Compliance FrameworksAmericas
Washington My Health My Data Act
Washington My Health My Data Act - consumer health data protection, consent, private right of action.
Washington My Health My Data Act - consumer health data protection, consent, private right of action.
| Short name | WA MHMDA |
| Region | Americas |
| Country or scope | United States |
| Sector | Healthcare |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers WA MHMDA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for WA MHMDA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for WA MHMDA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
WA-MHMDA-SEC Health Data Security and Access Restriction | Regulated entities must restrict internal access to consumer health data to what is necessary and maintain administrative, technical and physical data security practices satisfying a reasonable standard of care; given the sensitivity and the private right of action, integrity verification is expected at a high bar (RCW ch. 19.373, data-security and access-restriction provisions) | Scan |
WA-MHMDA-INV Health Data Processing Inventory | Consent-gating every collection and share of consumer health data presumes the entity knows exactly which software systems collect or process it; an enumerated component inventory is the prerequisite artifact (RCW ch. 19.373, consent and collection provisions) | Scan |
WA-MHMDA-SHARE Sharing and Sale Flow Control | Sharing requires separate consent and any sale requires the consumer's signed authorization; enforcing these gates demands a documented map of how data-handling components feed one another (RCW ch. 19.373, sharing-consent and sale-authorization provisions) | Scan |
WA-MHMDA-PROC Processor Oversight | Processors may process consumer health data only per binding contract and the regulated entity remains responsible for their conduct; each third-party component should carry a named supplier to demonstrate that chain (RCW ch. 19.373, processor provisions) | Scan |
WA-MHMDA-RIGHTS Consumer Rights and Withdrawal Readiness | Consumers may access their health data including a list of third parties it was shared with, withdraw consent, and have data deleted: including from backups and by notifying downstream recipients; executing this requires unambiguous identification of every system holding the data (RCW ch. 19.373, consumer-rights provisions) | Scan |
WA-MHMDA-POLICY Health Data Privacy Policy Documentation | Regulated entities must maintain and prominently link a consumer health data privacy policy describing categories collected, sources, sharing and rights; identified, timestamped system documentation keeps that policy verifiably accurate (RCW ch. 19.373, privacy-policy provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
RCW-70.372.010 | Consumer Health Data: Definition & Scope |
RCW-70.372.020 | Consent for Collection of Consumer Health Data |
RCW-70.372.030 | Consent for Sharing & Disclosure of Consumer Health Data |
RCW-70.372.040 | Prohibition on Sale of Consumer Health Data Without Consent |
RCW-70.372.050 | Geofencing Prohibition Near Healthcare Facilities |
RCW-70.372.060 | Consumer Rights: Access, Deletion & Withdrawal of Consent |
RCW-70.372.070 | Consumer Health Data Privacy Policy |
RCW-70.372.080 | Security for Consumer Health Data |
RCW-70.372.090 | Processor & Third-Party Agreements |
RCW-70.372.100 | Prohibited Practices: Surveillance & Inferencing |
RCW-70.372.110 | Private Right of Action & Enforcement |
Policy templates
Written for WA MHMDA:
- Washington MHMDA Consumer Health Data Privacy Policy
- Washington MHMDA Consent for Collection & Sharing Procedure
- Washington MHMDA Geofencing Prohibition & Security Policy
And 22 from the standard set, adapted to WA MHMDA.