Health record rights in Washington: what state law adds
In Washington, as of October 3, 2026, your OK is needed before businesses outside HIPAA collect or share your health data, and your signed permission before they sell it; you get a copy of your record faster than HIPAA requires, and free in some cases; the health information exchange offers no general choice; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue over misuse of your records; breach notices must cover medical and health insurance information; and one of the three rules we look for on AI in care is in force. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
The seven answers
Do apps and wearables need your OK before sharing health data?Yes. A consumer health data law requires your OK before a business collects or shares health data, and your signed permission before it sells it. Same answer in 2 of the 50 states, counting this one.
Can you sue if your records are misused?Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general. Same answer in 11 of the 50 states, counting this one.
Are there rules for AI used in your care?One of the three rules is in force. A licensed clinician decides, not AI alone. Also signed, not yet in force: Prior authorization: standards, denials (effective January 1, 2027) (January 1, 2027). Same answer in 12 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes. A consumer health data law requires your OK before a business collects or shares health data, and your signed permission before it sells it.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Chapter 19.373 RCW requires consent to collect and to share consumer health data, and a signed valid authorization to sell. Effective date of Laws of 2023 ch. 191 is July 23, 2023; operative duties began March 31, 2024.
My Health My Data Act: collection or sharing of consumer health data. RCW 19.373.030
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
beginning March 31, 2024, a regulated entity or a small business may not collect any consumer health data except: (i) With consent from the consumer for such collection for a specified purpose
Who it binds, in our words: "Regulated entity" means any legal entity that: (a) Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington (RCW 19.373.010). Small businesses covered from June 30, 2024.
My Health My Data Act: valid authorization to sell. RCW 19.373.070
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
it is unlawful for any person to sell or offer to sell consumer health data concerning a consumer without first obtaining valid authorization from the consumer.
Who it binds, in our words: Any person. The sale must be consistent with the valid authorization signed by the consumer.
Second check by a separate agent: confirmed.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
Yes, both. A deadline shorter than 30 days, and a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Beyond the federal floor: 15 working days is shorter than 30 days, and a free copy for an SSI or SSDI appeal goes past HIPAA and 45 CFR 171.302. The deadline counts working days.
Deadline in the law: 15 days.
Free copy: One free copy to a patient or personal representative when the patient is appealing a denial of federal SSI or Social Security disability benefits (RCW 70.02.030(2)(b)); not required again within two years.
Fee rule: RCW 70.02.080(2): "the health care provider may charge a reasonable fee for providing the health care information"
Fee rule: WAC 246-08-400(1)(a): "No more than one dollar and twenty-four cents per page for the first thirty pages"
Fee rule: WAC 246-08-400(1)(b): "No more than ninety-four cents per page for all other pages."
Fee rule: WAC 246-08-400(2)(a): "The provider can charge a twenty-eight dollar clerical fee for searching and handling records"
Fee rule: WAC 246-08-400(3): HIPAA covered entities "may not charge fees or costs that are not authorized by, or are prohibited by, Federal HIPAA regulation 45 C.F.R. Sec. 164."
Goes beyond the federal floor: yes.
Patient's examination and copying: requirements. RCW 70.02.080
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
a health care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall: (a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient
Who it binds, in our words: Health care providers. A delay notice may extend to "not later than twenty-one working days after receiving the request".
Patient authorization of disclosure: free copy for SSI or SSDI appeal. RCW 70.02.030(2)(b)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
shall provide the patient or representative with one copy of the patient's health care information free of charge if the patient is appealing the denial of federal supplemental security income or social security disability benefits.
Who it binds, in our words: Health care facilities and health care providers, on request of a patient or personal representative. Free copy added by Laws of 2018 ch. 87 (effective June 7, 2018); section last amended by Laws of 2024 ch. 150.
Health care providers charging for searching and duplicating health care records. WAC 246-08-400
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
No more than one dollar and twenty-four cents per page for the first thirty pages
Who it binds, in our words: Health care providers. Per-page cap recorded as a fact only.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No general choice. Sharing through the exchange follows HIPAA's rules, and no state rule or exchange policy offers a general choice.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
No statute sets an HIE consent rule. The designated HIE's current policy leaves consent to each participant and publishes no general patient opt-in or opt-out. stricterForSensitive not determined for the HIE.
Set by the published policy of the state-designated exchange; no state law sets the rule.
Designated exchange: HCP OneHealthPort, LLC (OneHealthPort HIE), lead organization designated by the Health Care Authority under RCW 41.05.039.
OneHealthPort HIE Participation Agreement, Business Associate Policy (effective 7/1/2026). OneHealthPort HIE Participation Agreement, Version 1, effective 2026-07-01
In force · effective · read October 3, 2026 · source(onehealthport.com, reached from hca.wa.gov)
Participant shall be responsible for obtaining any Consent or Authorization for the use of the HIE or any Service with respect to Protected Health Information which the Participant considers necessary or appropriate.
Who it binds, in our words: Participants in the OneHealthPort HIE. HCA page: "Health Commons Project (HCP) OneHealthPort, LLC is Health Care Authority’s (HCA) lead organization (LO) responsible for administering and providing technical support for the CDR."
Health information: secure access, lead organization. RCW 41.05.039
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
the director shall designate one or more lead organizations to coordinate development of processes, guidelines, and standards to: (a) Improve patient access to and control of their own health care information and thereby enable their active participation in their own care
Who it binds, in our words: Health Care Authority director. Sets no patient consent rule for exchange.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RCW 7.115.020 limits sharing of information on reproductive and gender-affirming care with other states and sets an attestation rule for legal process served on Washington communication service businesses.
Protected health care services: declaration of public policy, cooperation, business entities. RCW 7.115.020(3)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Any information relating to any protected health care services provided to a specific individual shall not be shared with an agency, department, or individual from another state for the purpose of investigating or enforcing another state's law
Who it binds, in our words: "Protected health care services" means gender-affirming treatment and reproductive health care services that are lawful in Washington (RCW 7.115.010). Amended by Laws of 2025 ch. 248, effective July 27, 2025.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RCW 70.02.230 limits disclosure of mental health service records to listed cases or a valid authorization. A later version takes effect June 30, 2027.
Mental health services, confidentiality of records: permitted disclosures (effective until June 30, 2027). RCW 70.02.230
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
all information and records compiled, obtained, or maintained in the course of providing mental health services to either voluntary or involuntary recipients of services at public or private agencies may not be disclosed except as provided in this section
Who it binds, in our words: Public or private agencies providing mental health services. Current text from Laws of 2024 ch. 209 sec. 32.
Mental health services, confidentiality of records: permitted disclosures (effective June 30, 2027). RCW 70.02.230 (as amended by Laws of 2025 ch. 58 sec. 5129)
Signed, not yet in force · effective · read October 3, 2026 · source(app.leg.wa.gov)
all information and records compiled, obtained, or maintained in the course of providing mental health services to either voluntary or involuntary recipients of services at public or private agencies may not be disclosed except as provided in this section
Who it binds, in our words: Same scope. Later version of the section.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV is a designated sexually transmitted disease, so RCW 70.02.220 disclosure limits apply to HIV information and records.
Sexually transmitted diseases: permitted and mandatory disclosures. RCW 70.02.220
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
No person may disclose or be compelled to disclose information and records related to sexually transmitted diseases, except as authorized by this section
Who it binds, in our words: Any person. Current text from Laws of 2021 ch. 270, effective January 1, 2022.
Definitions: sexually transmitted disease includes HIV. RCW 70.24.017(12)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
The board shall designate chancroid, gonorrhea, granuloma inguinale, lymphogranuloma venereum, genital herpes simplex, chlamydia, trachomitis, genital human papilloma virus infection, syphilis, and human immunodeficiency virus
Who it binds, in our words: RCW 70.02.010 adopts this definition of sexually transmitted disease.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
RCW 26.26A.355 covers parentage genetic testing only. Genetic data is also consumer health data under chapter 19.373 RCW. RCW 49.44.180 bars employers from requiring genetic information.
Uniform Parentage Act: confidentiality of genetic testing, penalty. RCW 26.26A.355
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
for a purpose not relevant to a proceeding regarding parentage, without a court order or written permission of the individual who furnished the specimen, commits a gross misdemeanor
Who it binds, in our words: Specimens collected for parentage genetic testing. Reports of such testing are released under chapter 70.02 RCW.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Yes. You can sue over unlawful collection, use or sharing of medical records or health data in general.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Two routes: RCW 70.02.170 for medical records held by providers, and chapter 19.373 RCW through the Consumer Protection Act for consumer health data.
Damages a court may award: None fixed. RCW 70.02.170: actual damages, no consequential or incidental damages, attorneys' fees to the prevailing party. RCW 19.86.090 (for chapter 19.373 violations): actual damages, court may raise to three times actual damages, capped at $25,000 for RCW 19.86.020 violations, plus attorney's fee.
Uniform Health Care Information Act: civil remedies. RCW 70.02.170
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
A person who has complied with this chapter may maintain an action for the relief provided in this section against a health care provider or facility who has not complied with this chapter.
Who it binds, in our words: Health care providers and facilities. Two-year limit after discovery.
My Health My Data Act: application of consumer protection act. RCW 19.373.090
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
A violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.
Who it binds, in our words: Regulated entities, small businesses and any person under chapter 19.373 RCW.
Consumer Protection Act: civil action for damages. RCW 19.86.090
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Any person who is injured in his or her business or property by a violation of RCW 19.86.020
Who it binds, in our words: Any person injured in business or property may bring a civil action in superior court.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Both medical information and health insurance numbers are personal information since Laws of 2019 ch. 241 took effect March 1, 2020. AG notice is due within 30 days for breaches over 500 residents.
Deadline to tell people: Without unreasonable delay and no more than 30 calendar days after discovery.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Data breach definitions: personal information, health insurance element. RCW 19.255.005(2)(a)(i)(G)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Health insurance policy number or health insurance identification number
Who it binds, in our words: Element counts when combined with the consumer's name, per the personal information definition.
Data breach definitions: personal information, medical element. RCW 19.255.005(2)(a)(i)(H)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Any information about a consumer's medical history or mental or physical condition or about a health care professional's medical diagnosis or treatment of the consumer
Who it binds, in our words: Element counts when combined with the consumer's name, per the personal information definition.
Personal information: notice of security breaches. RCW 19.255.010(7), (8)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Notification to affected consumers under this section must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered
Who it binds, in our words: Persons or businesses that own or license data. AG notice when a breach requires notice to more than 500 Washington residents.
Federal law: covered entities. RCW 19.255.030(1)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
is deemed to have complied with the requirements of this chapter with respect to protected health information if it has complied with section 13402 of the federal health information technology for economic and clinical health act
Who it binds, in our words: HIPAA covered entities. They must still notify the attorney general under RCW 19.255.010(7).
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
One of the three rules is in force. A licensed clinician decides, not AI alone.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Laws of 2026 ch. 157 requires a licensed clinician to deny prior authorization on medical necessity. No in-force AI disclosure or AI-specific human recourse rule for care found. A later version starts January 1, 2027.
You must be told when AI is used in your care: not found.
A licensed clinician decides, not AI alone: in force.
You can reach a human, or have a human review the decision: not found.
Related limit on AI (recorded, not counted in the answer): RCW 48.43.830(3)(a): "Artificial intelligence shall not be the sole means used to deny, delay, or modify health care services."
Related limit on AI (recorded, not counted in the answer): RCW 48.43.830(3)(a): "Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity."
Prior authorization: standards, denials (effective until January 1, 2027). RCW 48.43.830(3) (Laws of 2026 ch. 157 sec. 2)
In force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Only a licensed physician or a licensed health professional working within their scope of practice may deny a prior authorization request based on medical necessity.
Who it binds, in our words: Carriers offering health plans, and health care benefit managers doing prior authorization for them. Laws of 2026 ch. 157 sec. 4 sets parallel rules for public employee plans (RCW 41.05.845).
Prior authorization: standards, denials (effective January 1, 2027). RCW 48.43.830 (Laws of 2026 ch. 157 sec. 3)
Signed, not yet in force · effective · read October 3, 2026 · source(app.leg.wa.gov)
Artificial intelligence shall not be the sole means used to deny, delay, or modify health care services.
Who it binds, in our words: Same scope. Later version of the section.
Second check by a separate agent: confirmed.
Rights in practice: the setting
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
7.8%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
96.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
92.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
6.2%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$90,325 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
4.9%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.9%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
20.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
10.5%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
