Reputation MedicsReputation Medics™TRUST RESTORED

Last updated Oct 22, 2026

Washington

This guide is general educational information, not legal advice, and it does not create a lawyer-client relationship. Laws change and their application depends on specific facts. It does not promise any outcome, including removal of any review, any settlement, fine or successful claim. Consult a qualified lawyer licensed in your state before acting.

What a provider can and can't say in Washington

The national baseline below is the research's illustrative example, not a template that has been cleared for your practice. The state bullets and the practice-type rows are the rules this research recorded for this jurisdiction.

Illustrative only, not guaranteed legally safe; have a qualified lawyer review any template before use: "Thank you for your feedback. We take every concern seriously, but privacy rules prevent us from discussing anyone's care online. Please call our office manager at [phone] so we can talk directly." Do not confirm that the reviewer is a patient and do not mention treatment details. [F-007, F-024]
HIPAA is not a tool for removing criticism. It limits what covered practices may disclose; it does not restrict what patients may say about their own care. A practice cannot use HIPAA to force a review down. [F-007, F-003]

Review-response rule by practice type

Practice categoryHIPAA statusApplies without HIPAA?Review-response rule source
Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notYes - applies to licensed providers regardless of HIPAA status70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception
Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notYes - applies to licensed providers regardless of HIPAA status70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception
General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsYes - applies to licensed providers regardless of HIPAA status70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception
Medical med spaDepends; cash-only med spas often not coveredYes - applies to licensed providers regardless of HIPAA status70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception
Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)70.02 applies to state-licensed health care providers; estheticians (RCW 18.16) unresolved; MHMDA applies70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception
  • Consumer privacy and health data law: Washington has a consumer health data law (MHMDA RCW 19.373) but no general consumer privacy law. It exempts only HIPAA-protected health information (a data-level exemption), so a covered practice's other data, such as website or marketing data, can still fall under it. [WA-001, WA-003]
  • Data breach notification: Its data breach notification law covers medical information. Regulator notice: attorney general if more than 500 residents affected; HIPAA covered entities deemed compliant but must notify attorney general. [WA-008]
  • Patient confidentiality duties: Patient confidentiality duties come mainly from a medical-confidentiality statute (70.02). [WA-006]
  • Patient confidentiality duties: The state confidentiality law applies to licensed providers (Statute plus 18.130.180(19)). [WA-006, WA-009]
  • Lawsuits by individuals: Patients may be able to sue in some situations (70.02.170; MHMDA via CPA). [WA-007, WA-005]
  • Photos, names and likeness: A statute limits using a person's name or likeness in advertising without consent (RCW 63.60). [WA-012]
  • Med spa rules: Med spas: no med-spa-specific statute was found, but binding rules govern who may perform or supervise cosmetic medical procedures (binding delegation rule). [WA-010]
  • Enforcement located: Strongest state enforcement evidence located: allegations or media reports only (E3). Not finding enforcement does not mean none exists. [WA-011]

Sources:

*Educational information, not legal advice. Last reviewed October 22, 2026.*

State comparison

All 5 rows from the research matrix are in this table. Filters and sorting run in the browser after the page loads. Statutory maximums are ceilings, not typical outcomes.

Cosmetic and aesthetic privacy comparison for 50 states and the District of Columbia, current as of Oct 22, 2026
Washington (WA)Cosmetic/plastic surgeryDepends: covered only if it conducts HIPAA standard electronic transactions (incl. via billing agent); many cash-only cosmetic surgeons are notRCW 70.02.020 (written authorization required); UDA RCW 18.130.180(19)Yes - applies to licensed providers regardless of HIPAA statusMy Health My Data Act RCW 19.373 (data-level exemptions only; applies to HIPAA entities' non-PHI data)RCW 19.255: medical info covered; 30 days; AG if >500; HIPAA CEs deemed compliant but must notify AG70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception70.02 written authorization; MHMDA consent for consumer health data; RCW 63.60 consent for commercial useRCW 63.60 ($3,000 civil penalty + actual damages + profits)Yes: RCW 70.02.170 (actual damages + fees); MHMDA via CPA 19.86.090 (treble up to $25,000); 63.60WA Medical Commission, Dental Quality Assurance Commission, Nursing Commission, DOH, DOL (estheticians), AGCPA: up to $7,500 per violation (+$5,000 enhancement); UDA disciplineE3 (MHMDA class action Maxwell v. Amazon - not health care provider); E4 (no AG MHMDA action located)High2026-10-22
Washington (WA)Cosmetic dentistryUsually yes if it files any electronic dental claims; cash-only dental is notRCW 70.02.020 (written authorization required); UDA RCW 18.130.180(19)Yes - applies to licensed providers regardless of HIPAA statusMy Health My Data Act RCW 19.373 (data-level exemptions only; applies to HIPAA entities' non-PHI data)RCW 19.255: medical info covered; 30 days; AG if >500; HIPAA CEs deemed compliant but must notify AG70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception70.02 written authorization; MHMDA consent for consumer health data; RCW 63.60 consent for commercial useRCW 63.60 ($3,000 civil penalty + actual damages + profits)Yes: RCW 70.02.170 (actual damages + fees); MHMDA via CPA 19.86.090 (treble up to $25,000); 63.60WA Medical Commission, Dental Quality Assurance Commission, Nursing Commission, DOH, DOL (estheticians), AGCPA: up to $7,500 per violation (+$5,000 enhancement); UDA disciplineE3 (MHMDA class action Maxwell v. Amazon - not health care provider); E4 (no AG MHMDA action located)High2026-10-22
Washington (WA)General medical/dermatology (elective cosmetic)Usually yes (insurance billing); covered status applies to all PHI incl. cash cosmetic patientsRCW 70.02.020 (written authorization required); UDA RCW 18.130.180(19)Yes - applies to licensed providers regardless of HIPAA statusMy Health My Data Act RCW 19.373 (data-level exemptions only; applies to HIPAA entities' non-PHI data)RCW 19.255: medical info covered; 30 days; AG if >500; HIPAA CEs deemed compliant but must notify AG70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception70.02 written authorization; MHMDA consent for consumer health data; RCW 63.60 consent for commercial useRCW 63.60 ($3,000 civil penalty + actual damages + profits)Yes: RCW 70.02.170 (actual damages + fees); MHMDA via CPA 19.86.090 (treble up to $25,000); 63.60WA Medical Commission, Dental Quality Assurance Commission, Nursing Commission, DOH, DOL (estheticians), AGCPA: up to $7,500 per violation (+$5,000 enhancement); UDA disciplineE3 (MHMDA class action Maxwell v. Amazon - not health care provider); E4 (no AG MHMDA action located)High2026-10-22
Washington (WA)Medical med spaDepends; cash-only med spas often not coveredRCW 70.02.020 (written authorization required); UDA RCW 18.130.180(19)Yes - applies to licensed providers regardless of HIPAA statusMy Health My Data Act RCW 19.373 (data-level exemptions only; applies to HIPAA entities' non-PHI data)RCW 19.255: medical info covered; 30 days; AG if >500; HIPAA CEs deemed compliant but must notify AG70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception70.02 written authorization; MHMDA consent for consumer health data; RCW 63.60 consent for commercial useRCW 63.60 ($3,000 civil penalty + actual damages + profits)Yes: RCW 70.02.170 (actual damages + fees); MHMDA via CPA 19.86.090 (treble up to $25,000); 63.60WA Medical Commission, Dental Quality Assurance Commission, Nursing Commission, DOH, DOL (estheticians), AGCPA: up to $7,500 per violation (+$5,000 enhancement); UDA disciplineE3 (MHMDA class action Maxwell v. Amazon - not health care provider); E4 (no AG MHMDA action located)High2026-10-22
Washington (WA)Nonmedical aesthetic businessGenerally no (not a health care provider billing electronically)RCW 70.02.020 (written authorization required); UDA RCW 18.130.180(19)70.02 applies to state-licensed health care providers; estheticians (RCW 18.16) unresolved; MHMDA appliesMy Health My Data Act RCW 19.373 (data-level exemptions only; applies to HIPAA entities' non-PHI data)RCW 19.255: medical info covered; 30 days; AG if >500; HIPAA CEs deemed compliant but must notify AG70.02.020 bars disclosure without authorization; UDA (19) privilege betrayal; no review exception70.02 written authorization; MHMDA consent for consumer health data; RCW 63.60 consent for commercial useRCW 63.60 ($3,000 civil penalty + actual damages + profits)Yes: RCW 70.02.170 (actual damages + fees); MHMDA via CPA 19.86.090 (treble up to $25,000); 63.60WA Medical Commission, Dental Quality Assurance Commission, Nursing Commission, DOH, DOL (estheticians), AGCPA: up to $7,500 per violation (+$5,000 enhancement); UDA disciplineE3 (MHMDA class action Maxwell v. Amazon - not health care provider); E4 (no AG MHMDA action located)High2026-10-22

Cases this research tied to this jurisdiction

Settlements and consent orders resolve allegations. They are not court findings that the law was broken. Dollar amounts are the amounts recorded for that matter, not a prediction.

Maxwell v. Amazon.com, Inc.

W.D. Wash. No. 2:25-cv-00261 · WA · 2025-02-10

Provider type
Not health care (ad SDK)
Relevant facts
Alleged collection of consumer health data via SDK without MHMDA consent
Legal issues
RCW 19.373 (MHMDA), CPA
Holding, findings, allegations or settlement terms
Allegations only; consolidated (terminated on docket 2025-04-14); reported voluntarily dismissed
Consequences recorded
None / unknown
Procedural status
Consolidated 2025-04-14 into In re Amazon Ads SDK Litigation, No. 2:25-cv-00252-BJR (W.D. Wash.), which terminated 2025-06-06 per docket metadata; reported voluntary dismissal not read in a primary document (V-014). No merits ruling.
Precedential?
No (settlement/administrative/allegation)
Why it is in this research
First MHMDA private suit

Primary source

Related pages

Topics

Reference

Healthcare industry

Sources

  1. WA-001. RCW 19.373.010, .030

    My Health My Data Act: 'consumer health data' includes information on health-related surgeries or procedures and inferred health data; regulated entities need consent to collect and separate consent to share, beyond what is necessary to provide the requested product/service.

    Statute · Explicit · High · Applies to non-HIPAA aesthetic businesses, med spas, cash practices.

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373

  2. WA-003. RCW 19.373.070

    Selling consumer health data requires a signed valid authorization with specified elements, expiring within one year.

    Statute · Explicit · High

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070

  3. WA-008. RCW 19.255.005, .010, .030

    Breach law covers medical information and health insurance numbers; consumer and AG notice (if >500 residents) within 30 days; HIPAA covered entities deemed compliant if they comply with HITECH but must notify the AG.

    Statute · Explicit · High

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.255

  4. WA-006. RCW 70.02.010, .020

    Uniform Health Care Information Act: providers may not disclose health care information without written authorization except as authorized; 'health care' includes care affecting the structure or any function of the body.

    Statute · Explicit · High · Applies to any state-licensed/certified provider, HIPAA-covered or not.

    https://app.leg.wa.gov/RCW/default.aspx?cite=70.02

  5. WA-009. RCW 18.130.180(3),(7),(19)

    Uniform Disciplinary Act: willful betrayal of a practitioner-patient privilege, false advertising, and violation of statutes regulating the profession are unprofessional conduct for all health professions.

    Statute · Explicit · High · Covers DOH-regulated health professions; estheticians are licensed under RCW 18.16 by the Dept. of Licensing, so the UDA likely does not reach them (inference; verify).

    https://app.leg.wa.gov/RCW/default.aspx?cite=18.130.180

  6. WA-007. RCW 70.02.170

    Private civil action under 70.02 for actual damages (not consequential/incidental) and reasonable attorneys' fees; 2-year limitation from discovery.

    Statute · Explicit · High

    https://app.leg.wa.gov/RCW/default.aspx?cite=70.02.170

  7. WA-005. RCW 19.373.090; RCW 19.86.090, .140

    MHMDA violations are per se unfair/deceptive under the CPA, enabling AG enforcement and private suits.

    Statute · Explicit · High · Private plaintiffs must still prove CPA injury to business or property (Hangman Ridge elements; not separately verified here).

    https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.090

  8. WA-012. RCW 63.60.050, .060

    Unauthorized commercial use of a name, voice, signature, photograph, forged digital likeness, or likeness: civil penalty of $3,000 plus actual damages and attributable profits; injunctions and fees available.

    Statute · Explicit · High · Applies to any business, medical or not.

    https://app.leg.wa.gov/RCW/default.aspx?cite=63.60

  9. WA-010. WAC 246-919-606

    Physician delegation of nonsurgical medical cosmetic procedures (injectables) requires physician training, exam/consent, written protocols, delegate competence, and physician availability rules.

    Regulation · Explicit (via search extract of official page) · Medium · Scope law, not privacy.

    https://app.leg.wa.gov/wac/default.aspx?cite=246-919-606

  10. WA-011. Maxwell v. Amazon.com, Inc., No. 2:25-cv-00261 (W.D. Wash.)

    First MHMDA class action (Maxwell v. Amazon.com) was filed Feb 10, 2025 and consolidated on Apr 14, 2025 into In re Amazon Ads SDK Litigation (No. 2:25-cv-00252-BJR), which terminated Jun 6, 2025 per docket metadata; reported voluntarily dismissed.

    Litigation (allegations) · Explicit (docket metadata) · Medium · Termination date from docket metadata (V-014); basis reported by secondary sources only; no merits ruling.

    https://www.courtlistener.com/docket/69628048/maxwell-v-amazoncom-inc/

  11. F-007. 45 CFR 164.502(a)

    Covered entities may not use or disclose PHI except as permitted or required by the Privacy Rule.

    Regulation · Explicit · High · No Privacy Rule exception permits disclosing PHI to rebut an online review; OCR's review cases cite 164.502(a).

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502

  12. F-024. HHS OCR resolution agreements

    OCR has resolved at least four review-response matters against dental/medical practices: Elite Dental ($10,000, 2019), UPI/Igbinadolor ($50,000 CMP, 2022), New Vision Dental ($23,000, 2022), Manasa Health Center ($30,000, 2023).

    Enforcement (resolution agreements / CMP) · Explicit · High · Resolution agreements include no admission of liability; UPI was a CMP after failure to respond (not a litigated judicial finding).

    https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

  13. F-003. 45 CFR 160.103

    PHI covers individually identifiable health information in any form or medium held by a covered entity or business associate; excludes FERPA and employment records and persons deceased >50 years.

    Regulation · Explicit · High

    https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103

  14. V-014. V-014

    This reference id is cited in the publication and is not a row in the claim register supplied with it.