Washington's Healthcare AI Laws: My Health My Data, SB 5395 and HB 2225

Four, none of them called an AI act, and it is easy to look for the wrong thing.

Washington considered and rejected a general high risk AI statute in 2026. HB 2157 and SB 6284, both of which would have created Colorado style duties for developers and deployers of high risk systems and named healthcare among them, died in committee. What passed instead was targeted: a payer side rule on AI in prior authorization (E2SSB 5395), a chatbot rule (ESHB 2225), and a provenance rule for generative media (E2SHB 1170) that rarely touches a clinic.

Underneath those sits the law that already applied. The My Health My Data Act, chapter 19.373 RCW, has governed consumer health data outside HIPAA since March 31, 2024 and is the strictest consumer health data statute in the country because it carries a private right of action. RCW 9.73.030 requires the consent of all participants before a private conversation or call is recorded, which is the operative rule for every ambient scribe and AI phone agent in the state. Chapter 70.02 RCW, the Uniform Health Care Information Act, governs what a provider may disclose to a vendor. And the Uniform Disciplinary Act is how the Washington Medical Commission would reach a clinician who let an AI output into the chart unreviewed.

So the honest answer to the buyer's question is that Washington's healthcare AI law in 2026 is mostly older law applied carefully, plus one new statute that helps providers rather than binding them. That is a different shape from Colorado, which regulates the decision, or Texas, which regulates purpose and asks for disclosure. The state by state map shows where Washington sits among them.

Not the clinical ones, and yes to almost everything around them. The exemption is drawn around information, not around organisations, and that distinction decides the answer for each tool.

RCW 19.373.100(1)(a) exempts protected health information under HIPAA, health care information collected, used or disclosed under chapter 70.02 RCW, and 42 CFR Part 2 data. Subsection (1)(b) then exempts information originating from and intermingled to be indistinguishable with that data when it is maintained by a covered entity, a business associate, or a health care facility or provider. A scribe transcribing a visit under a business associate agreement, a prior authorization agent reading the chart, an inbox triage tool: all of that is PHI and outside the act.

What is inside the act is the data a clinic or its vendors collect before someone is a patient or outside the treatment relationship. RCW 19.373.010 defines consumer health data as personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status, and it expressly includes data derived or extrapolated from nonhealth information by any means, including algorithms or machine learning, biometric data including voice recordings, and precise location information that could indicate an attempt to receive health services. That catches a symptom checker on the public website, a marketing chatbot, ad pixels, a wellness app offered to the community, and a call recording made of a caller who never becomes a patient.

For that data the duties are real. RCW 19.373.030 bars collection except with consent for a specified purpose or to the extent necessary to provide a product or service the consumer requested, and sharing needs a separate and distinct consent. RCW 19.373.070 bars any sale without a valid authorization. RCW 19.373.080 makes it unlawful to implement a geofence around any entity providing in person health care to identify or track consumers, collect their data, or send them messages or advertisements. And RCW 19.373.090 makes every violation a per se Consumer Protection Act violation, which is what gives patients and their lawyers standing.

Two consequences for procurement. First, ask each vendor which of its processing sits inside your business associate agreement and which does not, because the second category is where this act lives. Second, do not rely on de-identification unless it meets the HIPAA standard in 45 CFR Part 164 and is derived from the exempt data listed in the statute; a vendor's own de-identification of website or app data has to meet the act's separate definition, with safeguards and contractual flow downs. The Attorney General's FAQ on the act confirms that inferred data such as a pregnancy prediction score is covered and that out of state processors must comply.

It means the recording announcement is a legal control, not a courtesy, and it has to be in the recording.

RCW 9.73.030(1) makes it unlawful for any individual, partnership, corporation or the state to intercept or record any private communication transmitted by telephone or other device, or any private conversation, without first obtaining the consent of all the participants. A clinical encounter and a patient call are private conversations. That is every participant, which in a consultation room includes the family member who came along.

Subsection (3) supplies the practical route. Consent is considered obtained whenever one party has announced to all other parties, in any reasonably effective manner, that the conversation is about to be recorded, provided that if the conversation is to be recorded the announcement is also recorded. Read that twice. A consent form signed at registration, on its own, is not the statutory route. The clinician or the agent has to say it, and the system has to capture the saying of it.

• For an ambient scribe: configure the workflow so the clinician's spoken statement that the visit is being recorded is captured at the head of the audio, and keep the written consent as the second layer, not the first. If a scribe discards audio after transcription, confirm that the announcement survives somewhere, because the statute expects it to be recorded.
• For an AI phone agent: the agent's opening line must announce recording and, since the caller may not yet be a patient, this is also the moment the My Health My Data Act attaches to the voice recording as biometric data. One opening statement can do both jobs and satisfy the Utah and California identification rules at the same time.
• For voiceprints: RCW 19.375 requires notice and consent before enrolling a biometric identifier, which includes a voiceprint used to identify a specific individual, for a commercial purpose. Raw audio and data generated from it are outside that definition, and HIPAA covered activity is excluded, so this bites on caller authentication features rather than on transcription.

The Washington Medical Commission has published nothing specific on recording clinical encounters, so there is no board guidance to lean on. The statute is the guidance.

It puts a licensed human between an algorithm and a denial, and it gives providers a new fact to demand on every adverse determination.

E2SSB 5395, chapter 157, Laws of 2026, amends RCW 48.43.830 and the parallel provision for public and school employee plans at RCW 41.05.845. The intent section states the purpose plainly: to ensure licensed physicians and licensed health professionals remain responsible for making determinations regarding treatments, prescription drugs and health care services. The operative language:

• Artificial intelligence shall not be the sole means used to deny, delay or modify health care services.
• Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity.
• Only a licensed physician or a licensed health professional working within their scope of practice may deny a prior authorization request based on medical necessity.
• A denial must include the credentials, board certifications and areas of specialty of the provider who had clinical oversight over the determination.
• A carrier using AI must base determinations on the individual's clinical history rather than group data alone, must not discriminate, and must subject the tools to audit and periodic performance review.
• By October 1, 2026 and annually thereafter, carriers report to the Insurance Commissioner, including the percentage of total denials that were aided by artificial intelligence.

The statute defines artificial intelligence broadly as the use of machine learning and related technologies that use data to train statistical models to perform tasks normally associated with human intelligence, including natural language processing and content generation, so a payer cannot argue its tool is merely a rules engine.

Nothing in it binds a clinic. The existing timelines in RCW 48.43.830 remain: three calendar days for a standard electronic request, one for expedited electronic, five and two for non electronic. What changes is your leverage. Every denial from a state regulated plan or a PEBB or SEBB plan now has to name a human with credentials, and a denial that cannot show clinical oversight is defective on its face. Build that check into your prior authorization workflow: when a denial arrives, capture the reviewer credentials, compare specialty to the service, and route anything that fails straight to appeal. Self funded ERISA plans and Medicare Advantage are outside the state statute, so your denial analytics should tag plan type before drawing conclusions.

The Insurance Commissioner had not, as of September 2026, published rulemaking to implement the AI provisions. Watch for it, because the definitions of human review and clinical oversight will be settled there.

It can, and the drafting gives a provider no automatic exit.

ESHB 2225, chapter 168, Laws of 2026, takes effect on January 1, 2027. It defines an AI companion chatbot as an artificial intelligence system with a natural language interface that provides adaptive, human like responses to user inputs, including by exhibiting anthropomorphic features, and is able to sustain a relationship across multiple interactions. The exclusions cover operational and customer service bots that do not sustain relationships or elicit emotional responses, video game characters that cannot discuss mental health, self harm or sexual content, voice assistants and narrowly tailored educational tools. There is no exclusion for healthcare providers, HIPAA covered entities or licensed clinicians.

A scheduling bot, an intake agent or a symptom router is outside the definition because it does not sustain a relationship. A between session support companion, a mood check in agent that remembers the patient, or a recovery coaching bot offered by a behavioural health practice is inside it. For those, the duties are:

• A clear and conspicuous disclosure that the chatbot is artificially generated and not human, at the start and at least every three hours, and at least every hour for minors, with additional anti manipulation and sexual content controls for minors.
• A maintained and implemented protocol for detecting and addressing suicidal ideation or expressions of self harm, including referral to a suicide hotline or crisis text line.
• Annual public disclosure of the number of crisis referral notifications issued to users in the preceding calendar year.

Section 6 makes a violation a per se Consumer Protection Act violation, so both the Attorney General and private plaintiffs can enforce it. This is the same mechanism New York used in General Business Law article 47, and the two statutes are close enough that a single companion design can satisfy both.

Washington did not follow Nevada, Illinois or Utah in restricting AI therapy itself. There is no Washington statute that says an AI may not deliver psychotherapy. What there is instead is the Uniform Disciplinary Act, under which a licensee who lets a chatbot do the clinical work is exposed for negligence or failure to supervise, and the Medical Commission's draft policy position that failure to apply human judgement to any AI output is a professional violation. For a practice the effect is similar: AI can support the clinician, not replace them.

Informed consent where reasonably possible, human judgement over every output, and no relaxation of the records and privacy duties. That is a draft position rather than an adopted policy, and the difference matters less than it sounds.

The Commission's July 19, 2024 business meeting packet carried a proposed policy on artificial, assistive and augmented intelligence which the committee recommended for Department of Health Secretary review. Its central sentences: AI may be used as a tool in the practice of medicine by practitioners; when reasonably possible a practitioner using AI should seek to obtain informed consent from the patient in advance and provide the option to receive treatment without AI; the use of AI neither decreases a practitioner's duty to protect privacy nor alters the basic purpose of patient medical records; and, adopting the Federation of State Medical Boards' April 2024 position, failure to apply human judgement to any output of AI is a violation of a physician's professional duties. As of September 2026 the Commission's policies page lists no adopted AI policy, so treat this as the direction of travel rather than a rule. Checked September 2026.

The enforceable hooks are older. RCW 18.130.180 defines unprofessional conduct to include incompetence, negligence or malpractice that creates an unreasonable risk that a patient may be harmed, misrepresentation or fraud in the conduct of the profession, and failure to adequately supervise auxiliary staff to the extent that the consumer's health or safety is at risk. An unreviewed scribe note that misstates a medication, or an intake agent that presents itself as a nurse, maps onto those without any new rule.

Chapter 70.02 RCW is the disclosure side. RCW 70.02.020 bars disclosure of health care information without written authorization except as the chapter permits, and RCW 70.02.050 permits disclosure to a person providing health care to the patient and to a person who requires it for administrative, quality assurance or similar services, provided the recipient will not use it for any other purpose and will take appropriate steps to protect it. That is the state law footing for a scribe or analytics vendor, alongside the federal business associate agreement described in our HIPAA and AI page. RCW 70.02.170 gives patients a civil action for violations with attorney fees, which is another reason the vendor contract should mirror the statutory language on purpose limitation.

The Commission is also the body most likely to ask, after a complaint, what your practice's written position on AI was. If you do not have one, the AI policy template for medical practices is the fastest route to something defensible.

The general framework, twice, and the employment rules. What survives is targeted, and the Task Force's own scorecard tells you what comes back.

The Task Force's final report of July 1, 2026 lists governance of high risk AI systems as a recommendation that was included in HB 2157 and SB 6284 and not enacted. Washington runs a short session in even years and a long one in odd years, so a fuller high risk bill in 2027 is the realistic expectation, and healthcare will be named in it as it was in both 2026 bills and in Executive Order 24-01.

Three other things to watch. The Insurance Commissioner's implementation of SB 5395, which will define human review. The first carrier AI denial statistics after October 1, 2026, which will be public and will change appeal strategy. And the Medical Commission's AI policy, if it moves from draft to adopted. The healthcare AI law checker is updated as those land.

Seven items, ordered by how quickly they close real exposure.

1. Put the recording announcement in the recording. RCW 9.73.030(3) is satisfied by an announced and recorded statement. Configure scribes and phone agents so the announcement is the first thing captured, and keep written consent as backup.
2. Sort every AI vendor's processing into inside and outside the BAA. Inside is PHI and exempt from the My Health My Data Act. Outside, including website chatbots, marketing tools, community apps and recordings of non patients, needs consent for collection, separate consent for sharing, and a published consumer health data privacy policy.
3. Kill any geofenced marketing. RCW 19.373.080 bans geofences around in person care sites for tracking, collection or advertising, with no consent exception.
4. Gate AI output behind clinician review and say so in policy. The Medical Commission's draft position and RCW 18.130.180 make unreviewed AI content a discipline risk. Write the review step down.
5. Rebuild the denial intake for SB 5395. Capture reviewer credentials on every adverse determination from a state regulated or PEBB and SEBB plan, check specialty against service, and appeal anything that fails. Tag plan type so ERISA and Medicare Advantage denials are not measured against a state rule that does not reach them.
6. Classify any patient facing conversational agent against the HB 2225 definition before January 1, 2027. If it sustains a relationship across sessions, build the disclosure cadence and the self harm protocol now.
7. Check the vendor contract against chapter 70.02. Purpose limitation and protection language that mirrors RCW 70.02.050 is cheap to add and is what a court will look for under RCW 70.02.170.

Washington rewards the organisation that sorts its data flows precisely and punishes the one that assumes HIPAA covers everything, because the private right of action under the Consumer Protection Act means the enforcement decision is not the Attorney General's alone. Mapping those flows, writing the review controls and aligning them with Colorado, California and Texas in one programme is what our AI governance and compliance engagement does. It starts with a system inventory, usually from an AI readiness audit, and you can book a scoping call to see whether that is the right entry point.