A consumer health data privacy policy, linked from the homepage
What the source requires
Washington requires a separate consumer health data privacy policy, and a link to it published prominently on the homepage. A general privacy policy does not satisfy this — the statute names a distinct document.
Why this is hard to satisfy
Practices have a privacy policy and assume it covers them. My Health My Data is enforceable through the Consumer Protection Act, which carries a private right of action, so this is the rare marketing rule a patient can sue over without a regulator deciding to act first.
What we do about it
The policy is generated from what the site actually collects, and the homepage link is emitted with it rather than added by hand afterwards.
In build · phase two
What this tier means
Same input, same verdict, every time — no model in the loop. This is the only tier where the word “verified” is literally true.