Why Washington's MHMDA Reaches Every Ambulatory and Telehealth Note
Washington's My Health My Data Act (RCW 19.373) imposes one of the strictest consumer health data regimes in the United States, and its reach extends well beyond the boundaries that clinicians typically associate with HIPAA. The Act applies to any regulated entity that conducts business in Washington or targets Washington consumers and determines the purpose and means of collecting, processing, sharing, or selling consumer health data. For an ambulatory clinic or telehealth practice, this means the statute governs any system that captures, transcribes, or analyzes patient audio, video, notes, or session metadata.
Consumer health data under the statute is defined expansively as any personal data that identifies or is reasonably linkable to a consumer and that is used to infer physical or mental health, diagnosis, treatment, or health-related behaviors. Critically, the definition captures non-HIPAA settings, including direct-to-consumer health applications, telehealth platforms operating on non-covered infrastructure, and audio-only encounters. When an AI documentation tool listens to a visit, it is processing consumer health data by definition, and the full weight of the opt-in framework attaches to that processing.
Practices frequently assume that HIPAA compliance confers MHMDA compliance, and that assumption is a documented source of enforcement exposure. HIPAA operates on a permission-and-minimum-necessary model; MHMDA operates on an affirmative opt-in model closer to GDPR. A clinic can be fully HIPAA-conformant and still violate RCW 19.373 by collecting scribe audio without the clear affirmative act the Act demands. When referencing the underlying statutory codes and the peer-reviewed literature on state health-privacy divergence, the archive at PubMed Central is a useful primary anchor for informatics teams building their governance record.
The Two-Consent Architecture: Collection Versus Sharing
MHMDA's consent standard is deliberately demanding, requiring a clear affirmative act that is freely given, specific, informed, opt-in, voluntary, and unambiguous. Passive notice, pre-checked boxes, and opt-out mechanics all fail this standard. Beginning March 31, 2024, a regulated entity may not collect consumer health data except with opt-in consent for a specified purpose, or when collection is strictly necessary to provide a product or service the consumer requested. For AI scribing, explicit consent is the defensible path.
The statute separates collection from sharing in a way that trips up most generic deployments. Section .030 governs the initial capture; Section .040 requires a separate and distinct opt-in before that data is shared with any third party. Because a cloud-based scribe vendor is a distinct entity from the clinic, transmitting session audio to that vendor is a sharing event requiring its own affirmative authorization. A single consolidated consent prompt does not satisfy both obligations, and stitching them together is a common defect we intentionally prevent.
Building the Pre-Session Consent Gate
Effective consent gating operationalizes the disclosure checklist rather than treating it as boilerplate. Before any audio enters the pipeline, the workflow must disclose the categories of data collected, the specific clinical purpose, the categories of recipients, whether any secondary use is contemplated, and how the patient may decline while still receiving care. The affirmative act itself can be a recorded verbal 'Yes, I agree' or an electronic acknowledgment, but it must be captured and logged before the microphone stream opens. Validated consent scripts and disclosure templates that map directly to the statutory elements are maintained in the Scribing Template Directory, which practices can adapt to their intake language.
Documenting the Encounter Under Telemedicine Rules
Washington's Apple Health telemedicine guidance requires that telehealth notes capture the modality, whether audio-only or audio-video, the HIPAA-compliant platform used, the patient's physical location, the provider's location and credentials, any additional attendees, and the start and end times of the service. Layered atop these clinical fields, the record must also reflect MHMDA consent status: whether collection consent was obtained, whether sharing consent was obtained, the date and time, and the method. Merry AI emits these as structured events so the clinical note is populated without manual re-entry.
The Non-Sale Boundary and Its Practical Consequences
The Act's prohibition on selling consumer health data is among its sharpest provisions. Under Section .090, it is unlawful to sell or offer to sell consumer health data without first obtaining valid authorization, a bar considerably higher than ordinary consent and one that carries specific content and form requirements. There is no necessity exception for sale or for secondary uses; necessity applies only to collection and sharing required to deliver a requested service, never to monetization.
For any AI documentation vendor operating in Washington, this reshapes the permissible business model. Revenue must derive from subscription or licensing fees paid by clinics, not from brokering, reselling, or monetizing patient-derived data. Merry AI is architected and contracted as a non-broker and non-seller: no advertising-technology integrations, no profiling, and no resale of derived features. De-identified data receives no automatic pass, because data that remains reasonably re-linkable is still consumer health data within the statutory definition.
Configuring the Washington Deployment Profile
A defensible deployment isolates Washington-specific controls into a discrete configuration profile that clinics can point to during an audit. In that profile, audio is non-persisted by default and processed in volatile memory only; transient transcription buffers are destroyed on a zero-day schedule once the note is attested; and all model-training and analytics flags are disabled unless a separate, explicit authorization exists. Consent and session metadata logging is robust enough to reconstruct the compliance posture of any individual encounter on demand.
Comparing Documentation Architectures
The practical differences among documentation approaches become clearest when contrasted directly. Manual charting minimizes third-party data flow but consumes clinician time and produces inconsistent consent records. Generic AI scribes save time but frequently retain audio, bundle consent, and reserve broad training rights that MHMDA does not permit. A compliance-first architecture reconciles efficiency with the statutory mandate.
| Dimension | Manual Charting | Generic AI Scribe | Merry AI Compliance Architecture |
|---|---|---|---|
| Consent model | Ad hoc, often verbal only | Single bundled checkbox | Separate opt-in for collection and sharing per RCW 19.373 |
| Audio retention | None captured | Persistent cloud storage | RAM-only, zero-day buffer shredding |
| Data for model training | Not applicable | Default enabled in terms | Disabled absent separate valid authorization |
| Sale or brokering risk | Low | Variable, often opaque | Contractually prohibited, subscription revenue only |
| Consent-status logging | Inconsistent | Rarely encounter-level | Time, version, and scope logged per encounter |
| Physician attestation | Manual signature | Draft accepted silently | Explicit attestation event tied to consent record |
Physician attestation remains the anchor of medico-legal defensibility across every architecture. The clinician reviews the AI-generated draft, confirms no unconsented secondary use has occurred, and records an explicit attestation event that binds the finalized note to the underlying consent record. This attestation, combined with encounter-level consent logging and same-day buffer destruction, produces the evidentiary trail an enforcement inquiry examines first. Practices ready to align their intake scripts, consent architecture, and Washington deployment profile can Book a 15-Minute Workflow Audit to review their current posture against RCW 19.373 element by element.
