HIPAA compliance for chiropractic practices in Washington

Washington keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Washington has 2 recorded rules that apply to chiropractic practices differently from other businesses in the state — set out below with their conditions and sources.

Washington jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Washington's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Chiropractic practices that electronically bill health plans, check eligibility, request authorization, or have a billing service do so are HIPAA covered entities. Medicare participation and electronic claims make coverage straightforward for many practices. Once covered, the duties below are required.

State — how Washington law interacts with HIPAA

Washington substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Chiropractic practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Washington's My Health My Data Act (RCW 19.373) applies broadly to consumer health data — including from entities not otherwise subject to HIPAA — and layers separate consent, disclosure, and consumer-rights obligations. Where an entity is subject to both HIPAA and MHMDA, HIPAA-compliant handling generally satisfies MHMDA's baseline for HIPAA-governed data, but MHMDA obligations for non-HIPAA data remain independent.

What Washington adds for chiropractic practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Washington's general breach law, which applies the same way to every business in the state.

How long records must be kept

How long the record must be kept

Any chiropractor who treats patients in Washington SHALL MAINTAIN ALL TREATMENT RECORDS regarding patients treated. These records MAY INCLUDE, BUT SHALL NOT BE LIMITED TO, X-RAYS, TREATMENT PLANS, PATIENT CHARTS, PATIENT HISTORIES, CORRESPONDENCE, FINANCIAL DATA AND BILLING. These records SHALL BE RETAINED BY THE CHIROPRACTOR FOR FIVE YEARS IN AN ORDERLY, ACCESSIBLE FILE and SHALL BE READILY AVAILABLE FOR INSPECTION by the commission or its authorized representative. Where X-rays or copies of records are forwarded, OFFICE RECORDS SHALL STATE THE DATE ON WHICH THE RECORDS WERE RELEASED, THE METHOD FORWARDED AND TO WHOM, AND THE REASON FOR THE RELEASE. A chiropractor SHALL HONOR WITHIN FIFTEEN DAYS a written request from an adult patient, their legal representative, or the legal representative of a minor child to release ORIGINAL X-RAYS AND RECORDS TO OTHER LICENSED HEALTH CARE PROVIDERS, or may provide DUPLICATE FILMS OR A COPY to the provider or the patient.

Provider class: Washington chiropractors

What this means operationally

The record class is unusually wide — CORRESPONDENCE, FINANCIAL DATA and BILLING are expressly inside the five-year duty, so a practice that retains clinical notes but purges billing has not complied. The release-logging requirement is the operationally distinctive part and has no analogue elsewhere in this corpus: every forwarding must be recorded with the date, the method, the recipient AND THE REASON, which is a disclosure register the rule requires without calling it one. Note the fifteen-day honor duty here runs in CALENDAR days, against the fifteen WORKING days the statute gives for patient access requests. ONE THING THE RULE DOES NOT SAY: it states no CLOCK for the five years. Not from last treatment, not from discharge, not from record creation. The trigger is recorded as NOT_SPECIFIED_BY_THIS_AUTHORITY rather than assumed — and the gap matters more here than usual, because the record class expressly includes correspondence and billing, which have their own natural end dates that do not coincide with the last treatment.

Applies when

A Washington chiropractor treats patients, or receives a written request to release X-rays or records

Exceptions

A reasonable fee may be charged the patient to cover mailing and clerical costs
The health care provider may bill the patient reasonable duplication costs for duplicate films or copies

State regulationWash. Admin. Code 246-808-650Patients of the practiceVerified 2026-08-30

Duty to keep an accurate record

A doctor of chiropractic MUST KEEP COMPLETE AND ACCURATE DOCUMENTATION on all patients and patient encounters. The patient record MUST DETAIL the patient's clinical history, the RATIONALE FOR THE EXAMINATION, diagnostic or analytical procedures, and treatment services provided. THE DIAGNOSIS OR CLINICAL IMPRESSION MUST BE CONTAINED IN THE PATIENT RECORD, NOT MERELY RECORDED ON BILLING FORMS OR STATEMENTS. SUBJECTIVE HEALTH STATUS UPDATES, WHETHER OR NOT SYMPTOMS ARE PRESENT, MUST BE DOCUMENTED FOR EVERY PATIENT ENCOUNTER. Documentation for the INITIAL RECORD must include at a minimum the patient's history, subjective presentation, examination or objective findings relating to the presenting condition, any diagnostic testing performed, a diagnosis or impression, any treatment or care provided, and a plan of care. REEXAMINATIONS must be documented at REASONABLE INTERVALS sufficient to reflect the effectiveness of the treatment, and WHENEVER THERE IS AN UNEXPECTED CHANGE in the subjective or objective status of the patient.

Provider class: Washington chiropractors

What this means operationally

Two requirements catch practices out. The diagnosis must live in the PATIENT RECORD and not only on a billing form — a rule written because the opposite is common, and one that an auditor can test in seconds. And a subjective health status update is required at EVERY encounter WHETHER OR NOT SYMPTOMS ARE PRESENT, so a routine maintenance visit with nothing to report still needs a documented subjective entry. The reexamination trigger is dual: at reasonable intervals, and additionally whenever the patient's status changes unexpectedly.

Applies when

A Washington chiropractor documents a patient or patient encounter

State regulationWash. Admin. Code 246-808-560Patients of the practiceVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Washington breach obligations

These apply to businesses generally rather than to chiropractic practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Washingtonbreach data →

Individual notice deadline

In the most expedient time possible, without unreasonable delay, and no later than 30 days after discovery of the breach, subject to the statutory law-enforcement delay and time reasonably necessary to determine scope and restore integrity.

The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.

State regulator notice

Required above 500 residents

The Washington State Attorney General must be notified when a breach affects more than 500 Washington residents.

Source: Wash. Rev. Code § 19.255.010

Statewide rules that also reach chiropractic practices

Minor may consent

Informed consent to health care on behalf of a minor patient may be given by a member of one of the following classes, in the following order of priority: the minor's appointed guardian or legal custodian; a person authorized by the court to consent for a minor in out-of-home placement; the minor's parents; a person to whom the parent has given signed authorization; and a competent adult relative who provides a declaration under penalty of perjury.

What this means operationally

An ordered list, like Florida's and unlike Texas's, and it is the list the behavioral health chapter points back to whenever it says 'a person who may consent on behalf of the minor pursuant to RCW 7.70.065'. The entry a practice is most likely to meet without recognizing is the fourth: a parent's signed authorization transfers consent authority to whoever holds it, so the relevant question is not the adult's relationship to the child but whether they are carrying that document.

Applies when

A person other than the minor is consenting to the minor's health care

StatewideWash. Rev. Code § 7.70.065(2)Minors whose care requires substitute consentVerified 2026-08-29

Duty to keep an accurate record

A health care provider SHALL MAINTAIN A RECORD OF EXISTING HEALTH CARE INFORMATION FOR AT LEAST ONE YEAR FOLLOWING RECEIPT OF AN AUTHORIZATION TO DISCLOSE that health care information under RCW 70.02.040, AND DURING THE PENDENCY OF A REQUEST FOR EXAMINATION AND COPYING under RCW 70.02.080 OR A REQUEST FOR CORRECTION OR AMENDMENT under RCW 70.02.100.

What this means operationally

DO NOT READ THIS AS WASHINGTON'S RETENTION PERIOD. The section is headed Retention of record and states a number, which makes it look like a general one-year rule, but it is a PRESERVATION duty triggered by an event: it attaches when an authorization to disclose is received, or while an access or amendment request is pending, and it says nothing about how long a record must be kept in the ordinary course. Washington's actual retention periods are set board by board. Operationally it functions as a statutory litigation-style hold — receipt of a disclosure authorization freezes that record for a year regardless of where it sits in any destruction schedule, so an automated purge needs a suppression flag keyed to authorizations and open requests.

Applies when

A provider receives an authorization to disclose under RCW 70.02.040, or a request under RCW 70.02.080 or 70.02.100 is pending

StatewideWash. Rev. Code § 70.02.160Patients and their representativesVerified 2026-08-30

Deadline to respond to an access request

Upon receipt of a WRITTEN REQUEST from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN FIFTEEN WORKING DAYS after receiving the request, shall: MAKE THE INFORMATION AVAILABLE for examination during regular business hours and provide a copy if requested; or INFORM THE PATIENT IF THE INFORMATION DOES NOT EXIST OR CANNOT BE FOUND; or, IF THE PROVIDER DOES NOT MAINTAIN THE RECORD, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PROVIDER WHO DOES; or, if the information is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the reasons for the delay and the earliest date, NOT LATER THAN TWENTY-ONE WORKING DAYS after receiving the request, when the information will be available or the request otherwise disposed of; or DENY the request under RCW 70.02.090 and inform the patient. Upon request the provider SHALL PROVIDE AN EXPLANATION OF ANY CODE OR ABBREVIATION used. If a record is not maintained in the requested form, the provider IS NOT REQUIRED TO CREATE A NEW RECORD OR REFORMULATE an existing one. The provider MAY CHARGE A REASONABLE FEE and IS NOT REQUIRED TO PERMIT EXAMINATION OR COPYING UNTIL THE FEE IS PAID.

What this means operationally

Washington gives five permitted responses and requires one of them inside fifteen WORKING days — so silence is never compliant, and a search that comes up empty must still be answered on time. Two branches are easy to miss: where the practice does not hold the record it must name the provider who does, and a delay is only lawful if the reasons are given IN WRITING with a specific date no later than twenty-one working days out. The code-and-abbreviation explanation duty is unusual and is triggered on request rather than automatically. Note the fee may gate access entirely — the provider need not permit examination or copying until it is paid.

Applies when

A patient makes a written request to examine or copy their recorded health care information

Exceptions

Denial in whole or part on a ground in RCW 70.02.090
No duty to create a new record or reformulate an existing one to match a requested form
The fee-before-access rule does not apply where RCW 70.02.030 provides otherwise

StatewideWash. Rev. Code § 70.02.080Patients and their representativesVerified 2026-08-30

Provider may disclose, subject to a test

A health care provider MAY DENY ACCESS to health care information by a patient if the provider REASONABLY CONCLUDES that: knowledge of the information WOULD BE INJURIOUS TO THE HEALTH of the patient; knowledge could reasonably be expected to LEAD TO THE PATIENT'S IDENTIFICATION OF AN INDIVIDUAL WHO PROVIDED THE INFORMATION IN CONFIDENCE under circumstances in which confidentiality was appropriate; knowledge could reasonably be expected to CAUSE DANGER TO THE LIFE OR SAFETY OF ANY INDIVIDUAL; the information WAS COMPILED AND IS USED SOLELY FOR LITIGATION, QUALITY ASSURANCE, PEER REVIEW OR ADMINISTRATIVE PURPOSES; or access is OTHERWISE PROHIBITED BY LAW. If access is denied, the provider SHALL, TO THE EXTENT POSSIBLE, SEGREGATE the information for which access is denied from information for which it cannot be denied AND PERMIT THE PATIENT TO EXAMINE OR COPY THE DISCLOSABLE INFORMATION. If denial is on the INJURIOUS-TO-HEALTH or DANGER grounds, the provider SHALL PERMIT EXAMINATION AND COPYING BY ANOTHER HEALTH CARE PROVIDER SELECTED BY THE PATIENT who is authorized under the laws of this state TO TREAT THE PATIENT FOR THE SAME CONDITION, and SHALL INFORM THE PATIENT OF THAT RIGHT.

What this means operationally

Denial is almost never total. The segregation duty means a practice must release everything it can and withhold only the specific material a ground covers — a blanket refusal over one problematic entry is non-compliant. And on the two clinical grounds the record still leaves the practice, to a clinician the patient picks who is authorized to treat the SAME CONDITION, with an affirmative duty to tell the patient that route exists. The confidential-source ground is broader than most states offer, and the litigation-and-quality-assurance ground turns on the material having been compiled and used SOLELY for those purposes, so a dual-purpose document does not qualify.

Applies when

A provider reasonably concludes one of the five statutory grounds applies to a request under RCW 70.02.080

Exceptions

Subject to any conflicting requirement in the Public Records Act, ch. 42.56 RCW

StatewideWash. Rev. Code § 70.02.090Patients and their representativesVerified 2026-08-30

Right to amend or correct the record

FOR PURPOSES OF ACCURACY OR COMPLETENESS, a patient may REQUEST IN WRITING that a health care provider CORRECT OR AMEND its record of the patient's health care information to which the patient has access under RCW 70.02.080. AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN TEN DAYS after receiving the request, the provider shall: MAKE THE REQUESTED CORRECTION OR AMENDMENT AND INFORM THE PATIENT; or inform the patient if the record NO LONGER EXISTS OR CANNOT BE FOUND; or, if the provider does not maintain the record, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PERSON WHO DOES; or, if the record is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the earliest date, NOT LATER THAN TWENTY-ONE DAYS after receiving the request, when the correction will be made or the request otherwise disposed of; or INFORM THE PATIENT IN WRITING OF THE REFUSAL to correct or amend as requested AND OF THE PATIENT'S RIGHT TO ADD A STATEMENT OF DISAGREEMENT.

What this means operationally

Ten days is the shortest amendment deadline in the corpus and it is shorter than Washington's own fifteen-working-day access clock — so a practice that routes corrections through the same queue as records requests will miss it. The extension runs to twenty-one CALENDAR days here against twenty-one WORKING days for access, another asymmetry worth building into the workflow separately rather than by analogy. A refusal must be in writing and must itself tell the patient about the statement of disagreement; a silent or verbal refusal fails on two counts.

Applies when

A patient requests in writing that a record be corrected or amended for accuracy or completeness

Exceptions

Reaches only information the patient has access to under RCW 70.02.080

StatewideWash. Rev. Code § 70.02.100Patients and their representativesVerified 2026-08-30

What applies to chiropractic practices everywhere

Chiropractic practices combine medical records, high patient volume, imaging, insurance claims, open treatment environments, workers' compensation, and personal-injury documentation. Each creates a different pathway through which PHI can be exposed.

The EHR or practice-management system and all workforce access roles

Digital X-ray and other imaging equipment, storage, transmission, specialist review, and backup

Claims, clearinghouse, Medicare, workers' compensation, and personal-injury workflows

Open treatment areas, front-desk conversations, sign-in processes, paper records, and workstation visibility

Patient portals, intake forms, email, texting, e-fax, scheduling, and home-care communication

Wellness, supplement, exercise, or ancillary-service systems when they connect activity to identifiable patients

Full chiropractorscompliance guide →

Knowing the Washington rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Washington rules on this page.

Start the risk assessment