HIPAA compliance for dental practices in Washington

Washington keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Washington has one recorded rule that applies to dental practices differently from other businesses in the state — set out below with their conditions and sources.

Washington jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Washington's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dental practices that electronically submit claims, check eligibility, request authorization, or have a billing service conduct those standard transactions on their behalf are HIPAA covered entities. Most modern dental practices meet that definition. Once covered, the duties below are required.

State — how Washington law interacts with HIPAA

Washington substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dental practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Washington's My Health My Data Act (RCW 19.373) applies broadly to consumer health data — including from entities not otherwise subject to HIPAA — and layers separate consent, disclosure, and consumer-rights obligations. Where an entity is subject to both HIPAA and MHMDA, HIPAA-compliant handling generally satisfies MHMDA's baseline for HIPAA-governed data, but MHMDA obligations for non-HIPAA data remain independent.

What Washington adds for dental practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Washington's general breach law, which applies the same way to every business in the state.

How long records must be kept

How long the record must be kept

A licensed dentist SHALL KEEP READILY ACCESSIBLE PATIENT RECORDS FOR AT LEAST SIX YEARS FROM THE DATE OF THE LAST TREATMENT. A licensed dentist SHALL RESPOND TO A WRITTEN REQUEST from a patient to examine or copy a patient's record WITHIN FIFTEEN WORKING DAYS after receipt, and SHALL COMPLY WITH CHAPTER 70.02 RCW for all patient record requests. A licensed dentist shall comply with chapter 70.02 RCW AND the Health Insurance Portability and Accountability Act destruction and privacy regulations.

Provider class: Washington licensed dentists

What this means operationally

Six years, and the qualifier READILY ACCESSIBLE is doing real work — the duty is not merely to possess the records but to be able to reach them, so deep archival storage or a decommissioned system that cannot be queried does not satisfy it. The fifteen-working-day response duty restates the statutory clock rather than shortening it, which is why this rule is a variation rather than a straight addition: it takes the statewide deadline and attaches it to the dental license. Note the express cross-reference to the federal destruction regulations, which imports the HIPAA disposal standard into state dental licensing.

Applies when

A Washington licensed dentist holds patient records, or receives a written request to examine or copy them

State regulationWash. Admin. Code 246-817-310Patients of the practiceVerified 2026-08-30

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Washington breach obligations

These apply to businesses generally rather than to dental practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Washingtonbreach data →

Individual notice deadline

In the most expedient time possible, without unreasonable delay, and no later than 30 days after discovery of the breach, subject to the statutory law-enforcement delay and time reasonably necessary to determine scope and restore integrity.

The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.

State regulator notice

Required above 500 residents

The Washington State Attorney General must be notified when a breach affects more than 500 Washington residents.

Source: Wash. Rev. Code § 19.255.010

Statewide rules that also reach dental practices

Minor may consent

Informed consent to health care on behalf of a minor patient may be given by a member of one of the following classes, in the following order of priority: the minor's appointed guardian or legal custodian; a person authorized by the court to consent for a minor in out-of-home placement; the minor's parents; a person to whom the parent has given signed authorization; and a competent adult relative who provides a declaration under penalty of perjury.

What this means operationally

An ordered list, like Florida's and unlike Texas's, and it is the list the behavioral health chapter points back to whenever it says 'a person who may consent on behalf of the minor pursuant to RCW 7.70.065'. The entry a practice is most likely to meet without recognizing is the fourth: a parent's signed authorization transfers consent authority to whoever holds it, so the relevant question is not the adult's relationship to the child but whether they are carrying that document.

Applies when

A person other than the minor is consenting to the minor's health care

StatewideWash. Rev. Code § 7.70.065(2)Minors whose care requires substitute consentVerified 2026-08-29

Duty to keep an accurate record

A health care provider SHALL MAINTAIN A RECORD OF EXISTING HEALTH CARE INFORMATION FOR AT LEAST ONE YEAR FOLLOWING RECEIPT OF AN AUTHORIZATION TO DISCLOSE that health care information under RCW 70.02.040, AND DURING THE PENDENCY OF A REQUEST FOR EXAMINATION AND COPYING under RCW 70.02.080 OR A REQUEST FOR CORRECTION OR AMENDMENT under RCW 70.02.100.

What this means operationally

DO NOT READ THIS AS WASHINGTON'S RETENTION PERIOD. The section is headed Retention of record and states a number, which makes it look like a general one-year rule, but it is a PRESERVATION duty triggered by an event: it attaches when an authorization to disclose is received, or while an access or amendment request is pending, and it says nothing about how long a record must be kept in the ordinary course. Washington's actual retention periods are set board by board. Operationally it functions as a statutory litigation-style hold — receipt of a disclosure authorization freezes that record for a year regardless of where it sits in any destruction schedule, so an automated purge needs a suppression flag keyed to authorizations and open requests.

Applies when

A provider receives an authorization to disclose under RCW 70.02.040, or a request under RCW 70.02.080 or 70.02.100 is pending

StatewideWash. Rev. Code § 70.02.160Patients and their representativesVerified 2026-08-30

Deadline to respond to an access request

Upon receipt of a WRITTEN REQUEST from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN FIFTEEN WORKING DAYS after receiving the request, shall: MAKE THE INFORMATION AVAILABLE for examination during regular business hours and provide a copy if requested; or INFORM THE PATIENT IF THE INFORMATION DOES NOT EXIST OR CANNOT BE FOUND; or, IF THE PROVIDER DOES NOT MAINTAIN THE RECORD, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PROVIDER WHO DOES; or, if the information is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the reasons for the delay and the earliest date, NOT LATER THAN TWENTY-ONE WORKING DAYS after receiving the request, when the information will be available or the request otherwise disposed of; or DENY the request under RCW 70.02.090 and inform the patient. Upon request the provider SHALL PROVIDE AN EXPLANATION OF ANY CODE OR ABBREVIATION used. If a record is not maintained in the requested form, the provider IS NOT REQUIRED TO CREATE A NEW RECORD OR REFORMULATE an existing one. The provider MAY CHARGE A REASONABLE FEE and IS NOT REQUIRED TO PERMIT EXAMINATION OR COPYING UNTIL THE FEE IS PAID.

What this means operationally

Washington gives five permitted responses and requires one of them inside fifteen WORKING days — so silence is never compliant, and a search that comes up empty must still be answered on time. Two branches are easy to miss: where the practice does not hold the record it must name the provider who does, and a delay is only lawful if the reasons are given IN WRITING with a specific date no later than twenty-one working days out. The code-and-abbreviation explanation duty is unusual and is triggered on request rather than automatically. Note the fee may gate access entirely — the provider need not permit examination or copying until it is paid.

Applies when

A patient makes a written request to examine or copy their recorded health care information

Exceptions

Denial in whole or part on a ground in RCW 70.02.090
No duty to create a new record or reformulate an existing one to match a requested form
The fee-before-access rule does not apply where RCW 70.02.030 provides otherwise

StatewideWash. Rev. Code § 70.02.080Patients and their representativesVerified 2026-08-30

Provider may disclose, subject to a test

A health care provider MAY DENY ACCESS to health care information by a patient if the provider REASONABLY CONCLUDES that: knowledge of the information WOULD BE INJURIOUS TO THE HEALTH of the patient; knowledge could reasonably be expected to LEAD TO THE PATIENT'S IDENTIFICATION OF AN INDIVIDUAL WHO PROVIDED THE INFORMATION IN CONFIDENCE under circumstances in which confidentiality was appropriate; knowledge could reasonably be expected to CAUSE DANGER TO THE LIFE OR SAFETY OF ANY INDIVIDUAL; the information WAS COMPILED AND IS USED SOLELY FOR LITIGATION, QUALITY ASSURANCE, PEER REVIEW OR ADMINISTRATIVE PURPOSES; or access is OTHERWISE PROHIBITED BY LAW. If access is denied, the provider SHALL, TO THE EXTENT POSSIBLE, SEGREGATE the information for which access is denied from information for which it cannot be denied AND PERMIT THE PATIENT TO EXAMINE OR COPY THE DISCLOSABLE INFORMATION. If denial is on the INJURIOUS-TO-HEALTH or DANGER grounds, the provider SHALL PERMIT EXAMINATION AND COPYING BY ANOTHER HEALTH CARE PROVIDER SELECTED BY THE PATIENT who is authorized under the laws of this state TO TREAT THE PATIENT FOR THE SAME CONDITION, and SHALL INFORM THE PATIENT OF THAT RIGHT.

What this means operationally

Denial is almost never total. The segregation duty means a practice must release everything it can and withhold only the specific material a ground covers — a blanket refusal over one problematic entry is non-compliant. And on the two clinical grounds the record still leaves the practice, to a clinician the patient picks who is authorized to treat the SAME CONDITION, with an affirmative duty to tell the patient that route exists. The confidential-source ground is broader than most states offer, and the litigation-and-quality-assurance ground turns on the material having been compiled and used SOLELY for those purposes, so a dual-purpose document does not qualify.

Applies when

A provider reasonably concludes one of the five statutory grounds applies to a request under RCW 70.02.080

Exceptions

Subject to any conflicting requirement in the Public Records Act, ch. 42.56 RCW

StatewideWash. Rev. Code § 70.02.090Patients and their representativesVerified 2026-08-30

Right to amend or correct the record

FOR PURPOSES OF ACCURACY OR COMPLETENESS, a patient may REQUEST IN WRITING that a health care provider CORRECT OR AMEND its record of the patient's health care information to which the patient has access under RCW 70.02.080. AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN TEN DAYS after receiving the request, the provider shall: MAKE THE REQUESTED CORRECTION OR AMENDMENT AND INFORM THE PATIENT; or inform the patient if the record NO LONGER EXISTS OR CANNOT BE FOUND; or, if the provider does not maintain the record, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PERSON WHO DOES; or, if the record is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the earliest date, NOT LATER THAN TWENTY-ONE DAYS after receiving the request, when the correction will be made or the request otherwise disposed of; or INFORM THE PATIENT IN WRITING OF THE REFUSAL to correct or amend as requested AND OF THE PATIENT'S RIGHT TO ADD A STATEMENT OF DISAGREEMENT.

What this means operationally

Ten days is the shortest amendment deadline in the corpus and it is shorter than Washington's own fifteen-working-day access clock — so a practice that routes corrections through the same queue as records requests will miss it. The extension runs to twenty-one CALENDAR days here against twenty-one WORKING days for access, another asymmetry worth building into the workflow separately rather than by analogy. A refusal must be in writing and must itself tell the patient about the statement of disagreement; a silent or verbal refusal fails on two counts.

Applies when

A patient requests in writing that a record be corrected or amended for accuracy or completeness

Exceptions

Reaches only information the patient has access to under RCW 70.02.080

StatewideWash. Rev. Code § 70.02.100Patients and their representativesVerified 2026-08-30

What applies to dental practices everywhere

Dental ePHI does not live in one system. It moves through the practice management system, digital imaging equipment, operatories, front-desk workstations, insurance transactions, laboratories, referral workflows, mobile devices, cloud backups, patient communication, and third-party support systems.

The practice management system and every user with administrative, clinical, scheduling, or billing access

Panoramic, CBCT, intraoral, and other imaging systems — including how images move between devices, workstations, laboratories, specialists, and storage

Electronic claims, eligibility verification, payment, and clearinghouse workflows

Patient portals, digital forms, e-fax, email, text messaging, appointment reminders, and referral tools

Office servers, workstations, laptops, tablets, phones, removable media, network equipment, and cloud backups

Every vendor that stores, maintains, transmits, or can remotely access the practice's ePHI

Full dentistscompliance guide →

Knowing the Washington rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Washington rules on this page.

Start the risk assessment