Washington - My Health Data Act 

Consumer health data privacy policy.

(1) (a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity and a small business shall maintain a consumer health data privacy policy that clearly and conspicuously discloses: (i) The categories of consumer health data collected and the purpose for which the data is collected, including how the data will be used; (ii) The categories of sources from which the consumer health data is collected; (iii) The categories of consumer health data that is shared; (iv) A list of the categories of third parties and specific affiliates with whom the regulated entity or the small business shares the consumer health data; and (v) How a consumer can exercise the rights provided in RCW 19.373.040. (b) A regulated entity and a small business shall prominently publish a link to its consumer health data privacy policy on its homepage. (c) A regulated entity or a small business may not collect, use, or share additional categories of consumer health data not disclosed in the consumer health data privacy policy without first disclosing the additional categories and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data. (d) A regulated entity or a small business may not collect, use, or share consumer health data for additional purposes not disclosed in the consumer health data privacy policy without first disclosing the additional purposes and obtaining the consumer's affirmative consent prior to the collection, use, or sharing of such consumer health data. (e) It is a violation of this chapter for a regulated entity or a small business to contract with a processor to process consumer health data in a manner that is inconsistent with the regulated entity's or the small business's consumer health data privacy policy. (2) A small business must comply with this section beginning June 30, 2024. [2023 c 191

Collection or sharing of consumer health data. 

(1)(a) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity or a small business may not collect any consumer health data except: (i) With consent from the consumer for such collection for a specified purpose; or (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business. (b) A regulated entity or a small business may not share any consumer health data except: (i) With consent from the consumer for such sharing that is separate and distinct from the consent obtained to collect consumer health data; or (ii) To the extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business. (c) Consent required under this section must be obtained prior to the collection or sharing, as applicable, of any consumer health data, and the request for consent must clearly and conspicuously disclose: (i) The categories of consumer health data collected or shared; (ii) the purpose of the collection or sharing of the consumer health data, including the specific ways in which it will be used; (iii) the categories of entities with whom the consumer health data is shared; and (iv) how the consumer can withdraw consent from future collection or sharing of the consumer's health data. (d) A regulated entity or a small business may not unlawfully discriminate against a consumer for exercising any rights included in this chapter. (2) A small business must comply with this section beginning June 30, 2024. 

Application of consumer protection act

 The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

Data security practices

 (1) Except as provided in subsection (2) of this section, beginning March 31, 2024, a regulated entity and a small business shall: (a) Restrict access to consumer health data by the employees, processors, and contractors of such regulated entity or small business to only those employees, processors, and contractors for which access is necessary to further the purposes for which the consumer provided consent or where necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business; and (b) Establish, implement, and maintain administrative, technical, and physical data security practices that, at a minimum, satisfy reasonable standard of care within the regulated entity's or the small business's industry to protect the confidentiality, integrity, and accessibility of consumer health data appropriate to the volume and nature of the consumer health data at issue. (2) A small business must comply with this section beginning June 30, 2024.

Additional information regarding Washington's My Health Data Act can be found in 19.373 in the Washington State Legislature. 

RLC’s Policy

Real Life Counseling and Real Life Community Behavioral Health prioritize privacy and rigorously adheres to State/Federal Privacy Acts and the HIPAA Privacy Rule.Our company is committed to ensuring the privacy and security of our customer's personal information. This policy outlines the type of personal information we collect, how we use it, and the measures we take to protect it.

Information Collection and Use:

As a health care provider who accepts insurance, we collect enough information to allow us to bill one's insurance.

• Legal first and last name
• Legal gender
• Address
• Date of Birth
• Emergency Contact
• Contact information - Email and or phone number
• How information is collected
• Insurance ID and Group number

Data Protection:

We take the security of personal information seriously and employ security measures to protect against unauthorized access or disclosure. Personal information is stored in secure servers and is only accessible to authorized personnel.

Information Sharing:

We do not sell, trade, or rent personal information to third parties. This policy applies to all clients and visitors to our website. By submitting a request for care through our website, you are entrusting us with your information and authorizing our team to contact you and store your information. Real Life Counseling and Real Life Community Behavioral Health will not disclose a client's personal information to any entity or individual without the client's written consent. Any third party in contract with RLC or RLCBH mirrors our privacy policy through a BAA and is unauthorized to mine our client's EPHI.

Cookies:

Our website may use cookies to enhance the user experience and collect information about usage patterns. Users have the option to accept or decline cookies. However, declining cookies may limit the functionality of the website. All information is collected exclusively through our website. While cookies may store your information, using an incognito browser can prevent this from happening.

Changes to Policy:

We reserve the right to modify this privacy policy at any time. Any changes will be posted on our website with the updated effective date.

By using our website or providing personal information to us, you consent to the collection, use, and disclosure of personal information by this privacy policy.

If you have any questions or concerns about this privacy policy, please contact our front desk.