Skip to main content
—
Framework library
Framework module · washington-mhmda

Washington My Health My Data Act

The first US law protecting consumer health data that falls outside HIPAA, with a private right of action — an increasingly distinct healthcare-SaaS ask, separate from HIPAA itself.

HB 1155 · Washington State Office of the Attorney General · published 2023-04-27

Standing today
Directory entry

00Answer

from the registry record
What is Washington My Health My Data Act?
The first US law protecting consumer health data that falls outside HIPAA, with a private right of action — an increasingly distinct healthcare-SaaS ask, separate from HIPAA itself.
Who does Washington My Health My Data Act apply to?
Washington My Health My Data Act applies to consumer health, technology, US-WA, per Washington State Office of the Attorney General.
What is the current version of Washington My Health My Data Act?
The current edition is HB 1155, issued by Washington State Office of the Attorney General and published 2023-04-27. Source: https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy.
What does an assessment under Washington My Health My Data Act require?
No control catalog has been ingested for Washington My Health My Data Act yet — the registry tracks it as planned (Tracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

01Standing

Directory entry

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

Washington My Health My Data Act is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Named and tracked only; obligations not modelled as a control catalog.

Request this frameworkAuthority source (opens in a new tab)

02Registry record

checked 2026-09-06
Registry status
Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
Control units
Not on record — no catalog ingested and no authority-published count cited.
Control families
Consumer health data privacy policy · Consent to collect and share · Data deletion rights · Geofencing restrictions
Applies to
consumer health · technology · US-WA
Verification
Primary — the issuing body's own page was read and states this version. checked 2026-09-06
Pending change
Staggered implementation: Section 10 (private right of action) took effect 2023-07-23; Sections 4-9 took effect 2024-03-31 for larger entities and 2024-06-30 for small businesses. All dates have passed — the Act is fully in force.Expected: In force

03Version ledger

1 edition
HB 1155Current edition2023-04-27

06Related frameworks

scored from registry facts
  1. FTC Health Breach Notification Rule16 CFR Part 318 (2024 amended rule)

    Also applies to consumer health · The federal breach-notification rule for vendors of personal health records and related entities that are not covered by HIPAA, including applicable health apps and connected services.

  2. ISO/IEC 270182025

    Also applies to technology · Privacy guidance for public-cloud providers acting as processors of personally identifiable information. It complements ISO/IEC 27001 and 27002; it is not a regulation, standalone certification, or claim that ControlFrame is certified.

  3. AIUC-1Q3 2026 (2026-07-15 release)

    Also applies to technology · A quarterly updated standard and certification program for AI agents covering data and privacy, security, safety, reliability, accountability, and societal risk. Only AIUC can issue its certificate; registry inclusion makes no certification claim.

  4. CSA AI Controls Matrixv1.1

    Also applies to technology · The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.

See control-level overlap in the Control Atlas
Washington My Health My Data Act | ControlFrame