Washington § 19.373.050 Data security practices.

Washington Statutes

§ 19.373.050 — Data security practices.

Washington § 19.373.050

Title 19BUSINESS REGULATIONS—MISCELLANEOUS

Ch. 19.373WASHINGTON MY HEALTH MY DATA ACT

This text of Washington § 19.373.050 (Data security practices.) is published on Counsel Stack Legal Research, covering Washington primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Wash. Rev. Code § 19.373.050 (2026).

Text

(1)Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity and a small business shall:

(a)Restrict access to consumer health data by the employees, processors, and contractors of such regulated entity or small business to only those employees, processors, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business; and

(b)Establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's or the small business's

Free access — add to your briefcase to read the full text and ask questions with AI

(1) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity and a small business shall:

(a) Restrict access to consumer health data by the employees, processors, and contractors of such regulated entity or small business to only those employees, processors, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business; and

(b) Establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's or the small business's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the consumer health data at issue.

(2) A small business must comply with this section beginning June 30, 2024.