HIPAA compliance for independent medical practices in Washington

Washington keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Washington has one recorded rule that applies to independent medical practices differently from other businesses in the state — set out below with their conditions and sources.

Washington jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Washington's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Medical practices that electronically submit claims, check eligibility, request authorization, or conduct another adopted transaction are HIPAA covered entities. That describes the overwhelming majority of modern medical practices. The duties below are required; an EHR does not perform them for the practice.

State — how Washington law interacts with HIPAA

Washington substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Independent medical practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Washington's My Health My Data Act (RCW 19.373) applies broadly to consumer health data — including from entities not otherwise subject to HIPAA — and layers separate consent, disclosure, and consumer-rights obligations. Where an entity is subject to both HIPAA and MHMDA, HIPAA-compliant handling generally satisfies MHMDA's baseline for HIPAA-governed data, but MHMDA obligations for non-HIPAA data remain independent.

What Washington adds for independent medical practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Washington's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

An unaccompanied homeless youth under the age of majority who cannot obtain consent through school personnel may authorize their own nonemergency, outpatient, primary care services, including examinations, immunizations and routine follow-up care, but excluding elective surgeries. Status may be verified by a written statement signed under penalty of perjury by staff at a governmental or nonprofit human services agency, an attorney, or an adult relative or other adult with knowledge of the minor patient. A health care provider or facility relying on such a declaration is immune from suit in any action, civil or criminal, absent actual notice of the falsity of the statements.

Service: nonemergency, outpatient, primary care services including examinations, immunizations and routine follow-up care
Patient population: unaccompanied homeless minors under the age of majority

What this means operationally

One of the few provisions anywhere that gives a primary care practice — not a behavioral health facility — an affirmative route to treat a minor presenting alone, and it is bounded to exactly the services such a practice provides. Two operational consequences: the declaration may come from an adult with no legal relationship to the child, and the immunity attaches to RELIANCE, so the document has to be obtained and retained rather than the status merely believed.

Applies when

The minor is an unaccompanied homeless youth under the age of majority
Consent cannot be obtained through school personnel
The services are nonemergency outpatient primary care

Exceptions

Does not extend to elective surgeries
Immunity is lost where the provider has actual notice of the falsity of the declaration

State statuteWash. Rev. Code § 7.70.065(3)Unaccompanied homeless minorsVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Washington breach obligations

These apply to businesses generally rather than to independent medical practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Washingtonbreach data →

Individual notice deadline

In the most expedient time possible, without unreasonable delay, and no later than 30 days after discovery of the breach, subject to the statutory law-enforcement delay and time reasonably necessary to determine scope and restore integrity.

The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.

State regulator notice

Required above 500 residents

The Washington State Attorney General must be notified when a breach affects more than 500 Washington residents.

Source: Wash. Rev. Code § 19.255.010

Statewide rules that also reach independent medical practices

Minor may consent

Informed consent to health care on behalf of a minor patient may be given by a member of one of the following classes, in the following order of priority: the minor's appointed guardian or legal custodian; a person authorized by the court to consent for a minor in out-of-home placement; the minor's parents; a person to whom the parent has given signed authorization; and a competent adult relative who provides a declaration under penalty of perjury.

What this means operationally

An ordered list, like Florida's and unlike Texas's, and it is the list the behavioral health chapter points back to whenever it says 'a person who may consent on behalf of the minor pursuant to RCW 7.70.065'. The entry a practice is most likely to meet without recognizing is the fourth: a parent's signed authorization transfers consent authority to whoever holds it, so the relevant question is not the adult's relationship to the child but whether they are carrying that document.

Applies when

A person other than the minor is consenting to the minor's health care

StatewideWash. Rev. Code § 7.70.065(2)Minors whose care requires substitute consentVerified 2026-08-29

Duty to keep an accurate record

A health care provider SHALL MAINTAIN A RECORD OF EXISTING HEALTH CARE INFORMATION FOR AT LEAST ONE YEAR FOLLOWING RECEIPT OF AN AUTHORIZATION TO DISCLOSE that health care information under RCW 70.02.040, AND DURING THE PENDENCY OF A REQUEST FOR EXAMINATION AND COPYING under RCW 70.02.080 OR A REQUEST FOR CORRECTION OR AMENDMENT under RCW 70.02.100.

What this means operationally

DO NOT READ THIS AS WASHINGTON'S RETENTION PERIOD. The section is headed Retention of record and states a number, which makes it look like a general one-year rule, but it is a PRESERVATION duty triggered by an event: it attaches when an authorization to disclose is received, or while an access or amendment request is pending, and it says nothing about how long a record must be kept in the ordinary course. Washington's actual retention periods are set board by board. Operationally it functions as a statutory litigation-style hold — receipt of a disclosure authorization freezes that record for a year regardless of where it sits in any destruction schedule, so an automated purge needs a suppression flag keyed to authorizations and open requests.

Applies when

A provider receives an authorization to disclose under RCW 70.02.040, or a request under RCW 70.02.080 or 70.02.100 is pending

StatewideWash. Rev. Code § 70.02.160Patients and their representativesVerified 2026-08-30

Deadline to respond to an access request

Upon receipt of a WRITTEN REQUEST from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN FIFTEEN WORKING DAYS after receiving the request, shall: MAKE THE INFORMATION AVAILABLE for examination during regular business hours and provide a copy if requested; or INFORM THE PATIENT IF THE INFORMATION DOES NOT EXIST OR CANNOT BE FOUND; or, IF THE PROVIDER DOES NOT MAINTAIN THE RECORD, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PROVIDER WHO DOES; or, if the information is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the reasons for the delay and the earliest date, NOT LATER THAN TWENTY-ONE WORKING DAYS after receiving the request, when the information will be available or the request otherwise disposed of; or DENY the request under RCW 70.02.090 and inform the patient. Upon request the provider SHALL PROVIDE AN EXPLANATION OF ANY CODE OR ABBREVIATION used. If a record is not maintained in the requested form, the provider IS NOT REQUIRED TO CREATE A NEW RECORD OR REFORMULATE an existing one. The provider MAY CHARGE A REASONABLE FEE and IS NOT REQUIRED TO PERMIT EXAMINATION OR COPYING UNTIL THE FEE IS PAID.

What this means operationally

Washington gives five permitted responses and requires one of them inside fifteen WORKING days — so silence is never compliant, and a search that comes up empty must still be answered on time. Two branches are easy to miss: where the practice does not hold the record it must name the provider who does, and a delay is only lawful if the reasons are given IN WRITING with a specific date no later than twenty-one working days out. The code-and-abbreviation explanation duty is unusual and is triggered on request rather than automatically. Note the fee may gate access entirely — the provider need not permit examination or copying until it is paid.

Applies when

A patient makes a written request to examine or copy their recorded health care information

Exceptions

Denial in whole or part on a ground in RCW 70.02.090
No duty to create a new record or reformulate an existing one to match a requested form
The fee-before-access rule does not apply where RCW 70.02.030 provides otherwise

StatewideWash. Rev. Code § 70.02.080Patients and their representativesVerified 2026-08-30

Provider may disclose, subject to a test

A health care provider MAY DENY ACCESS to health care information by a patient if the provider REASONABLY CONCLUDES that: knowledge of the information WOULD BE INJURIOUS TO THE HEALTH of the patient; knowledge could reasonably be expected to LEAD TO THE PATIENT'S IDENTIFICATION OF AN INDIVIDUAL WHO PROVIDED THE INFORMATION IN CONFIDENCE under circumstances in which confidentiality was appropriate; knowledge could reasonably be expected to CAUSE DANGER TO THE LIFE OR SAFETY OF ANY INDIVIDUAL; the information WAS COMPILED AND IS USED SOLELY FOR LITIGATION, QUALITY ASSURANCE, PEER REVIEW OR ADMINISTRATIVE PURPOSES; or access is OTHERWISE PROHIBITED BY LAW. If access is denied, the provider SHALL, TO THE EXTENT POSSIBLE, SEGREGATE the information for which access is denied from information for which it cannot be denied AND PERMIT THE PATIENT TO EXAMINE OR COPY THE DISCLOSABLE INFORMATION. If denial is on the INJURIOUS-TO-HEALTH or DANGER grounds, the provider SHALL PERMIT EXAMINATION AND COPYING BY ANOTHER HEALTH CARE PROVIDER SELECTED BY THE PATIENT who is authorized under the laws of this state TO TREAT THE PATIENT FOR THE SAME CONDITION, and SHALL INFORM THE PATIENT OF THAT RIGHT.

What this means operationally

Denial is almost never total. The segregation duty means a practice must release everything it can and withhold only the specific material a ground covers — a blanket refusal over one problematic entry is non-compliant. And on the two clinical grounds the record still leaves the practice, to a clinician the patient picks who is authorized to treat the SAME CONDITION, with an affirmative duty to tell the patient that route exists. The confidential-source ground is broader than most states offer, and the litigation-and-quality-assurance ground turns on the material having been compiled and used SOLELY for those purposes, so a dual-purpose document does not qualify.

Applies when

A provider reasonably concludes one of the five statutory grounds applies to a request under RCW 70.02.080

Exceptions

Subject to any conflicting requirement in the Public Records Act, ch. 42.56 RCW

StatewideWash. Rev. Code § 70.02.090Patients and their representativesVerified 2026-08-30

Right to amend or correct the record

FOR PURPOSES OF ACCURACY OR COMPLETENESS, a patient may REQUEST IN WRITING that a health care provider CORRECT OR AMEND its record of the patient's health care information to which the patient has access under RCW 70.02.080. AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN TEN DAYS after receiving the request, the provider shall: MAKE THE REQUESTED CORRECTION OR AMENDMENT AND INFORM THE PATIENT; or inform the patient if the record NO LONGER EXISTS OR CANNOT BE FOUND; or, if the provider does not maintain the record, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PERSON WHO DOES; or, if the record is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the earliest date, NOT LATER THAN TWENTY-ONE DAYS after receiving the request, when the correction will be made or the request otherwise disposed of; or INFORM THE PATIENT IN WRITING OF THE REFUSAL to correct or amend as requested AND OF THE PATIENT'S RIGHT TO ADD A STATEMENT OF DISAGREEMENT.

What this means operationally

Ten days is the shortest amendment deadline in the corpus and it is shorter than Washington's own fifteen-working-day access clock — so a practice that routes corrections through the same queue as records requests will miss it. The extension runs to twenty-one CALENDAR days here against twenty-one WORKING days for access, another asymmetry worth building into the workflow separately rather than by analogy. A refusal must be in writing and must itself tell the patient about the statement of disagreement; a silent or verbal refusal fails on two counts.

Applies when

A patient requests in writing that a record be corrected or amended for accuracy or completeness

Exceptions

Reaches only information the patient has access to under RCW 70.02.080

StatewideWash. Rev. Code § 70.02.100Patients and their representativesVerified 2026-08-30

What applies to independent medical practices everywhere

Independent medical practices often have the broadest technology and data surface: EHRs, portals, laboratories, e-prescribing, imaging, claims, referrals, fax, remote access, and dozens of vendors. The SRA must cover the whole environment — not merely the primary EHR.

The complete inventory of systems that create, receive, maintain, or transmit ePHI

EHR access, administrative privileges, audit logging, integrations, APIs, and patient-portal connections

Laboratory, imaging, e-prescribing, pharmacy, hospital, specialist, and referral data flows

Claims, eligibility, prior authorization, clearinghouse, billing, and payment workflows

Email, text, e-fax, forms, telehealth, call recording, voicemail, and patient messaging

Workstations, servers, laptops, tablets, phones, network equipment, remote access, cloud storage, and backup

Full medical practicescompliance guide →

Knowing the Washington rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Washington rules on this page.

Start the risk assessment