCW-70.372.070`	Consumer Health Data Privacy Policy
`RCW-70.372.080`	Security for Consumer Health Data
`RCW-70.372.090`	Processor & Third-Party Agreements
`RCW-70.372.100`	Prohibited Practices: Surveillance & Inferencing
`RCW-70.372.110`	Private Right of Action & Enforcement

Policy templates

Written for WA MHMDA:

Washington MHMDA Consumer Health Data Privacy Policy
Washington MHMDA Consent for Collection & Sharing Procedure
Washington MHMDA Geofencing Prohibition & Security Policy

And 22 from the standard set, adapted to WA MHMDA.