Impact of the My Health My Data (MHMDA) Act

The MHMDA's reach extends well beyond hospitals and clinics. Any entity that collects consumer health data from Washington residents, including fitness apps, employee wellness platforms, and even retailers tracking purchase patterns for health-related products, falls within scope. Violations qualify as per se violations of the Washington Consumer Protection Act, allowing for treble damages of up to $25,000 per violation. The first private lawsuit under the MHMDA was filed in early 2025, signaling that plaintiffs' attorneys are actively testing the statute. For insureds, this means the regulatory-proceedings coverage found in many off-the-shelf cyber policies may not respond to a private class action. The policy form needs to be read at the insuring-agreement level to confirm that MHMDA claims trigger the third-party liability grant.

Target Industries: Aerospace, Technology, and Healthcare

Washington's aerospace supply chain handles controlled unclassified information (CUI) subject to DFARS and CMMC requirements. A breach of CUI can trigger both federal contract liability and state notification obligations. Technology firms, from SaaS startups in Seattle to managed service providers in Spokane, face exposure through their service agreements: a single downstream breach can generate errors and omissions claims from multiple clients simultaneously. Healthcare organizations must reconcile HIPAA's federal floor with the MHMDA's broader definition of "consumer health data," which covers information that HIPAA does not. Each of these sectors requires coverage structured around its specific regulatory stack, not a one-size policy.

First-Party vs. Third-Party Coverage

First-party coverage pays your own costs: forensic investigation, data restoration, business interruption losses during network downtime, and crisis management expenses like customer notification and credit monitoring. Third-party coverage responds when someone else makes a claim against you, whether that is a regulatory body, a class of affected consumers, or a business partner alleging your security failure caused their loss. Many small and mid-market buyers assume their policy includes both. That is not always true. Some forms bundle them; others sell third-party liability as an optional endorsement. A specialist like Bloc Cyber will review the actual insuring agreements before binding to confirm both grants are present and that sublimits are adequate for your exposure profile.

Ransomware and Extortion Protection

Ransomware remains the single most frequent trigger for cyber insurance claims. The average total cost of a ransomware incident exceeded $4.9 million in 2026, factoring in ransom payments, downtime, and remediation. Extortion coverage within a cyber policy typically pays the ransom demand itself (subject to OFAC compliance screening) plus the cost of a negotiation firm. The catch is that many policy forms impose a separate sublimit on extortion that is far lower than the aggregate limit. A $5 million policy with a $250,000 extortion sublimit will not meaningfully respond to a seven-figure demand. You need to confirm the sublimit, the retention, and whether the form requires prior carrier consent before any payment is made.

Data Breach Response and Notification Costs

Washington law requires notification to affected residents within 30 days of discovery. For breaches affecting more than 500 residents, the state attorney general must also be notified. The per-record cost of breach notification, credit monitoring, and call-center support typically runs between $150 and $300. A breach affecting 10,000 records can generate $1.5 million to $3 million in first-party response costs alone, before any regulatory fine or lawsuit. Your policy's breach response coverage should include pre-approved vendor panels for forensics, legal counsel, and notification services, and you should verify whether the form allows you to select your own vendors or restricts you to the carrier's panel.

Comparison Chart: General Liability vs. Cyber Insurance

General liability policies contain electronic data exclusions that remove coverage for loss arising from data processing or transmission. Professional liability forms may pick up some third-party claims but will not pay first-party breach costs. A standalone cyber policy is the only form designed to respond to the full spectrum of digital risk.

Securing Intellectual Property in Aerospace

Aerospace suppliers handling CUI face contractual obligations under DFARS 252.204-7012 and, increasingly, CMMC Level 2 certification requirements. A breach of CUI can result in contract termination, False Claims Act exposure, and reputational harm that costs future bids. Your cyber policy should include coverage for regulatory proceedings arising from federal contract obligations and, where available, an endorsement for contingent business interruption if a key supplier's breach disrupts your production line. Intellectual property theft by a state-sponsored actor is a real scenario in the Pacific Northwest: confirm that your form does not exclude "acts of war" so broadly that it eliminates coverage for nation-state attacks.

Compliance for Tech Startups and SaaS Providers

SaaS companies face a dual exposure: their own data and their customers' data. A platform outage or security failure can trigger errors and omissions claims from every downstream client simultaneously, and the aggregate damages can exceed the company's revenue. Technology E&O coverage, placed alongside cyber liability, responds to claims alleging your product or service failed to perform as promised. Many startups purchase a bundled "tech E&O plus cyber" form, but the sublimits within that bundle often favor one side over the other. A firm like Bloc Cyber, whose entire practice focuses on cyber and technology E&O placement, will read the sublimit schedule and flag any imbalance before you sign.

Healthcare Data Privacy and MHMDA Litigation Risks

Healthcare organizations in Washington must comply with HIPAA, the state breach notification statute, and the MHMDA. The MHMDA's definition of "consumer health data" is broader than HIPAA's protected health information, capturing data that a covered entity might not even recognize as regulated. A mental health app, a pharmacy loyalty program, or a telehealth platform collecting location data could all trigger MHMDA obligations. Because the statute allows private suits with treble damages, the third-party liability section of your cyber policy must explicitly cover claims arising from state privacy statutes, not just federal ones. Review the policy's definition of "privacy regulation" to confirm the MHMDA falls within scope.

FAQ: What does cyber insurance actually pay for?

A cyber policy typically pays for forensic investigation, legal counsel, breach notification, credit monitoring, business interruption, ransomware negotiation and payment, regulatory defense costs, and third-party settlements or judgments arising from a data breach or network security failure. The exact scope depends on the policy form.

FAQ: Does my business really need this if we use the cloud?

Yes. Cloud providers' terms of service almost universally disclaim liability for your data. If your cloud environment is compromised, the breach notification obligation and resulting claims fall on you, not your hosting provider.

FAQ: How much coverage is enough for a small tech firm?

Most small tech firms with 10 to 100 employees start with $1 million to $3 million in aggregate limits. The right number depends on your contract requirements, the volume of records you hold, and whether you process regulated health or financial data. Ransomware incidents alone now average nearly $5 million in total cost, so a $1 million limit may leave significant exposure.

FAQ: Will this cover fines from the My Health My Data Act?

Some policy forms cover fines and penalties where insurable by law. Washington does permit insurance coverage for certain civil penalties, but treble damages under the MHMDA present a gray area. You need a form-level review to confirm whether the policy's "loss" definition includes multiplied damages and whether any exclusion narrows the grant.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.