How Puget Sound dental, legal, and medical practices deploy AI chatbots and automation without running into Washington's health data, biometric, and consumer protection laws.
Washington is one of the most legally active states in the country on privacy and AI right now, yet it still has no single comprehensive consumer privacy law like California's CCPA or Colorado's CPA. A broad privacy bill has been introduced in some form nearly every year since 2021 and has stalled again in the current legislative session, mostly over whether consumers should have the right to sue directly.
That absence does not mean Washington is unregulated. It means the opposite. Instead of one general law, Washington has built a patchwork of narrow, sector-specific statutes that are often stricter than a general privacy law would be, plus a wave of new AI-specific bills passed in the 2026 legislative session. For a dental, legal, or medical practice deploying an AI chatbot, phone system, or automation platform, several different Washington laws can apply at the same time, depending on exactly what that system does.
This guide walks through each law that actually matters for a regulated Puget Sound practice, in plain English, then breaks down what changes specifically for dental, legal, and medical businesses.
The My Health My Data Act (MHMDA) is the single most consequential Washington privacy law for regulated local practices, and it is broader than most business owners expect. It covers consumer health data, defined as information that identifies a consumer's past, present, or future physical or mental health status, and it applies to any business operating in or targeting Washington residents, not just hospitals or clinics.
If your website chatbot, intake form, or voice agent asks a visitor about symptoms, treatment interest, a legal injury, a medical restriction, or any condition that could be tied to their health, and stores or passes along their contact details, you are very likely collecting consumer health data under MHMDA. That covers a dental scheduling bot asking what brings a patient in, a law firm intake bot asking about an accident, or a service business chatbot noting that a client has a health-related accommodation request.
The Act requires affirmative, opt-in consent before that data is collected, a separate consent before it is shared or sold, a dedicated consumer health data privacy policy linked from your homepage, and a way for people to access, delete, or withdraw consent for their data. Compliance deadlines already passed in 2024, including for small businesses, so there is no grace period left today. If MHMDA applies to your practice, it applies now.
Most dental and medical practices assume HIPAA already has this covered. It does not, not entirely. HIPAA governs protected health information handled by a "covered entity," your practice, and its "business associates" under a signed agreement. MHMDA is broader: it covers consumer health data collected by any business, regardless of HIPAA status, and it explicitly reaches marketing-adjacent tools, like a public website chatbot or lead-capture form, that HIPAA's business-associate framework may never touch if the vendor hasn't signed a Business Associate Agreement (BAA).
In practice, this means a practice can be fully HIPAA-compliant on its clinical systems and still have an MHMDA gap on its public-facing AI chatbot. Before deploying any AI tool that touches patient or visitor health information, ask your vendor directly whether they will sign a BAA where one is needed, and separately, whether their platform supports MHMDA's consent, access, and deletion requirements.
This is the rule most AI automation vendors never mention. Washington is an all-party consent state under RCW 9.73.030, one of the strictest wiretapping laws in the country. Recording or transcribing a phone call, including with an AI receptionist, AI voice agent, or call-scoring tool, requires every participant's consent, not just the practice's.
In practice, this is easy to satisfy: play a short recorded notice at the start of every call stating that it may be recorded or monitored, before the AI system starts processing it. A caller who stays on the line after hearing that notice has given valid consent under Washington law. Skipping this step is a criminal gross misdemeanor and opens the door to a private lawsuit, with damages of at least a hundred dollars a day up to a thousand dollars, plus attorney fees, for each violation.
Washington's biometric privacy law (RCW 19.375) requires notice and consent before enrolling someone's fingerprint, voiceprint, retina scan, or similar unique biological identifier in a database for a commercial purpose. It explicitly excludes plain photographs, video, and audio recordings, so simply recording or transcribing a call does not trigger this law by itself.
It becomes relevant the moment an AI system generates a voiceprint to identify or verify a specific caller, for example, matching a returning patient or client by voice rather than by name or phone number. If any AI vendor offers voice-based caller identification, ask directly whether it creates a biometric template, and build consent into that workflow before turning the feature on. Washington's Attorney General is the only enforcer here, with penalties up to $7,500 per violation.
Washington passed several AI-specific laws in the 2026 legislative session worth tracking, even though most will not immediately change how a typical dental, legal, or medical AI chatbot operates today.
Creates rules, including a mandatory disclosure and a private right of action, for AI companion chatbots: bots built to sustain an ongoing, human-like relationship and elicit emotional responses, similar to companion or wellness apps. Standard business chatbots used for scheduling, intake, or answering service questions are excluded, as long as they stay focused on that business purpose rather than acting like a relationship.
Introduces requirements, including impact assessments and consumer disclosure, for high-impact AI systems used in consequential decisions such as hiring, lending, insurance, or healthcare eligibility. Most day-to-day scheduling or lead-capture chatbots are unlikely to qualify as high-impact, but the definitions are still being clarified, so this is worth revisiting with counsel as the deadline approaches.
If a practice uses AI to monitor staff calls, transcripts, or productivity, this law requires advance written notice to employees specifying the form, purpose, and data use of that monitoring before it begins.
None of this should discourage a properly built AI chatbot or automation system. It means choosing a vendor who tracks these deadlines with you, rather than one who treats compliance as your problem to discover later.
Use this as a quick reference, not a substitute for a full review of your specific setup:
| AI Activity | Law That May Apply | What It Requires |
|---|---|---|
| Chatbot collects symptom, injury, or health info | My Health My Data Act | Affirmative opt-in consent, privacy policy, access/deletion rights |
| AI phone system records or transcribes calls | All-Party Consent Law (RCW 9.73.030) | Recorded disclosure at the start of every call |
| AI creates a voiceprint to identify a caller | Biometric Privacy Law (RCW 19.375) | Notice and consent before enrollment |
| AI sends automated texts or calls to leads | Federal TCPA | Prior express consent, easy opt-out |
| Chatbot acts like an ongoing personal relationship | AI Companion Chatbot Law (2027) | Non-human disclosure; standard business bots excluded |
| AI drives a high-impact, consequential decision | AI Accountability Act (2027) | Impact assessment, consumer disclosure, opt-out rights |
Dental practices sit at the center of Washington's health data rules because a scheduling chatbot asking "what brings you in today" is, functionally, collecting consumer health data. Three things matter most:
For the marketing side of dental growth, from new-patient acquisition to review automation, see the Dental Practice Marketing Guide.
Law firm AI intake raises two separate obligations that are easy to conflate. Washington's advertising ethics rules (RPC 7.1 through 7.5) govern how a firm markets itself and are covered in depth in the Law Firm Marketing Guide. This guide covers the separate question of data privacy:
Medical practices typically already have HIPAA-trained staff and business associate agreements for clinical systems, which is a real head start. The gap usually shows up on the public-facing side:
For patient acquisition and reputation strategy, see the Medical Practice Marketing Guide.
Before turning on any new AI automation for a dental, legal, or medical practice in Washington, run through this list:
Confirm whether your chatbot, intake form, or voice agent ever collects anything that reads as health information, and if so, get affirmative consent before collection, not just a privacy-policy mention.
Publish or update a consumer health data privacy policy linked from your homepage if MHMDA applies to you.
Add a recorded call disclosure to any AI phone or voice system before it starts processing a call.
Confirm with your AI vendor whether any feature creates a voiceprint or other biometric template, and get consent if it does.
Check that automated texts or calls to leads have documented, affirmative consent and an easy opt-out, consistent with the federal TCPA.
Calendar the January 1, 2027 deadlines for Washington's new AI accountability and companion chatbot rules, and revisit your setup before then.
This is exactly the gap AvioneX Digital Co. was built to close for Puget Sound practices. We are not a generic AI vendor bolting a chatbot onto your website and moving on. When we build AI chatbots or workflow automation for dental, legal, or medical practices, we configure consent capture, call disclosures, and data-handling settings around Washington's actual rules from day one, not as an afterthought after a complaint. That is what it means to be a local expert: knowing the difference between a general AI trend and the specific law that applies to a Kent dental office or a Tacoma law firm.
See exactly how your AI automation stacks up against Washington's rules, and what it would take to fix any gaps.
Book Free Audit →A free audit shows exactly where your current chatbot, phone system, or automation setup stands against Washington's privacy and AI rules, and what it would take to close any gaps.
Book Free Audit →