Washington State Abortion Reporting Privacy Laws for Clinics: Submitting Statistics Without Patient Names

Abortion Reporting Requirements in Washington

Who must report and when

All Washington hospitals and clinics that perform lawful induced abortions must submit a monthly report to the Department of Health (DOH) covering procedures from the prior month. This obligation also applies to physicians who perform an emergency abortion outside an approved facility, with an accompanying statement explaining the emergency determination. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))

What the report includes—and omits

The state’s Induced Termination of Pregnancy Report (ITOP) requires, for each abortion, data such as the patient’s age, geographic residence, pregnancy history, gestational duration, method, and any complications, along with the reporting physician’s name. Notably, the rule enumerates required elements and does not require patient names or other direct personal identifiers to be submitted to DOH. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))

Physician reporting obligations

Clinicians should ensure that physician-identifying details are supplied as required, while patient identity remains excluded. When an abortion is performed in a nonapproved setting due to a medical emergency, the physician must report in the same manner and include a clear, detailed statement of the facts supporting the emergency. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))

Aggregate Data Submission Practices

How Washington uses reported data

DOH compiles submitted ITOP records into statewide statistics and releases only aggregated abortion data (for example, annual counts and percentages by method). Public data products are de-identified and presented in the aggregate to prevent reidentification. ([doh.wa.gov](https://doh.wa.gov/sites/default/files/2024-02/422-239-WAOccurrenceAbortionMedicalProcedures2001-2022.pdf?utm_source=openai))

Clinic-facing good practices

• Use the DOH-prescribed categories (e.g., age in years, method types, gestational duration) and avoid free-text fields that might inadvertently include personal details.
• When sharing figures outside mandatory state reporting (e.g., grant reporting), publish only aggregate counts and rates; suppress very small cells that could enable reidentification in small communities.

Confidentiality and Disclosure Restrictions

What the state may disclose

Washington law prohibits DOH from publicly releasing abortion information in a way that identifies any individual without consent (except by subpoena) or that identifies a facility, except in certificate-of-approval proceedings. This is the cornerstone confidentiality mandate governing ITOP data. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-110))

Baseline health information privacy

Separately, Washington’s Uniform Health Care Information Act restricts health care providers from disclosing patient health information without patient authorization, reinforcing that abortion-related clinical records stay confidential outside of the required statistical reporting. ([apps.leg.wa.gov](https://apps.leg.wa.gov/rcw/default.aspx?cite=70.02.020&utm_source=openai))

Health Data Privacy Protections under My Health My Data Act

Scope and consent requirements

Washington’s My Health My Data Act (Chapter 19.373 RCW) adds obligations for entities that collect “consumer health data” outside HIPAA. It requires clear, prior consent for collecting or sharing such data, a posted health data privacy policy, and limits on selling consumer health data. For most regulated entities, key provisions took effect March 31, 2024; for small businesses, June 30, 2024. ([lawfilesext.leg.wa.gov](https://lawfilesext.leg.wa.gov/law/RCW/RCW%20%2019%20%20TITLE/RCW%20%2019%20.373%20%20CHAPTER/RCW%20%2019%20.373%20.030.htm?utm_source=openai))

Operational takeaways for clinics

• Audit non-HIPAA data flows (e.g., websites, apps, analytics, geolocation) to ensure consent and disclosures meet RCW 19.373 standards.
• Honor consumer rights (access, deletion) for covered consumer health data maintained outside HIPAA systems.
• Avoid prohibited geofencing around facilities for health-related targeting. ([app.leg.wa.gov](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&utm_source=openai))

Shield Law Safeguards for Providers and Patients

Protections against out-of-state actions

Washington’s Shield Law (Chapter 7.115 RCW) protects providers, patients, and helpers when abortion and gender-affirming care are lawful in Washington. It restricts cooperation with out-of-state investigations, limits subpoenas and discovery, and creates a civil cause of action for interference with protected health care services. ([app.leg.wa.gov](https://app.leg.wa.gov/RCW/default.aspx?cite=7.115&full=true&utm_source=openai))

What this means for clinic operations

• Respond to any out-of-state request for records or testimony only after legal review under the Shield Law framework.
• Train staff on referral of legal process to counsel and on documentation practices that avoid nonessential disclosures. ([app.leg.wa.gov](https://app.leg.wa.gov/RCW/default.aspx?cite=7.115&full=true&utm_source=openai))

Procedures for Reporting Without Patient Identifiers

Practical step-by-step for compliant submissions

1. Use the state-supplied ITOP form and collect only the data elements the rule requires (age, geographic residence, pregnancy history, gestational duration, method, complications, physician name, and dates). ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))
2. Exclude direct patient identifiers from the report (e.g., name, full street address, SSN, MRN, full dates of birth). Maintain any clinical identifiers only in your internal medical record, subject to Washington health information privacy laws. ([apps.leg.wa.gov](https://apps.leg.wa.gov/rcw/default.aspx?cite=70.02.020&utm_source=openai))
3. Submit during the month following the reporting period, using the process and formats prescribed by DOH. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))
4. Document emergency abortions performed in nonapproved settings with a concise factual statement supporting the emergency determination. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))
5. For any public or external sharing, rely on aggregate data only, applying small-number suppression and avoiding sub-state geography that could reveal identities. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-110))
6. Harden non-HIPAA data practices (web trackers, analytics, marketing systems) to meet My Health My Data Act consent and disclosure requirements. ([lawfilesext.leg.wa.gov](https://lawfilesext.leg.wa.gov/law/RCW/RCW%20%2019%20%20TITLE/RCW%20%2019%20.373%20%20CHAPTER/RCW%20%2019%20.373%20.030.htm?utm_source=openai))

Conclusion

In Washington, clinics meet their legal duties by submitting timely ITOP statistics while excluding patient identifiers, relying on DOH aggregation for public reporting, and honoring strict confidentiality rules. Layer in My Health My Data Act safeguards for non-HIPAA data and apply the Shield Law’s protections when facing out-of-state legal demands, and your compliance program will be both lawful and privacy-first. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))

FAQs

What patient information is excluded in abortion statistics reporting?

Washington’s ITOP rule lists the data that must be reported and does not require patient names or other direct identifiers. DOH is further barred from publicly disclosing information in a manner that could identify an individual, and state guidance treats names, SSNs, medical record numbers, and granular dates as direct identifiers that are excluded from confidential files. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-100))

How does Washington ensure confidentiality in abortion data reporting?

By statute and rule, DOH may not publicly release abortion information in a form that identifies any individual or facility (with narrow exceptions such as subpoena or certificate-of-approval proceedings). Public outputs are aggregated, and providers must separately comply with Washington’s health information confidentiality law. ([app.leg.wa.gov](https://app.leg.wa.gov/WAC/default.aspx?cite=246-490-110))

What legal protections exist under the Shield Law?

The Shield Law limits Washington’s cooperation with out-of-state actions targeting lawful abortion care provided here, restricts subpoenas and discovery for such cases, and creates a civil cause of action for interference with protected health care services—safeguarding clinics, patients, and those who assist them. ([app.leg.wa.gov](https://app.leg.wa.gov/RCW/default.aspx?cite=7.115&full=true&utm_source=openai))

How does the My Health My Data Act impact abortion data privacy?

It requires clear consent before collecting or sharing consumer health data outside HIPAA, mandates a published privacy policy, and grants consumers rights such as access and deletion. Most entities had to comply beginning March 31, 2024; small businesses on June 30, 2024—deadlines clinics should reflect in their web, app, and marketing data practices. ([lawfilesext.leg.wa.gov](https://lawfilesext.leg.wa.gov/law/RCW/RCW%20%2019%20%20TITLE/RCW%20%2019%20.373%20%20CHAPTER/RCW%20%2019%20.373%20.030.htm?utm_source=openai))