Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · seattle

Washington wrote its own consumer health data law, and it reaches far past hospitals.

Seattle-area companies build cloud platforms, ship parts to airframe lines in Everett and Renton, and run cancer research on shared clusters. Since 2024 Washington's My Health My Data Act has also turned any consumer app that infers health status into a regulated business, with private lawsuits allowed.

Talk to an engineer
work in seattle6 services
4 local rules covered below
in short·15-second read

For Seattle-area software, aerospace and biomedical organizations we handle cloud identity and permissions, privileged access to production and plant systems, and consent and data mapping for consumer health data under Washington's My Health My Data Act.

Aerospace suppliers get CMMC-aligned access controls and researchers get governed data platforms. Cohash is headquartered in Frisco, Texas, works with Seattle remotely and travels up for workshops and launches.

Cohash has no Seattle office. Our US base is Frisco, Texas, so Puget Sound work runs remotely, with consultants traveling up for discovery workshops, supplier site visits and go-live.

Ask an engineer facts checked 2026-10-21 · 9 sources
rules
Washington breach notification, RCW 19.255.010My Health My Data Act, chapter 19.373 RCWWashington biometric identifiers law, RCW 19.375.020CMMC, 32 CFR part 170
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
seattle by the numbers

What's specific about Seattle

Each figure comes from a public source, linked on the card.

01 1,479

Information jobs number about 125.8 thousand and professional and business services 310.9 thousand in the Seattle-Bellevue-Everett division, out of 1,479.7 thousand nonfarm jobs, BLS reports for September 2026 (preliminary).

source ↗ 02 52,715,181

Seattle-Tacoma International Airport set a record with 52,715,181 passengers in 2025, the Port of Seattle reports, while total air cargo fell 6.9% from 2024.

source ↗ 03 6,200

Fred Hutch, the cancer research and care organization on Fairview Avenue North in Seattle, lists a staff of about 6,200.

source ↗ 04 1,500

The state's Choose Washington site counts more than 1,500 aerospace suppliers in Washington and describes aerospace as a $71 billion industry in the state.

source ↗
who and what

Who we work with in Seattle, and the rules they work under

industries

  1. Cloud and software platforms

    Large cloud estates pile up IAM roles, cross-account trusts and CI tokens nobody remembers creating. We map effective permissions across accounts, swap standing admin rights for just-in-time elevation, and move pipelines to federated workload identity so long-lived access keys can be deleted.

  2. Aerospace suppliers

    Tier 2 and tier 3 suppliers handle drawings with export markings and, on defense programs, CUI. Shop-floor machines and CAD stations often share logins. We move engineering data into a controlled enclave, issue named accounts with MFA and line up the evidence for a CMMC assessment.

  3. Biomedical research and cancer care

    Research institutes run clinical, genomic and imaging data across HPC clusters and cloud accounts, and investigators come and go with grants. We tie data access to IRB protocols and appointment dates and keep a lineage record for every derived dataset.

  4. Consumer health and wellness apps

    Under My Health My Data, an app collecting Washington consumers' health data needs consent to collect it beyond what the service requires, separate consent to share it and a signed authorization to sell it. We build the consent capture, a data map that finds health inferences in analytics pipelines, and deletion workflows.

regulations

  1. Washington breach notification, RCW 19.255.010 ↗

    Affected Washington residents get notice within 30 calendar days of discovery. When more than 500 residents are affected, the Attorney General also gets notice within 30 days, listing the number affected, data types, exposure window and containment steps. A vendor holding data for another company must tell that company immediately.

  2. My Health My Data Act, chapter 19.373 RCW ↗

    Protects consumer health data well outside HIPAA, including data used to infer health status. Most duties applied to regulated entities from 31 March 2024 and to small businesses from 30 June 2024. Violations are per se Consumer Protection Act violations, enforced by the Attorney General and through private suits.

  3. Washington biometric identifiers law, RCW 19.375.020 ↗

    A business may not enroll a biometric identifier in a database for a commercial purpose without notice and consent or a mechanism to prevent later commercial use. It may keep the identifier only as long as reasonably necessary and must guard it against unauthorized access.

  4. CMMC, 32 CFR part 170 ↗

    Defense suppliers' contracts began carrying the DFARS CMMC clause on a phased basis from 10 November 2025, on top of the program rule in force since 16 December 2024. Suppliers holding CUI need a Level 2 assessment when the clause calls for one.

services

Most requested in Seattle

The services clients in Seattle ask us for most.

you are hereSeattle
01Does My Health My Data apply to us if we're not a health care company?

Quite possibly. It covers consumer health data collected by businesses in Washington or about Washington consumers, and the definition includes data from which health status can be inferred, such as purchases, location near clinics or fitness tracking. Counsel decides scope, and we map where that data flows in your product and analytics.

02How long does it take to remove standing admin access in a large cloud estate?

For a few hundred accounts, the first pass usually takes a couple of months. We start with the roles that reach production data and identity services, switch them to just-in-time elevation with approval, and keep break-glass accounts vaulted and alerted.

03We're a small machine shop supplying a defense program. Do we really need CMMC?

If your contract carries the CMMC clause and you handle CUI, yes, and the level is set in the solicitation. If you only receive federal contract information, a Level 1 self-assessment may be enough. We help you confirm which data you hold before you spend on an enclave.

04Does Washington's biometric law cover employee badge readers that use fingerprints?

The statute targets enrollment for a commercial purpose, and security uses get different treatment, so employee timekeeping and access control often fall outside it. Check with counsel, since My Health My Data and other laws may still apply, and we can document how templates are stored and retained.

washington

More cities in Washington

All 82 cities
SpokaneHealth care & Fairchild AFB
sources 9 sources linked last checked 2026-10-21 content fingerprint ac43fbfa
  1. 01BLS, Seattle-Bellevue-Everett economy at a glancebls.gov ↗
  2. 02Port of Seattle, airport statisticsportseattle.org ↗
  3. 03Fred Hutch, about the Hutchfredhutch.org ↗
  4. 04Choose Washington, aerospace sectorchoosewashingtonstate.com ↗
  5. 05RCW 19.255.010app.leg.wa.gov ↗
  6. 06Washington Attorney General, My Health My Data Actatg.wa.gov ↗
  7. 07RCW 19.375.020app.leg.wa.gov ↗
  8. 08Federal Register, CMMC program rule (govinfo)govinfo.gov ↗
  9. 09Federal Register, DFARS CMMC rule (govinfo)govinfo.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it