Skip to content
Network USA

WA · Breach notification statute

Washington data breach notification law

A summary of the Washington breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

This state has 2 separate breach notification statutes

Private Sector: RCW 19.255 (Personal Information: Notice of Security Breaches) (amended

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

30 days Washington requires businesses to notify affected consumers in the most expedient time possible

Attorney general notice

Yes Washington requires Attorney General notification when breaches affect more than 500 Washington

What counts as a breach

In Washington 'breach of the security of the system' means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business. Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system when the personal information is not used or subject to further unauthorized disclosure. 1

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Washington

187 reports to HHS OCR affecting 23,291,258 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Washington.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Premera Blue CrossHealth Plan11,000,000Mar 17, 2015Hacking/IT IncidentArchive (closed)
Navia Benefit Solutions, Inc.Business Associate2,151,330Mar 18, 2026Hacking/IT IncidentUnder investigation
Fred Hutchinson Cancer CenterHealthcare Provider1,840,927Dec 22, 2023Hacking/IT IncidentArchive (closed)
UW MedicineHealthcare Provider973,024Feb 20, 2019Hacking/IT IncidentArchive (closed)
MCG Health, LLCBusiness Associate793,283Jun 10, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Washington businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Washington timing rule as: "30 days Washington requires businesses to notify affected consumers in the most expedient time possible". (Source: PRC 2026 survey extract.)

Does Washington require notice to the attorney general?

The PRC 2026 extract notes: "Yes Washington requires Attorney General notification when breaches affect more than 500 Washington". (Source: PRC 2026 survey extract.)

Does the Washington law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Washington breach law.

Does the Washington law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Washington breach law.

Does the Washington law cover paper records?

No. The PRC 2026 survey records the Washington law as covering computerised data only, not paper records.

Is there a private right of action in Washington?

Yes. The PRC 2026 survey records a private right of action under the Washington breach law.

Is credit monitoring required in Washington?

No. The PRC 2026 survey does not record a credit monitoring requirement in Washington.

How does the Washington law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Washington statute, and see our HIPAA vs state breach notification laws guide.

Sources