What a Washington business has to have in writing

Write and send notice to every affected Washington resident within 30 calendar days of discovering that unsecured personal information was acquired without authorization, in the plain-language format the statute prescribes, naming the data types involved, the dates, the response steps and the contact points. Send the Attorney General a copy of the notice plus the resident count when more than 500 Washington residents are notified, within the same 30 days.

Take all reasonable steps to destroy, or to arrange the destruction of, personal financial and health information and government-issued personal identification numbers in records you are disposing of and will not retain. In practice that means a documented retention and disposal routine you can show, because both individuals and the Attorney General can sue over a failure, with higher penalties where the failure was willful.

Maintain a consumer health data privacy policy that clearly and conspicuously discloses the categories of consumer health data collected and why, the categories of sources it comes from, the categories shared, a list of the categories of third parties and the specific affiliates it is shared with, and how a consumer exercises their rights. Publish a prominent link to that policy on the homepage. Do not collect, use or share any category or purpose the policy does not name without first disclosing it and getting affirmative consent, and do not contract with a processor to handle the data in a way that contradicts the policy.

Publish a standalone consumer health data privacy policy, linked prominently from the homepage, listing the categories of health data collected and why, the sources, what is shared, the categories of third parties and affiliates it goes to, and how consumers exercise their rights. Get separate affirmative consent before collecting or sharing anything outside that policy, obtain a signed valid authorization on the statute's terms before any sale, keep records of consents and authorizations, restrict employee and contractor access, and answer access, withdrawal and deletion requests within 45 days. Geofencing around health care facilities to track or advertise to people is prohibited.

Give clear notice and obtain consent, or provide a mechanism to prevent later commercial use, before enrolling anyone's biometric identifier in a database. Do not sell, lease or disclose the identifier without consent or a statutory exception, protect it with reasonable care measured against the industry standard, and keep it no longer than the purpose it was collected for requires.

Adopt a written sexual harassment policy, train managers, supervisors and isolated employees on preventing sexual assault, harassment and discrimination, on whistleblower protection and on how panic buttons work, hand out a resource list that includes the EEOC, the Washington Human Rights Commission and local advocacy groups, issue a panic button to every isolated employee, and keep records of the training and of the panic button purchases and use for the department on request.

Write an accident prevention program tailored to the actual hazards of the workplace. It must cover a safety orientation that describes the whole safety and health program, on-the-job orientation for each new assignment, how and when to report injuries and where first aid is, how to report unsafe conditions, the use and care of required PPE, emergency and evacuation steps, and the identification and safe handling of hazardous substances. Keep it current, and add the separate written programs any specific hazard rule triggers, such as hazard communication, respiratory protection or lockout-tagout.

Set up either a safety committee with employee-elected and employer-selected members that meets monthly, or, for a workplace of ten or fewer on a shift, hold a monthly safety meeting. Keep written minutes for each meeting for at least one year showing who attended, what was discussed and what corrective action was decided.

A procurement condition, not a certification a supplier holds in advance, and Washington runs no equivalent of TX-RAMP. A WaTech Security Design Review is required before an agency stands up a new IT implementation that uses agency-managed cloud services, vendor-managed cloud or dedicated hosting, or internet-facing services hosted on premise. The duties in the policy fall on the buying agency, which supplies the review checklists, an architecture diagram showing security controls and information flows, the risk assessment and the planned mitigations, and which must then agree to run the system as the review says. The supplier is pulled in through contract terms rather than the policy: Washington's participating addenda under the statewide cloud contract have the contractor warrant it will materially comply with statewide IT policies 141.10 and 188 and submit its product to a WaTech security design review before any state agency order is finally executed. Washington does not require FedRAMP, StateRAMP or GovRAMP authorization and is not a GovRAMP participating organization.

Accrue at least one hour of paid sick leave for every 40 hours worked, give each employee a one-time written notice of their sick leave rights (accrual rate, permitted uses, retaliation protection, carryover) no later than the start of employment, and then a written statement at least monthly showing leave accrued, used and available. Employers that set a policy on verification for absences over three days, or on shared leave or leave cash-out, must put that policy in writing and give it to employees.

Display the Employment Security Department's Paid Family and Medical Leave poster, report employee hours and wages and remit premiums each quarter, and give a written statement of Paid Family and Medical Leave rights to any employee who takes seven or more consecutive days off for a qualifying reason. Employers running a voluntary plan instead must have it approved in writing by the department.

Post the Labor and Industries poster set where employees can see and read it: Job Safety and Health Law, Your Rights as a Worker, and Notice to Employees If a Job Injury Occurs, plus the Paid Family and Medical Leave notice and the federal notices. Remote employees must be given physical access to the posters, not just a link.

State the wage scale or salary range, or the fixed wage if only one is on offer, plus a general description of benefits and other compensation, in every job posting, including postings placed through third parties. On request, give an employee offered an internal transfer or promotion the wage scale for that role. Postings made through July 27, 2027 get five business days to fix a defective posting after written notice.

File the Business License Application with the Department of Revenue's Business Licensing Service to get a Unified Business Identifier number and the state and city endorsements the business needs, register any trade name, renew the license annually, and file the separate entity formation documents with the Secretary of State for corporations and LLCs.

Disclose the terms of a noncompetition covenant in writing to a candidate no later than the moment they accept the job offer, and say in writing if the covenant will only become enforceable later once pay rises. A covenant signed after employment starts needs separate consideration, one enforced after a layoff needs the employee's base pay for the restricted period, and the restraint is presumed unreasonable beyond 18 months.

Hand over a complete free copy of an employee's or former employee's personnel file within 21 calendar days of a request, covering job applications, performance evaluations, closed disciplinary records, leave and accommodation records, payroll records and employment agreements. Within 21 days of a written request from a former employee, provide a signed written statement giving the effective discharge date, whether there was a reason and what it was.

Strip out of offer letters, handbooks, severance and settlement documents any clause that stops a worker from disclosing illegal discrimination, harassment, retaliation, wage-and-hour violations or unsafe conditions, and stop enforcing existing ones. Confidentiality of the settlement sum itself remains permissible.

Register with Labor and Industries before advertising or bidding, post a continuous surety bond and general liability insurance in the amounts set for the general or specialty class, renew every two years, and put the registration number on advertising, contracts, bids and vehicles. Residential work over the statutory dollar threshold needs a written contract with the disclosure statement the chapter requires.

Develop and implement a written workplace violence prevention plan, through the safety or workplace violence committee where one exists, covering the building's physical security, staffing patterns, lone-worker risks, job design, first aid and emergency procedures, how violent acts get reported, employee training and its rollout, high-risk units and shifts, parking and surrounding areas, and support for staff who were assaulted. Train every affected employee, keep records of violent acts for at least five years, and file the periodic data summary the chapter requires.

Make sure every food worker holds a valid Washington food worker card obtained from a local health jurisdiction after training and a test, keep the cards on file at the establishment, designate a person in charge who can demonstrate food safety knowledge, and hold the local health department's food establishment permit with a written food safety plan where the operation requires one.

Develop and implement written policies, standards and procedures for managing health information, consistent with the federal HIPAA privacy rules. They must limit access to staff who need the data for their jobs, provide employee training, set disciplinary measures for violations, identify the job titles authorized to disclose nonpublic personal health information, set procedures for authorizing and restricting collection, use and disclosure, cover access and amendment rights, cover handling, disclosure, storage and disposal, and provide for periodic monitoring of employee compliance. Send initial and annual privacy notices with opt-out to consumers, and notify the insurance commissioner in writing within two business days of deciding that a breach notice must go to customers.