My Health My Data Act does not exempt businesses based on size or collection volume; instead, it postpones by three months the date by which small businesses must come into compliance, the Act permits the state Attorney General to enforce violations of the Act.