RCW 70.02.280: Health care providers and facilities—Prohibited actions.

A health care provider, health care facility, and their assistants, employees, agents, and contractors may not:

(1) Use or disclose health care information for marketing or fund-raising purposes, unless permitted by federal law; or

(2) Sell health care information to a third party, except:

(a) For purposes of treatment or payment;

(b) For purposes of sale, transfer, merger, or consolidation of a business;

(c) For purposes of remuneration to a third party for services;

(d) As disclosures are required by law;

(e) For purposes of providing access to or accounting of disclosures to an individual;

(f) For public health purposes;

(g) For research;

(h) With an individual's authorization;

(i) Where a reasonable cost-based fee is paid to prepare and transmit health information, where authority to disclose the information is provided in this chapter; or

(j) In a format that is deidentified and aggregated.