HIPAA compliance for psychiatry practices in Washington

Washington keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Washington has 10 recorded rules that apply to psychiatry practices differently from other businesses in the state — set out below with their conditions and sources.

Washington jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Washington's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Psychiatry practices that electronically bill, check eligibility, request authorization, or conduct other adopted transactions are HIPAA covered entities. Once covered, the duties below are required. Psychotherapy notes, qualifying Part 2 records, controlled-substance prescribing, and state mental-health law add obligations; they do not replace HIPAA's core program.

State — how Washington law interacts with HIPAA

Washington substitutes federal notice for part of its scheme but keeps a residual state duty of its own. Psychiatry practices operating here should expect both a federal and a state obligation, with different recipients and triggers.

Washington's My Health My Data Act (RCW 19.373) applies broadly to consumer health data — including from entities not otherwise subject to HIPAA — and layers separate consent, disclosure, and consumer-rights obligations. Where an entity is subject to both HIPAA and MHMDA, HIPAA-compliant handling generally satisfies MHMDA's baseline for HIPAA-governed data, but MHMDA obligations for non-HIPAA data remain independent.

What Washington adds for psychiatry practices specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Washington's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

Any adolescent may request and receive outpatient behavioral health treatment without the consent of the adolescent's parent. Parental authorization is required for outpatient treatment of a minor under the age of thirteen.

Service: outpatient behavioral health treatment
Patient population: adolescents aged 13 and older

What this means operationally

Washington draws a clean line at 13 with no session cap and no maturity determination, which makes it one of the simpler regimes to operate — and therefore one of the easier to get wrong by importing another state's extra conditions. The only thing intake has to establish is age.

Applies when

The adolescent is 13 or older
The treatment is outpatient behavioral health treatment

Exceptions

Parental authorization is required below age 13

State statuteWash. Rev. Code § 71.34.530Adolescents aged 13 and olderVerified 2026-08-29

Minor may consent

An adolescent may admit themselves to an evaluation and treatment facility for inpatient mental health treatment, or to an approved substance use disorder treatment program, without parental consent. Parental authorization, or authorization from a person who may consent on behalf of the minor under RCW 7.70.065, is required for inpatient treatment of a minor under 13. The professional person in charge must concur with the need for inpatient treatment and determine that it is not feasible to treat the person in a less restrictive setting.

Service: inpatient mental health treatment or approved substance use disorder treatment
Setting: an evaluation and treatment facility or approved substance use disorder treatment program
Patient population: adolescents 13 and older

What this means operationally

Washington is the inverse of Virginia here. Virginia requires a minor 14 or older to consent JOINTLY with a parent for inpatient admission; Washington lets an adolescent self-admit without the parent at all. The gate is not the parent but the professional — self-admission does not oblige the facility to accept, and a less-restrictive-setting determination has to be made and stands on the record as the reason the admission was appropriate.

Applies when

The adolescent is 13 or older
The professional person in charge concurs with the need for inpatient treatment
Treatment in a less restrictive setting is not feasible

Exceptions

A minor under 13 requires parental authorization or authorization under RCW 7.70.065

State statuteWash. Rev. Code § 71.34.500Adolescents 13 and olderVerified 2026-08-29

Minor may consent

A parent may bring, or authorize the bringing of, their adolescent child to an evaluation and treatment facility, a facility licensed under chapter 70.41, 71.12 or 72.23 RCW, or a secure withdrawal management and stabilization facility or approved substance use disorder treatment program, and request an examination or assessment to determine whether the adolescent has a behavioral health disorder and needs inpatient treatment. THE CONSENT OF THE ADOLESCENT IS NOT REQUIRED for admission, evaluation and treatment if a parent provides consent. The evaluation must be completed within twenty-four hours unless the professional person determines the adolescent's condition requires more time, and in no event may an adolescent be held longer than one hundred twenty hours for evaluation. Facilities must promptly give written and verbal notice of all statutorily available treatment options and document a signed acknowledgment of receipt by the parent or guardian.

Service: mental health or substance use disorder evaluation and treatment initiated by a parent
Setting: an evaluation and treatment facility, licensed inpatient facility, or approved substance use disorder treatment program

What this means operationally

Washington runs two doors into the same building. Through the adolescent-initiated door the parent has no say; through the family-initiated door the adolescent has none. Neither displaces the other, and which one an episode came through determines who may consent, who must be told, and who may later object — so the initiating party is a field that has to be captured at the point of admission, because nothing about the clinical picture reveals it afterwards.

Applies when

A parent brings the adolescent and requests evaluation or treatment

Exceptions

The evaluation must be completed within twenty-four hours absent a professional determination that more time is needed, and never beyond one hundred twenty hours

State statuteWash. Rev. Code §§ 71.34.375, 71.34.600Adolescents brought for treatment by a parentVerified 2026-08-29

Payment liability

A minor receiving treatment under chapter 71.34 RCW and responsible others shall be liable for the costs of treatment, care and transportation to the extent of available resources and ability to pay. The secretary or director establishes rules defining income, resources and exemptions for determining ability to pay.

Service: treatment, care and transportation under the adolescent behavioral health chapter

What this means operationally

Washington does not allocate the cost by who consented, which is what Maryland, Texas, California and Minnesota all do in their different ways. Both the minor and 'responsible others' are liable, bounded only by resources and ability to pay. So a Washington practice cannot infer the guarantor from the consent route, and the answer turns on a means determination made under agency rules rather than on anything in the clinical record.

Applies when

A minor received treatment under chapter 71.34 RCW

Exceptions

Liability is bounded by available resources and ability to pay as defined by rule

State statuteWash. Rev. Code § 71.34.405Minors treated under chapter 71.34 RCWVerified 2026-08-29

Parental access to records

Provider must disclose

The professional person in charge of an evaluation and treatment facility shall provide notice to the parent of an adolescent voluntarily admitted to inpatient treatment under RCW 71.34.500 SOLELY for mental health treatment and not for substance use disorder treatment, unless the professional person has a compelling reason to believe that such disclosure would be detrimental to the adolescent or contact cannot be made, in which case the professional person must document the reasons in the adolescent's medical record.

Service: voluntary inpatient admission of an adolescent
Setting: an evaluation and treatment facility or approved substance use disorder treatment program

What this means operationally

The default is that the parent is told, and it is displaced only by a documented compelling reason that disclosure would be detrimental, or by an inability to make contact. The documentation is the part that is easy to lose: the reason has to be written into the medical record, so a decision taken well but recorded nowhere looks identical afterwards to one never taken. Withholding also switches on a separate recurring duty under subsection (3), which is recorded on its own.

Applies when

An adolescent is voluntarily admitted to inpatient treatment under RCW 71.34.500

Exceptions

Withheld for a documented compelling reason that disclosure would be detrimental to the adolescent, or where contact cannot be made

State statuteWash. Rev. Code § 71.34.510(1)Adolescents voluntarily admitted to inpatient treatmentVerified 2026-08-29

Provider may disclose, subject to a test

A mental health agency, behavioral health hospital, evaluation and treatment facility, crisis stabilization unit, or 23-hour crisis relief center may release mental health information about an adolescent to a parent without the consent of the adolescent, by following the limitations and restrictions of RCW 70.02.240 and 70.02.265.

Service: an adolescent's mental health information
Provider class: a mental health agency, behavioral health hospital, evaluation and treatment facility, crisis stabilization unit or 23-hour crisis relief center

What this means operationally

A permission rather than a right, and it is conditioned rather than free — the section does not itself state the limits, it points at two other provisions that do. That structure matters operationally: a practice cannot answer a parent's request from this section alone, and any policy that cites it without carrying the RCW 70.02 restrictions across is incomplete on its face.

Applies when

A parent seeks mental health information about an adolescent

Exceptions

The release is bounded by the limitations and restrictions of RCW 70.02.240 and 70.02.265

State statuteWash. Rev. Code § 71.34.430Adolescents receiving mental health servicesVerified 2026-08-29

Release prohibited

The professional person in charge shall provide notice to the parent of an adolescent voluntarily admitted under RCW 71.34.500 for SUBSTANCE USE DISORDER treatment only if the adolescent provides written consent to the disclosure of the fact of admission and such other substance use disorder treatment information as the notice would contain, or where permitted by federal law.

Service: voluntary inpatient admission for substance use disorder treatment
Setting: an evaluation and treatment facility or approved substance use disorder treatment program

What this means operationally

The mirror image of the mental-health rule in the same section, and the reason the two cannot share a workflow. Here silence is the default and notification is the exception, gated on the adolescent's WRITTEN consent — a verbal agreement does not open it. The federal alternative is a reference to the substance-use confidentiality regime rather than a general license, so a facility relying on it should be able to identify which federal provision it is relying on.

Applies when

An adolescent is voluntarily admitted for substance use disorder treatment

Exceptions

The adolescent provides written consent to the disclosure
Federal law permits the disclosure

State statuteWash. Rev. Code § 71.34.510(2)Adolescents admitted for substance use disorder treatmentVerified 2026-08-29

Provider must disclose

The notice required under RCW 71.34.510(1) and (2) shall be in the form most likely to reach the parent within twenty-four hours of the adolescent's voluntary admission, and shall advise the parent: that the adolescent has been admitted to inpatient treatment; of the location and telephone number of the facility providing the treatment; of the name of a professional person on the staff of the facility who is designated to discuss the adolescent's need for inpatient treatment with the parent; and of the medical necessity for admission. Notification efforts shall begin as soon as reasonably practicable, considering the adolescent's immediate medical needs.

Service: the parental notice required on voluntary inpatient admission
Setting: an evaluation and treatment facility or approved substance use disorder treatment program

What this means operationally

The mechanics shared by both notice duties, and they are more demanding than 'tell the parent'. Four elements are mandatory, and the third names a person rather than a department — a designated staff member the parent can speak to about the need for treatment, which has to be decided and communicated at the time. The standard is the form most likely to REACH the parent within twenty-four hours, so choice of channel is a judgment about that particular parent rather than a fixed procedure, and the effort clock starts as soon as reasonably practicable subject to the adolescent's immediate medical needs.

Applies when

A notice is owed under subsection (1), or is permitted and given under subsection (2)

Exceptions

Notification efforts begin as soon as reasonably practicable, considering the adolescent's immediate medical needs

State statuteWash. Rev. Code § 71.34.510(4)Parents of adolescents voluntarily admittedVerified 2026-08-29

Provider disclosure to a parent

Prerequisite before the authority may be used

If the professional person withholds notice to a parent under RCW 71.34.510(1), or such notice cannot be provided, the professional person in charge of the facility must consult the information the Washington State Patrol makes publicly available under RCW 43.43.510(2) at least once every eight hours for the first seventy-two hours of treatment, and once every twenty-four hours thereafter, while the adolescent continues to receive inpatient services and until the professional person contacts a parent of the adolescent.

Setting: an evaluation and treatment facility where parental notice was withheld or could not be given

What this means operationally

A recurring obligation that attaches precisely BECAUSE the parent was not told, which makes it the easiest duty in this corpus to miss — it is scheduled work rather than a decision. The cadence changes: every eight hours for the first seventy-two, then every twenty-four, and it runs until a parent is actually contacted rather than until some fixed point. Consulting the listing is the whole of this duty; what happens if the adolescent turns out to be listed is a separate obligation recorded on its own.

Applies when

Parental notice under subsection (1) was withheld, or could not be provided
The adolescent continues to receive inpatient services and no parent has yet been contacted

Exceptions

The duty ends once the professional person contacts a parent of the adolescent

State statuteWash. Rev. Code § 71.34.510(3), checking dutyAdolescents admitted without parental noticeVerified 2026-08-29

Provider must disclose

If the adolescent is publicly listed as missing, the professional person must IMMEDIATELY notify the Department of Children, Youth, and Families of its contact with the youth listed as missing. The notification must include a description of the adolescent's physical and emotional condition.

Setting: an evaluation and treatment facility treating an adolescent publicly listed as missing

What this means operationally

The conditional half of subsection (3), and the only obligation in the section owed to a state agency rather than to a parent. Two things distinguish it operationally: it is immediate rather than scheduled, and it has required content — a description of the adolescent's physical AND emotional condition, which is a clinical statement rather than an administrative one and therefore cannot be sent by front-desk staff without input.

Applies when

Parental notice was withheld or could not be given under subsection (1)
The adolescent is publicly listed as missing

State statuteWash. Rev. Code § 71.34.510(3), notification dutyAdolescents publicly listed as missingVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Washington breach obligations

These apply to businesses generally rather than to psychiatry practices in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Washingtonbreach data →

Individual notice deadline

In the most expedient time possible, without unreasonable delay, and no later than 30 days after discovery of the breach, subject to the statutory law-enforcement delay and time reasonably necessary to determine scope and restore integrity.

The outer bound of 30 days is materially shorter than HIPAA's 60-day individual-notice window. Federal and state duties apply independently.

State regulator notice

Required above 500 residents

The Washington State Attorney General must be notified when a breach affects more than 500 Washington residents.

Source: Wash. Rev. Code § 19.255.010

Statewide rules that also reach psychiatry practices

Minor may consent

Informed consent to health care on behalf of a minor patient may be given by a member of one of the following classes, in the following order of priority: the minor's appointed guardian or legal custodian; a person authorized by the court to consent for a minor in out-of-home placement; the minor's parents; a person to whom the parent has given signed authorization; and a competent adult relative who provides a declaration under penalty of perjury.

What this means operationally

An ordered list, like Florida's and unlike Texas's, and it is the list the behavioral health chapter points back to whenever it says 'a person who may consent on behalf of the minor pursuant to RCW 7.70.065'. The entry a practice is most likely to meet without recognizing is the fourth: a parent's signed authorization transfers consent authority to whoever holds it, so the relevant question is not the adult's relationship to the child but whether they are carrying that document.

Applies when

A person other than the minor is consenting to the minor's health care

StatewideWash. Rev. Code § 7.70.065(2)Minors whose care requires substitute consentVerified 2026-08-29

Duty to keep an accurate record

A health care provider SHALL MAINTAIN A RECORD OF EXISTING HEALTH CARE INFORMATION FOR AT LEAST ONE YEAR FOLLOWING RECEIPT OF AN AUTHORIZATION TO DISCLOSE that health care information under RCW 70.02.040, AND DURING THE PENDENCY OF A REQUEST FOR EXAMINATION AND COPYING under RCW 70.02.080 OR A REQUEST FOR CORRECTION OR AMENDMENT under RCW 70.02.100.

What this means operationally

DO NOT READ THIS AS WASHINGTON'S RETENTION PERIOD. The section is headed Retention of record and states a number, which makes it look like a general one-year rule, but it is a PRESERVATION duty triggered by an event: it attaches when an authorization to disclose is received, or while an access or amendment request is pending, and it says nothing about how long a record must be kept in the ordinary course. Washington's actual retention periods are set board by board. Operationally it functions as a statutory litigation-style hold — receipt of a disclosure authorization freezes that record for a year regardless of where it sits in any destruction schedule, so an automated purge needs a suppression flag keyed to authorizations and open requests.

Applies when

A provider receives an authorization to disclose under RCW 70.02.040, or a request under RCW 70.02.080 or 70.02.100 is pending

StatewideWash. Rev. Code § 70.02.160Patients and their representativesVerified 2026-08-30

Deadline to respond to an access request

Upon receipt of a WRITTEN REQUEST from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN FIFTEEN WORKING DAYS after receiving the request, shall: MAKE THE INFORMATION AVAILABLE for examination during regular business hours and provide a copy if requested; or INFORM THE PATIENT IF THE INFORMATION DOES NOT EXIST OR CANNOT BE FOUND; or, IF THE PROVIDER DOES NOT MAINTAIN THE RECORD, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PROVIDER WHO DOES; or, if the information is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the reasons for the delay and the earliest date, NOT LATER THAN TWENTY-ONE WORKING DAYS after receiving the request, when the information will be available or the request otherwise disposed of; or DENY the request under RCW 70.02.090 and inform the patient. Upon request the provider SHALL PROVIDE AN EXPLANATION OF ANY CODE OR ABBREVIATION used. If a record is not maintained in the requested form, the provider IS NOT REQUIRED TO CREATE A NEW RECORD OR REFORMULATE an existing one. The provider MAY CHARGE A REASONABLE FEE and IS NOT REQUIRED TO PERMIT EXAMINATION OR COPYING UNTIL THE FEE IS PAID.

What this means operationally

Washington gives five permitted responses and requires one of them inside fifteen WORKING days — so silence is never compliant, and a search that comes up empty must still be answered on time. Two branches are easy to miss: where the practice does not hold the record it must name the provider who does, and a delay is only lawful if the reasons are given IN WRITING with a specific date no later than twenty-one working days out. The code-and-abbreviation explanation duty is unusual and is triggered on request rather than automatically. Note the fee may gate access entirely — the provider need not permit examination or copying until it is paid.

Applies when

A patient makes a written request to examine or copy their recorded health care information

Exceptions

Denial in whole or part on a ground in RCW 70.02.090
No duty to create a new record or reformulate an existing one to match a requested form
The fee-before-access rule does not apply where RCW 70.02.030 provides otherwise

StatewideWash. Rev. Code § 70.02.080Patients and their representativesVerified 2026-08-30

Provider may disclose, subject to a test

A health care provider MAY DENY ACCESS to health care information by a patient if the provider REASONABLY CONCLUDES that: knowledge of the information WOULD BE INJURIOUS TO THE HEALTH of the patient; knowledge could reasonably be expected to LEAD TO THE PATIENT'S IDENTIFICATION OF AN INDIVIDUAL WHO PROVIDED THE INFORMATION IN CONFIDENCE under circumstances in which confidentiality was appropriate; knowledge could reasonably be expected to CAUSE DANGER TO THE LIFE OR SAFETY OF ANY INDIVIDUAL; the information WAS COMPILED AND IS USED SOLELY FOR LITIGATION, QUALITY ASSURANCE, PEER REVIEW OR ADMINISTRATIVE PURPOSES; or access is OTHERWISE PROHIBITED BY LAW. If access is denied, the provider SHALL, TO THE EXTENT POSSIBLE, SEGREGATE the information for which access is denied from information for which it cannot be denied AND PERMIT THE PATIENT TO EXAMINE OR COPY THE DISCLOSABLE INFORMATION. If denial is on the INJURIOUS-TO-HEALTH or DANGER grounds, the provider SHALL PERMIT EXAMINATION AND COPYING BY ANOTHER HEALTH CARE PROVIDER SELECTED BY THE PATIENT who is authorized under the laws of this state TO TREAT THE PATIENT FOR THE SAME CONDITION, and SHALL INFORM THE PATIENT OF THAT RIGHT.

What this means operationally

Denial is almost never total. The segregation duty means a practice must release everything it can and withhold only the specific material a ground covers — a blanket refusal over one problematic entry is non-compliant. And on the two clinical grounds the record still leaves the practice, to a clinician the patient picks who is authorized to treat the SAME CONDITION, with an affirmative duty to tell the patient that route exists. The confidential-source ground is broader than most states offer, and the litigation-and-quality-assurance ground turns on the material having been compiled and used SOLELY for those purposes, so a dual-purpose document does not qualify.

Applies when

A provider reasonably concludes one of the five statutory grounds applies to a request under RCW 70.02.080

Exceptions

Subject to any conflicting requirement in the Public Records Act, ch. 42.56 RCW

StatewideWash. Rev. Code § 70.02.090Patients and their representativesVerified 2026-08-30

Right to amend or correct the record

FOR PURPOSES OF ACCURACY OR COMPLETENESS, a patient may REQUEST IN WRITING that a health care provider CORRECT OR AMEND its record of the patient's health care information to which the patient has access under RCW 70.02.080. AS PROMPTLY AS REQUIRED UNDER THE CIRCUMSTANCES BUT NO LATER THAN TEN DAYS after receiving the request, the provider shall: MAKE THE REQUESTED CORRECTION OR AMENDMENT AND INFORM THE PATIENT; or inform the patient if the record NO LONGER EXISTS OR CANNOT BE FOUND; or, if the provider does not maintain the record, inform the patient AND PROVIDE THE NAME AND ADDRESS, IF KNOWN, OF THE PERSON WHO DOES; or, if the record is IN USE or UNUSUAL CIRCUMSTANCES have delayed handling, inform the patient and SPECIFY IN WRITING the earliest date, NOT LATER THAN TWENTY-ONE DAYS after receiving the request, when the correction will be made or the request otherwise disposed of; or INFORM THE PATIENT IN WRITING OF THE REFUSAL to correct or amend as requested AND OF THE PATIENT'S RIGHT TO ADD A STATEMENT OF DISAGREEMENT.

What this means operationally

Ten days is the shortest amendment deadline in the corpus and it is shorter than Washington's own fifteen-working-day access clock — so a practice that routes corrections through the same queue as records requests will miss it. The extension runs to twenty-one CALENDAR days here against twenty-one WORKING days for access, another asymmetry worth building into the workflow separately rather than by analogy. A refusal must be in writing and must itself tell the patient about the statement of disagreement; a silent or verbal refusal fails on two counts.

Applies when

A patient requests in writing that a record be corrected or amended for accuracy or completeness

Exceptions

Reaches only information the patient has access to under RCW 70.02.080

StatewideWash. Rev. Code § 70.02.100Patients and their representativesVerified 2026-08-30

What applies to psychiatry practices everywhere

Psychiatry combines highly sensitive records, psychotherapy-note protections, telehealth, prescribing, laboratory monitoring, supervision, and high-consequence disclosure decisions. The SRA must reflect all of those systems and workflows.

The EHR and the storage, separation, access, and disclosure of psychotherapy notes when they are created

E-prescribing and EPCS systems, prescriber identity controls, multifactor authentication, and audit trails

Telehealth platforms, recordings, chat, remote devices, home offices, and patient communication

Laboratory interfaces used for medication monitoring

Supervision, consultation, care coordination, and shared-record workflows

Billing, payment, portals, intake, scheduling, messaging, email, text, and e-fax

Full psychiatrycompliance guide →

Knowing the Washington rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Washington rules on this page.

Start the risk assessment