# WAC 308-10A-201: WAC 308-10A-201. Recipient compliance requirements

> Washington · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_201

## Section

- **Citation:** WAC 308-10A-201
- **Heading:** WAC 308-10A-201. Recipient compliance requirements
- **Jurisdiction:** Washington
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Washington Administrative Code / Title 308 / Chapter 308-10A / Section 308-10A-201

## Text

(1) Audits - For a recipient receiving protected personal information:
(a) A recipient receiving recurring lists of protected personal information must undergo data security and permissible use audits as outlined in the data sharing agreement.
(b) A recipient receiving a one-time list containing protected personal information must demonstrate security controls are in place to protect the information and may be required to undergo audits as outlined in the data sharing agreement.
(c) A recipient receiving individual records of protected personal information is subject to audits.
(d) The department may conduct random audits of any recipient it deems necessary.
(e) The department will determine the frequency of all audits.
(f) The cost of all audits, including actual costs incurred by the department to coordinate, schedule, conduct, draft, receive, review, and report the audit up to the point when the department issues the final audit review or report, is the responsibility of the recipient.
(g) The department may suspend or terminate a recipient's access to data if the recipient fails to provide or allow an acceptable audit by the due date established by the department.
(h) The department will only accept third-party audits that meet department audit standards and are performed by auditors that meet independent third-party auditor qualifications.
(2) Subrecipient lists - A recipient must provide the department with a list of:
(a) All subrecipients and secondary subrecipients that received protected personal information originating from the recipient in the time frame requested; and
(b) All customers.

## Nearby sections

- [WAC 308-10A-100 WAC 308-10A-100. Definitions](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_100.md)
- [WAC 308-10A-201 WAC 308-10A-201. Recipient compliance requirements](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_201.md)
- [WAC 308-10A-202 WAC 308-10A-202. Vetting of subrecipients](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_202.md)
- [WAC 308-10A-203 WAC 308-10A-203. Subrecipient disqualification](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_203.md)
- [WAC 308-10A-204 WAC 308-10A-204. Subrecipient audit requirements](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_204.md)
- [WAC 308-10A-205 WAC 308-10A-205. Required written consent audits](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_205.md)
- [WAC 308-10A-301 WAC 308-10A-301. Recipient-subrecipient data sharing agreement](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_301.md)
- [WAC 308-10A-401 WAC 308-10A-401. Standards for audits of recipients](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_401.md)
- [WAC 308-10A-402 WAC 308-10A-402. Selection of an auditor](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_402.md)
- [WAC 308-10A-403 WAC 308-10A-403. Independent third-party auditor qualifications](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_403.md)
- [WAC 308-10A-404 WAC 308-10A-404. Statement of compliance](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_404.md)
- [WAC 308-10A-405 WAC 308-10A-405. Corrective action plans](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_405.md)
- [WAC 308-10A-500 WAC 308-10A-500. Permissible uses pertaining to RCW 46.12.630 ](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_500.md)
- [WAC 308-10A-700 WAC 308-10A-700. Research](https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_700.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_WA_ADC_308_10A_201. Check the current official text before relying on it. Not legal advice.