WAC 246-455-090   Release of the data.  (1) To acknowledge the need to protect patient privacy, federal privacy rules are used as models for deidentification of individually identifiable health information and for minimum necessary disclosure of individually identifiable health information in the release of CHARS data.

     (2) Individually identifiable health information will not be released to the public.

     (3) Confidential data sets may contain all or portions of the individually identifiable health information. Confidential data sets will be released under the following conditions:

     (a) Data sets containing any of the individually identifiable health information will be constructed by applying the standard of inclusion of the minimum elements necessary for the recipient's project requirements.

     (b) Research projects may receive these data sets following approval by Washington state institutional review board, and receipt of a signed data use agreement with the board and the department of health.

     (c) Projects of state, local and federal agencies directly related to quality assurance or quality improvement of the data activities, hospitalization payment rate setting, program evaluation or public health surveillance may receive these data sets through a signed contract that includes a data use agreement.

     The department reserves the right to determine whether a use is appropriate.

     (4) The data sharing agreements for confidential data sets must include language which:

     (a) Establishes who will use and receive the data set;

     (b) Requires that the data not be used to identify or contact individuals;

     (c) Requires appropriate safeguards to prevent the use or disclosure of the information other than as provided for in the agreement;

     (d) Establishes the permitted use of the data set and excludes other uses;

     (e) Requires immediate notification to DOH of any suspected security breach;

     (f) Requires a report to DOH of any use or disclosure not permitted in the agreement;

     (g) Contains penalties for violation of the agreement;

     (h) Requires that the data set be destroyed or returned; and

     (i) Requires all users, including contractors and subcontractors, to read the agreement, abide by its provisions and sign it.



[Statutory Authority: RCW 43.70.040 and 43.70.052. 07-09-091, § 246-455-090, filed 4/18/07, effective 5/23/07. Statutory Authority: RCW 43.70.040 and chapter 70.170 RCW. 94-12-090, § 246-455-090, filed 6/1/94, effective 7/2/94. Statutory Authority: RCW 43.70.040. 91-02-049 (Order 121), recodified as § 246-455-090, filed 12/27/90, effective 1/31/91. Statutory Authority: Chapter 70.39 RCW. 87-08-037 (Order 87-02, Resolution No. 87-02), § 261-50-075, filed 3/30/87.]