HIPAA compliance for dermatology practices in Washington

Washington keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Patient Protect has not recorded any Washington rule that applies to dermatology practices differently from other providers in the state — the statewide rules below are the ones that reach you.

Washington jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Washington's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Dermatology practices that electronically bill, check eligibility, request authorization, or conduct other adopted transactions are HIPAA covered entities. Once covered, the duties below apply to records, photographs, pathology, teledermatology, devices, people, and vendors — not just the EHR.

State — how Washington law interacts with HIPAA

Washington substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Dermatology practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Washington's My Health My Data Act (RCW 19.373) applies broadly to consumer health data — including from entities not otherwise subject to HIPAA — and layers separate consent, disclosure, and consumer-rights obligations. Where an entity is subject to both HIPAA and MHMDA, HIPAA-compliant handling generally satisfies MHMDA's baseline for HIPAA-governed data, but MHMDA obligations for non-HIPAA data remain independent.

What Washington adds for dermatology practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Washington's general breach law, which applies the same way to every business in the state.

No verified intersection rules recorded

Patient Protect has not recorded any Washington rule that applies to dermatology practices differently from any other practice in the state. Where that is the case, the federal obligations and the Washington rules below are the whole picture, and the dermatology guidance that applies nationally is the better starting point.

HIPAA compliance for dermatology practices→

Washington breach obligations

These apply to businesses generally rather than to dermatology practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Washingtonbreach data →

Individual notice deadline

In the most expedient time possible, without unreasonable delay, and no later than 30 days after discovery of the breach, subject to the statutory law-enforcement delay and time reasonably necessary to determine scope and restore integrity.

The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.

State regulator notice

Required above 500 residents

The Washington State Attorney General must be notified when a breach affects more than 500 Washington residents.

Source: Wash. Rev. Code § 19.255.010

Statewide rules that also reach dermatology practices

Minor may consent

Informed consent to health care on behalf of a minor patient may be given by a member of one of the following classes, in the following order of priority: the minor's appointed guardian or legal custodian; a person authorized by the court to consent for a minor in out-of-home placement; the minor's parents; a person to whom the parent has given signed authorization; and a competent adult relative who provides a declaration under penalty of perjury.

What this means operationally

An ordered list, like Florida's and unlike Texas's, and it is the list the behavioral health chapter points back to whenever it says 'a person who may consent on behalf of the minor pursuant to RCW 7.70.065'. The entry a practice is most likely to meet without recognizing is the fourth: a parent's signed authorization transfers consent authority to whoever holds it, so the relevant question is not the adult's relationship to the child but whether they are carrying that document.

Applies when

A person other than the minor is consenting to the minor's health care

StatewideWash. Rev. Code § 7.70.065(2)Minors whose care requires substitute consentVerified 2026-08-29

Duty to keep an accurate record

A health care provider SHALL MAINTAIN A RECORD OF EXISTING HEALTH CARE INFORMATION FOR AT LEAST ONE YEAR FOLLOWING RECEIPT OF AN AUTHORIZATION TO DISCLOSE that health care information under RCW 70.02.040, AND DURING THE PENDENCY OF A REQUEST FOR EXAMINATION AND COPYING under RCW 70.02.080 OR A REQUEST FOR CORRECTION OR AMENDMENT under RCW 70.02.100.

What this means operationally

DO NOT READ THIS AS WASHINGTON'S RETENTION PERIOD. The section is headed Retention of record and states a number, which makes it look like a general one-year rule, but it is a PRESERVATION duty triggered by an event: it attaches when an authorization to disclose is received, or while an access or amendment request is pending, and it says nothing about how long a record must be kept in the ordinary course. Washington's actual retention periods are set board by board. Operationally it functions as a statutory litigation-style hold — receipt of a disclosure authorization freezes that record for a year regardless of where it sits in any destruction schedule, so an automated purge needs a suppression flag keyed to authorizations and open requests.

Applies when

A provider receives an authorization to disclose under RCW 70.02.040, or a request under RCW 70.02.080 or 70.02.100 is pending

StatewideWash. Rev. Code § 70.02.160Patients and their representativesVerified 2026-08-30

Deadline to respond to an access request

Upon receipt of a WRITTEN REQUEST from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN FIFTEEN WORKING DAYS after receiving the request, shall: MAKE THE INFORMATION AVAILABLE for examination during regular business hours and provide a copy if requested; or INFORM THE PATIENT IF THE INFORMATION DOES NOT EXIST OR CANNOT BE FOUND; or, IF THE PROVIDER DOES NOT MAINTAIN THE RECORD, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PROVIDER WHO DOES; or, if the information is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the reasons for the delay and the earliest date, NOT LATER THAN TWENTY-ONE WORKING DAYS after receiving the request, when the information will be available or the request otherwise disposed of; or DENY the request under RCW 70.02.090 and inform the patient. Upon request the provider SHALL PROVIDE AN EXPLANATION OF ANY CODE OR ABBREVIATION used. If a record is not maintained in the requested form, the provider IS NOT REQUIRED TO CREATE A NEW RECORD OR REFORMULATE an existing one. The provider MAY CHARGE A REASONABLE FEE and IS NOT REQUIRED TO PERMIT EXAMINATION OR COPYING UNTIL THE FEE IS PAID.

What this means operationally

Washington gives five permitted responses and requires one of them inside fifteen WORKING days — so silence is never compliant, and a search that comes up empty must still be answered on time. Two branches are easy to miss: where the practice does not hold the record it must name the provider who does, and a delay is only lawful if the reasons are given IN WRITING with a specific date no later than twenty-one working days out. The code-and-abbreviation explanation duty is unusual and is triggered on request rather than automatically. Note the fee may gate access entirely — the provider need not permit examination or copying until it is paid.

Applies when

A patient makes a written request to examine or copy their recorded health care information

Exceptions

Denial in whole or part on a ground in RCW 70.02.090
No duty to create a new record or reformulate an existing one to match a requested form
The fee-before-access rule does not apply where RCW 70.02.030 provides otherwise

StatewideWash. Rev. Code § 70.02.080Patients and their representativesVerified 2026-08-30

Provider may disclose, subject to a test

A health care provider MAY DENY ACCESS to health care information by a patient if the provider REASONABLY CONCLUDES that: knowledge of the information WOULD BE INJURIOUS TO THE HEALTH of the patient; knowledge could reasonably be expected to LEAD TO THE PATIENT'S IDENTIFICATION OF AN INDIVIDUAL WHO PROVIDED THE INFORMATION IN CONFIDENCE under circumstances in which confidentiality was appropriate; knowledge could reasonably be expected to CAUSE DANGER TO THE LIFE OR SAFETY OF ANY INDIVIDUAL; the information WAS COMPILED AND IS USED SOLELY FOR LITIGATION, QUALITY ASSURANCE, PEER REVIEW OR ADMINISTRATIVE PURPOSES; or access is OTHERWISE PROHIBITED BY LAW. If access is denied, the provider SHALL, TO THE EXTENT POSSIBLE, SEGREGATE the information for which access is denied from information for which it cannot be denied AND PERMIT THE PATIENT TO EXAMINE OR COPY THE DISCLOSABLE INFORMATION. If denial is on the INJURIOUS-TO-HEALTH or DANGER grounds, the provider SHALL PERMIT EXAMINATION AND COPYING BY ANOTHER HEALTH CARE PROVIDER SELECTED BY THE PATIENT who is authorized under the laws of this state TO TREAT THE PATIENT FOR THE SAME CONDITION, and SHALL INFORM THE PATIENT OF THAT RIGHT.

What this means operationally

Denial is almost never total. The segregation duty means a practice must release everything it can and withhold only the specific material a ground covers — a blanket refusal over one problematic entry is non-compliant. And on the two clinical grounds the record still leaves the practice, to a clinician the patient picks who is authorized to treat the SAME CONDITION, with an affirmative duty to tell the patient that route exists. The confidential-source ground is broader than most states offer, and the litigation-and-quality-assurance ground turns on the material having been compiled and used SOLELY for those purposes, so a dual-purpose document does not qualify.

Applies when

A provider reasonably concludes one of the five statutory grounds applies to a request under RCW 70.02.080

Exceptions

Subject to any conflicting requirement in the Public Records Act, ch. 42.56 RCW

StatewideWash. Rev. Code § 70.02.090Patients and their representativesVerified 2026-08-30

Right to amend or correct the record

FOR PURPOSES OF ACCURACY OR COMPLETENESS, a patient may REQUEST IN WRITING that a health care provider CORRECT OR AMEND its record of the patient's health care information to which the patient has access under RCW 70.02.080. AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN TEN DAYS after receiving the request, the provider shall: MAKE THE REQUESTED CORRECTION OR AMENDMENT AND INFORM THE PATIENT; or inform the patient if the record NO LONGER EXISTS OR CANNOT BE FOUND; or, if the provider does not maintain the record, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PERSON WHO DOES; or, if the record is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the earliest date, NOT LATER THAN TWENTY-ONE DAYS after receiving the request, when the correction will be made or the request otherwise disposed of; or INFORM THE PATIENT IN WRITING OF THE REFUSAL to correct or amend as requested AND OF THE PATIENT'S RIGHT TO ADD A STATEMENT OF DISAGREEMENT.

What this means operationally

Ten days is the shortest amendment deadline in the corpus and it is shorter than Washington's own fifteen-working-day access clock — so a practice that routes corrections through the same queue as records requests will miss it. The extension runs to twenty-one CALENDAR days here against twenty-one WORKING days for access, another asymmetry worth building into the workflow separately rather than by analogy. A refusal must be in writing and must itself tell the patient about the statement of disagreement; a silent or verbal refusal fails on two counts.

Applies when

A patient requests in writing that a record be corrected or amended for accuracy or completeness

Exceptions

Reaches only information the patient has access to under RCW 70.02.080

StatewideWash. Rev. Code § 70.02.100Patients and their representativesVerified 2026-08-30

What applies to dermatology practices everywhere

Clinical photography makes dermatology unusually exposed. Images can contain a face, tattoo, body location, embedded metadata, patient identifier, or clinical context. The SRA must follow those images from capture through storage, treatment use, disclosure, marketing, retention, and deletion.

Every device used to capture clinical photographs, dermoscopy images, wound documentation, and treatment-progress images

Camera rolls, automatic cloud synchronization, local storage, image upload, EHR attachment, backup, and deletion

The EHR, practice-management system, portal, teledermatology platform, imaging tools, and photo-management systems

Dermatopathology, laboratory, biopsy, Mohs, referral, and specialist data flows

Email, text, e-fax, patient forms, scheduling, and delivery of images or results

Before-and-after photography used for treatment documentation, education, websites, advertising, or social media

Full dermatologycompliance guide →

Federal obligations still have to be evidenced for dermatology practices in Washington.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Washington rules on this page.

Start the risk assessment