Requirements & evidence
Washington My Health My Data Act
The first US law protecting consumer health data that falls outside HIPAA, with a private right of action — an increasingly distinct healthcare-SaaS ask, separate from HIPAA itself.
- Edition on record
- HB 1155
- Issuing authority
- Washington State Office of the Attorney General (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for consumer health, technology, across US-WA. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Consumer health data privacy policy
- Consent to collect and share
- Data deletion rights
- Geofencing restrictions
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
Washington My Health My Data Act is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Named and tracked only; obligations not modelled as a control catalog.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
Staggered implementation: Section 10 (private right of action) took effect 2023-07-23; Sections 4-9 took effect 2024-03-31 for larger entities and 2024-06-30 for small businesses. All dates have passed — the Act is fully in force.
Authority’s stated timing: In force
Read the authority’s announcement (opens in a new tab)- HB 1155Current edition on record
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on September 6, 2026.
- Washington State Office of the Attorney General (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: washington-mhmda.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Consumer health data privacy policy · Consent to collect and share · Data deletion rights · Geofencing restrictions.
Record last updated: September 6, 2026.
Common questions
A closer look.
What is Washington My Health My Data Act?
The first US law protecting consumer health data that falls outside HIPAA, with a private right of action — an increasingly distinct healthcare-SaaS ask, separate from HIPAA itself.
Who does Washington My Health My Data Act apply to?
Washington My Health My Data Act applies to consumer health, technology, US-WA, per Washington State Office of the Attorney General.
What is the current version of Washington My Health My Data Act?
The current edition is HB 1155, issued by Washington State Office of the Attorney General and published 2023-04-27. Source: https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy.
What does an assessment under Washington My Health My Data Act require?
No control catalog has been ingested for Washington My Health My Data Act yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
Washington My Health My Data Act
HB 1155
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize Washington My Health My Data Act requirements, evidence preparation, and review for your assessment scope.