UW Medicine Compliance
Use and Disclosure of Protected Health Information (PHI) – COMP.103
This policy outlines the requirements for appropriate use and disclosure of protected health information (PHI), addresses the concept of minimum necessary as it applies to PHI uses and disclosures, describes the special restrictions on PHI requiring heightened standards of confidentiality, and references the requirement to document certain PHI disclosures made without patient authorization.
Applicability: UW Medicine Affiliated Covered Entity
Policy Title: Use and Disclosure of Protected Health Information (PHI)
Policy Number: COMP.103
Superseded Policies: PP-07, PP-08, PP-09, PP-10, PP-13, PP-14, PP-15, PP-16a-l, PP-17, PP-18, PP-19, PP-19a, PP-20
Date Established: October 11, 2017
Date Effective: September 21, 2018
Next Review Date: October 11, 2020
Uses and disclosures of PHI generally require authorization unless they are specifically permitted, authorized or required by law.
UW Medicine workforce members may use and disclose PHI only:
- For treatment, payment or healthcare operations (TPO); or
- As authorized by the patient; or
- *As specifically permitted, authorized or required by law.
UW Medicine workforce members shall limit their access, use and disclosure of PHI to the minimum amount of information necessary in compliance with the requirements outlined in Section I of this policy.
*Special note regarding PHI requiring heightened standards of confidentiality:Heightened standards of confidentiality are required when using or disclosing PHI pertaining to sexually transmitted diseases (STDs), acquired immunodeficiency syndrome (AIDS), or human immunodeficiency virus (HIV), mental health records, drug and alcohol treatment records or sexual assault program records. Use or disclosure of this type of PHI for anything but TPO generally requires a valid patient authorization or a federal or Washington State court order. Exceptions are noted in the applicable sections of this policy and summarized in Section II.M of this policy.
Except for TPO purposes, most PHI disclosures made without patient authorization must be documented in the Accounting of Disclosures database. UW Medicine workforce members shall document such disclosures in accordance with the requirements outlined in COMP.104 Patient Rights Related to PHI.
UW Medicine takes reasonable precautions to ensure that uses of, disclosures of, or requests for PHI are limited to the minimum necessary. Minimum necessary is based on a need-to-know and is the limited PHI required to accomplish the intended purpose of the use or disclosure or request. UW Medicine shall not use, disclose or request an entire medical record from another covered entity unless access to the entire medical record is specifically justified as the amount of information reasonably necessary to accomplish the purpose of the request.
The minimum necessary requirement does not apply to:
- Uses and disclosures for treatment purposes,
- Disclosures pursuant to an authorization,
- Disclosures to the individual,
- Disclosures made to U.S. Department of Health and Human Service (HHS) for compliance and enforcement purposes,
- Disclosures required by law, and
- Uses or disclosures required to comply with the federal privacy regulations.
- For routine or recurring disclosures of PHI, UW Medicine departments that make such disclosures shall implement standard procedures that limit the PHI disclosed to the amount reasonably necessary to achieve the purpose of the disclosure.
- For all other disclosures, UW Medicine departments that make disclosures shall establish criteria to limit the PHI disclosed to what is reasonably necessary to achieve the purpose of the disclosure, and conduct case-by-case reviews and determinations for individual requests based on the criteria.
- Workforce members may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when:
• Disclosing PHI to certain public officials, see COMP.102 Safeguarding the Privacy and Security of PHI, Section III;
• The request is from another covered entity;
• The request is from a UW Medicine workforce member or business associate for the purpose of providing professional services to UW Medicine; or
• The requestor submits documentation or represents that the information is for an institutional review board (IRB)-approved research project, see Section IV of this policy for information regarding PHI use for research purposes.
- Workforce member shall direct requests to obtain PHI from outside healthcare organizations to the applicable Health Information Management (HIM) that is the custodian of the requested PHI.
- When UW Medicine wishes to obtain PHI for routine or recurring purposes, it shall follow standard procedures established by HIM to ensure that the PHI requested is limited to the amount reasonably necessary to accomplish the purpose of the request.
- For all other requests for PHI by UW Medicine, workforce members shall use the following steps to limit each request for PHI to the information reasonably necessary to accomplish the purpose:
• Determine the purpose of the request. The information requested must be related directly to the stated purpose.
• Identify and request the data elements required to fulfill the purpose of the request. For example, the entire medical record shall be requested only if it is clearly demonstrated that each part of the medical record is related to the reason the request is being made. To the extent possible, the request should be specific both as to the documents being requested and the applicable time period.
• Verify that the purpose could not be achieved by requesting de-identified information.
- When workforce members receive the requested PHI, the requestor determines if the PHI needs to be maintained within the UW Medicine designated record set and if so, forwards the records to the applicable HIM department for inclusion.
Workforce members may use and disclose PHI for treatment, payment and healthcare operations (TPO) without patient authorization. For use or disclosure of records of federally-assisted alcohol or drug abuse treatment programs, refer to Section II.M of this policy.
- Workforce members may disclose the minimum necessary PHI without patient authorization, except for substance abuse treatment program records for public health activities to:
a. Public health authorities who are required by law to collect or receive the information for the purpose of preventing or controlling disease, injury or disability, including but not limited to the reporting of disease, injury and vital events, and the conduct of public health surveillance, public health investigation and public health interventions;
b. Official(s) of a foreign government agency acting in collaboration with a public health authority when the public health authority directs the disclosure be made to the collaborating foreign agency;
c. A person or entity subject to the jurisdiction of the U.S. Food and Drug Administration (FDA) who has responsibility for the quality, safety and effectiveness of a FDA-regulated product when necessary to protect public health and the purpose of the disclosure is one of the following:
i. To collect or report adverse events with respect to food, dietary supplements, product defects or problems, or biological product deviations;
ii. To track FDA-regulated products;
iii. To enable product recalls, repairs, replacement, or lookback (including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback); or
iv. To conduct post-marketing surveillance.
2. Exposure-related requests for STD test results:
A law enforcement officer, fire fighter, healthcare professional, healthcare facility staff person, department of corrections staff person, jail staff person, or certain other person who has been substantially exposed to an individual’s bodily fluids may request that a public health officer test the individual for an STD and may receive the results of that test. Individuals who have been placed at risk for acquisition of an STD because of their behavioral interaction with the infected individual may also request the results of the test.
3. Public health intervention:
If UW Medicine is otherwise authorized by law to conduct a public health intervention and is authorized as part of the intervention to notify a person who may have been exposed to a communicable disease, including but not limited to an STD, or may be at risk of contracting or spreading a disease, workforce members may notify such person without patient authorization.
UW Medicine may disclose PHI without patient authorization, except for mental health treatment records, substance abuse treatment program records and STD records, as authorized by and only to the extent necessary to comply with laws relating to WA State workers’ compensation or other similar programs established by law that provide benefits for work-related injuries or illness without regard to fault. Mental health treatment records, substance abuse treatment program records and STD records may not be disclosed unless authorized by an appropriate court order.
Examples of worker’s compensation programs:
- Labor & Industries (L&I) workers compensation program;
- Self-insured workers compensation;
- Crime Victims’ Compensation (CVC) program; and
- Examinations required by the Washington Industrial Safety and Health Act (WISHA).
Patient authorization is required for disclosing PHI to worker’s compensation programs in other states.
UW Medicine provides written notice to the patient in the Joint Notice of Privacy Practices (uwmedicine.org/nopp) that PHI relating to work-related medical monitoring or surveillance or work-related injuries or illnesses may be disclosed to the employer.
Workforce members may disclose PHI to a patient’s employer without patient authorization only when the following conditions are met:
- The employer needs the information to comply with its obligation under the Occupational Safety and Health Act (OSHA), the Mine Safety and Health Act (MSHA) and the WISHA;
- UW Medicine is providing healthcare to a patient at the request of an employer, including when UW Medicine is the employer, for the purpose of:
• Conducting an evaluation of work-related medical monitoring or surveillance; or
• Evaluating whether the patient has a work-related injury or illness;
- Only the findings concerning the work-related medical monitoring or surveillance or work-related illness or injury shall be disclosed; and
- Mental health treatment records, STD records and substance abuse treatment program records may be disclosed only as authorized by an appropriate court order.
- Workforce members may disclose PHI without patient authorization to a health oversight agency for oversight activities as authorized by law, including:
a. Audits, as long as there is a written agreement to:
i. Remove and/or destroy patient-identifying information at the earliest opportunity; and
ii. Not to further disclose the information except to complete an audit or to report unlawful conduct involving fraud in payment of healthcare by a healthcare professional or patient, or other unlawful conduct by the healthcare professional.
b. Civil, administrative, or criminal investigations, proceedings or actions;
d. Licensure, certification, or registration rules or laws, or to investigate unprofessional conduct;
Note: Department of Health (DOH) requests for PHI associated with licensure actions against individual healthcare professionals must be accompanied by a subpoena.
e. Other activities necessary for appropriate oversight of the healthcare system, where such activities require disclosure of health information, such as:
i. Determining beneficiary eligibility for government benefit programs;
ii. Determining entity compliance with applicable civil rights laws; or
iii. Determining entity compliance with applicable government regulatory programs.
A health oversight activity does not include an investigation or other activity in which a patient is the subject of the investigation when such activity is not directly related to:
a. Receipt of healthcare;
b. Claim for public benefits related to health; or
c. Qualification for, or receipt of, public services or benefits when a patient’s health is integral to the claim for public services or benefits.
Note: If a health oversight activity or investigation is conducted in conjunction with an oversight activity relating to a claim for public benefits not related to health, the joint activity or investigation would be considered a health oversight activity and workforce members may use or disclose PHI.
The following restrictions do not apply to disclosures for death notification purposes or to the deceased patient’s personal representative.
1. Workforce members may disclose PHI about a deceased patient without a valid authorization to:
a. A coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law;
b. Funeral directors for the purpose of carrying out their duties (including disclosures prior to and in reasonable anticipation of the individual’s death); or
c. Organizations engaged in organ procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating the donation and transplantation.
2. Workforce members may disclose a patient’s STD PHI without patient authorization only for item II.F.1.c. above. Disclosures of mental health treatment records or substance abuse treatment program records for deceased patients require a valid authorization or a federal or WA State court order.
3. Workforce members may use PHI about a deceased patient without a valid authorization for purposes of identifying the deceased person, determining a cause of death or other duties as authorized by law when UW Medicine performs the duties of a coroner or medical examiner.
4. The use of decedents’ PHI for research purposes requires IRB review and approval. The IRB may require consent from the legally authorized surrogate or may authorize a waiver of consent in accordance with WA state law Revised Code of Washington (RCW) 70.02. See Section IV of this policy for information regarding research.
1. Consistent with applicable law and standards of ethical conduct, workforce members may use or disclose PHI without patient authorization to persons reasonably able to prevent or lessen the threat, including the probable victim(s) if they believe in good faith that one of the below situations exists. Unless otherwise noted in the situations below, the disclosure may include only the minimum necessary information concerning mental health treatment or STDs. Substance abuse treatment program records may be disclosed only to law enforcement for situations involving a crime on UW Medicine premises or against a workforce member – all other disclosures of substance abuse treatment program records without patient authorization require an appropriate court order:
a. It is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
b. An individual has escaped from a correctional institution, a mental health treatment facility or other lawful custody.
c. An individual has admitted to participating in a violent crime that may have caused serious physical harm to another and there is a serious threat to the health or safety of the patient or the other individual. Only the minimum necessary information to minimize the danger should be released, not to exceed the following:
i. Name and address;
ii. Date and place of birth;
iii. Social security number;
iv. ABO blood type and Rh factor;
v. Type of injury;
vi. Date and time of treatment;
vii.Date and time of death, if applicable;
viii. Description of distinguishing physical characteristics including height, weight, gender, race, hair and eye color, facial hair, tattoos etc.
2. Healthcare professionals have a duty to warn, or to take reasonable precautions to provide protection from violent behavior when the patient has communicated an actual threat of physical violence against a victim or victims that are reasonably identifiable. In these situations, healthcare professionals must make reasonable efforts to communicate the threat to the victim(s) and to law enforcement. In this situation, the professional may only disclose:
a. Dates of admission and discharge;
b. Authorized and unauthorized absences from the facility;
c. Other information pertinent to the threat or harassment.
3. Under this exception to authorization requirements, healthcare professionals may decide to disclose PHI without a direct request from law enforcement. If the anticipated PHI disclosure is due to a request from law enforcement, the law enforcement official must provide sufficient detail to the healthcare professional about the anticipated harm to justify the disclosure and to demonstrate that the anticipated harm is serious and imminent. If the official credibly demonstrates to a healthcare professional that in the opinion of the official the harm is serious and imminent and that the information requested is needed to lessen that threatened harm, healthcare professionals may reasonably rely upon such representations and release the minimum necessary information PHI to lessen the threatened harm.
4. Exception: Other than when required by law, such as mandatory reporting situations, workforce members may not disclose PHI without patient authorization if the information is learned:
a. In the course of treatment to affect the propensity (inclination, tendency) to commit the criminal conduct that is the basis for the disclosure; or
b. Through a request by the individual to be referred, or to start treatment, counseling, or therapy for treatment to affect the propensity to commit criminal conduct.
Note: In determining whether a particular set of facts creates a mandatory or discretionary duty to warn on the part of the healthcare professional, the healthcare professional should consult the appropriate Department of Social Work policy and consult with professional colleagues.
Workforce members may use or disclose PHI without patient authorization for judicial and administrative proceedings in certain circumstances. Special restriction: For substance abuse treatment program records, mental health treatment records and STD records, the requirements outlined in item II.H.5 below must be met.
All court orders, warrants, notices of intent, subpoenas and administrative orders seeking records of PHI from the Designated Record Set must be forwarded to the applicable HIM department.
1. Court-ordered lawful process
Without patient authorization, workforce members may disclose only the information expressly authorized by a federal or Washington State court order, warrant, grand jury subpoena, administrative tribunal or subpoena or out-of-state court order that is signed by a judge.
2. Non-court-ordered lawful process
a. If a child’s PHI is requested for a proceeding regarding the abuse or neglect of that child, workforce members may disclose the requested information, except for substance abuse treatment program records, without patient authorization or a court order.
b. If mental health records are requested for a proceeding regarding an individual’s involuntary commitment or restoration of an individual’s competency, workforce members may disclose the individual’s requested information without patient authorization or a court order.
c. For law enforcement purposes, in the case of an administrative order that is not accompanied by a court order (including an administrative subpoena or summons, a civil or an authorized investigative demand or similar process authorized by law) the requested information may be released only IF:
i. The information sought is relevant and material to a legitimate law enforcement inquiry;
ii. The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and
iii. De-identified information could not reasonably be used.
d. For all other purposes, such as a federal or Washington State subpoena not signed by a judge, discovery request or other lawful process that is not accompanied by a court order or authorized by an administrative tribunal, the requested information may be released only if:
i. UW Medicine receives satisfactory assurances from the party seeking the records that reasonable efforts have been made to ensure that the patient has been given notice and an opportunity to raise an objection with the appropriate tribunal. For purposes of this section, satisfactory assurances means one of the following:
a) All the following four conditions are met:
1) Requestor provides advance notice (often called a Notice of Intent) to the healthcare professional and the patient or the patient’s attorney, indicating what healthcare information is sought, the date by which a protective order must be obtained to prevent the healthcare professional from complying, and sufficient information about the litigation or administrative proceeding to permit the individual to raise an objection;
2) The advance notice gives the patient and healthcare professional adequate time to seek a protective order (no less than 14 days);
3) The subpoena, discovery request or other lawful process is served after the expiration of the notice period; and
4) The patient does not object or acquire a protective order during the notice period; or
b) UW Medicine receives a written statement and accompanying documentation (reasonable assurances) that the parties to the dispute giving rise to the request for information have agreed to a qualified protective order that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested; and requires the return or destruction of the PHI at the end of the litigation or proceeding.
ii. Without proof of the satisfactory assurances above, UW Medicine may disclose only if it has made reasonable efforts to provide notice to the patient that informs the patient of his or her right to seek a qualified protective order that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation or proceeding for which such information was requested; and requires the return to UW Medicine or destruction of the PHI at the conclusion of the litigation.
3. If a federal or Washington State subpoena, discovery request or other lawful record-seeking process does not meet the criteria under Section II above, the applicable HIM department mails a letter to the requestor denying disclosure.
4. If information is disclosed pursuant to a federal or Washington state subpoena, discovery request, or other lawful process, the disclosure must be documented in the applicable Accounting of Disclosures database.
5. Mental health, STD or substance abuse treatment program records:
a. A patient’s mental health treatment records may be released without authorization to the patient’s counsel or guardian ad litem, without modification, at any time in order to prepare for involuntary commitment or recommitment proceedings, reexaminations, appeals, or other actions relating to detention, admission, commitment, or a patient’s rights.
b. The minimum necessary information concerning mental health treatment records and STD records may be released without authorization for proceedings regarding the abuse or neglect of a child.
c. Except as described in the preceding items a and b, substance abuse treatment program records, mental health treatment records and STD records require a federal or Washington State court order and shall not be released pursuant to a subpoena without patient authorization unless otherwise authorized by state law.
d. If the records sought are for mental health treatment, substance abuse treatment programs or STDs and neither item a, b or c applies, the applicable HIM department sends a letter to the requestor informing them of the need for a court order or a patient authorization.
6. For U.S.A. PATRIOT Act Court Orders, see Section II.L of this policy for other disclosures required by law.
In addition to the types of disclosures described elsewhere in Section II of this policy, workforce members may also disclose PHI to law enforcement or correctional facility officials without patient authorization in the following situations when the applicable requirements are met.
(For law enforcement requests to photograph patients or collect evidence, which requires the patient’s permission, see Section III.C of this policy.)
- Reporting a crime when providing emergency healthcare services.
When providing emergency healthcare services, only the minimum amount of PHI may be disclosed to law enforcement if it is necessary to avoid an imminent danger (see Section II.G) and the disclosure appears necessary to alert law enforcement to the commission and nature of a crime, the location of such crime or of the victims, and the identity, description, and location of the perpetrator. The disclosure may include substance abuse treatment program information only for crimes on UW Medicine premises or against workforce members. The disclosure may not include STD or mental health records unless another exception applies.
If the workforce member believes that the medical emergency is the result of abuse, neglect or domestic violence of the patient, this paragraph does not apply and any disclosure of PHI is instead subject to Section II.J of this policy.
- Patients brought to the healthcare facility by authorities.
a. For patients brought or caused to be brought to the healthcare facility by fire, police, sheriff, or other public authority, workforce members may disclose only the following information, if known, to that public authority:a. For patients brought or caused to be brought to the healthcare facility by fire, police, sheriff, or other public authority, workforce members may disclose only the following information, if known, to that public authority:
v. Condition, diagnosis, or extent and location of injuries as determined by a healthcare provider;
vi. Whether the patient was conscious when admitted; and
vii. Discharge date.
b. The disclosure may not include information or records related to substance abuse treatment programs, STDs or mental health treatment unless another exception applies.
Note: It is important to make a distinction between substance abuse treatment records and records related to emergency department testing of individuals for drugs or alcohol. Records of tests for drug or alcohol use are treated in the same manner as any other PHI.
- Patients in custody.
a. Workforce members may disclose the minimum necessary PHI to a correctional institution or a law enforcement officer about a patient who is in their lawful custody, except for STD, mental health or substance abuse treatment program records*, when the PHI is necessary for:
i. Health and safety of the patient or others;
ii. Provision of healthcare to the patient;
iii. Health and safety of the officers, employees or others at the correctional institution;
iv. Health and safety of individuals, officers or other persons responsible for the transport of inmates;
v. Law enforcement on the premises of the correctional institution; or
vi. The administration and maintenance of the safety, security and good order of the correctional institution.
*Under this exception, STD, mental health or substance abuse treatment program records may be disclosed without patient authorization only as outlined in item II.I.3.b below or in Section II.M of this policy, or pursuant to a federal or Washington state court order.
b. Involuntary mental health treatment or commitment.
i. Upon request, workforce members may disclose without patient authorization to law enforcement the fact, place and date of an involuntary commitment, the fact and date of discharge or release, and the last known address of patients committed under the involuntary treatment act. Workforce members may release additional mental health records as necessary to a prosecuting attorney for involuntary treatment release or modification purposes.
ii. When UW Medicine conducts an investigation or provides treatment at the request of law enforcement or a correctional institution for purposes of determining whether to detain or release an individual, workforce members may disclose mental health information to comply with reporting requirements for such a request.
iii. Upon written request from law enforcement or a correctional institution, workforce members must disclose, without patient authorization, information and records related to mental health services delivered to a patient who:
a) Is currently committed to the custody or supervision of the department of corrections or the indeterminate sentence review board;
b) Has been convicted or found not guilty by reason of insanity of a serious violent offense; or
c) Was charged with a serious violent offense and the charges were dismissed when the patient was determined to be incompetent.
Appropriate purposes for requesting this information include:
• Completing presentence investigations or risk assessment reports;
• Planning for and provision of supervision of an offender;
• Responding to an offender’s failure to report for supervision;
• Assessing a person’s risk to the community;
• Assessing a person’s risk to self or others when incarcerated.
iv. If a patient is committed under the involuntary mental health treatment act after dismissal of a sex, violent or felony harassment offense, then law enforcement, witnesses who testified against the patient and the victim must all be notified of that patient’s conditional release, final discharge, transfer, authorized leave, or escape from involuntary treatment or recapture. Workforce members shall disclose the required mental health information without patient authorization to meet this reporting requirement.
- Identification and location purposes.
Since Washington state law is more restrictive than HIPAA, workforce members may disclose PHI to law enforcement without patient authorization to identify or locate a suspect, fugitive, material witness or missing person only when another exception (basis for disclosing the information without patient authorization) applies, as outlined elsewhere in Section II of this policy.
Exception. In the absence of compulsory legal process, such as a search warrant, the following PHI may not be disclosed for the purpose of identifying or locating a suspect, fugitive, material witness or missing person:
ii. Dental records;
iii. Typing sample or analysis of body tissues or fluids.
- Crime on UW Medicine Premises or against UW Medicine workforce members.
Workforce members may disclose PHI to federal, state or local law enforcement authorities without patient authorization when they believe in good faith that the PHI constitutes evidence of criminal conduct that occurred on UW Medicine premises or against UW Medicine workforce members. The disclosure may include substance abuse treatment program information as necessary, but may not include STD or mental health records unless another exception applies.
- Crime victims.
Washington state law does not expressly permit disclosures of PHI in response to a law enforcement officer’s request for information about an individual who is the victim of a crime. HIPAA does allow this type of disclosure. Because state law is more restrictive, workforce members may disclose information about a crime victim directly to law enforcement only when another basis for disclosing the information, as outlined throughout this policy, applies. See also Section III of this policy.
A law enforcement officer may accompany a victim/patient while the victim/patient receives treatment in the healthcare facility only if the patient consents and healthcare staff determine that the patient’s care will not be compromised. If the patient verbally consents, the healthcare professional may respond to questions from the law enforcement officer regarding the patient. If the officer requests written materials or substances, the patient must authorize the disclosure or an exception described elsewhere in this policy must apply.
- Alcohol or drug test results.
According to State of Washington statutes, every person who operates a motor vehicle in Washington has given “implied consent” to an alcohol test of the person’s breath or blood, if the arresting officer has reasonable grounds to believe that the person was driving or in physical control of a vehicle while intoxicated. Therefore, blood alcohol or drug levels may be tested and disclosed to the police in any of the following situations:
i. The person is incapable of providing a breath sample due to physical injury, physical incapacity, or other physical limitation;
ii. The person is being treated in a hospital, clinic, doctor’s office; emergency medical vehicle, ambulance, or other similar facility;
iii. The officer has reasonable grounds to believe that the person is under the influence of a drug;
iv. The person is under arrest for:
a) Vehicular homicide;
b) Vehicular assault; or
c) DUI and the arrest results from an accident in which there was serious bodily injury to another person.
If a person is dead, unconscious, or otherwise incapable of refusal, the person is deemed to have consented to the test.
- Mandatory reporting of violent injuries for patients.
a. When a patient who arrives for treatment is found to have a bullet, gunshot or stab wound, UW Medicine is required to disclose the following information, if known, to law enforcement as soon as reasonably possible following entity procedure and taking into consideration a patient’s emergency care needs:
i. The name, residence, sex and age of the patient;
ii. Whether the patient has received a bullet wound, gunshot wound or stab wound; and
iii. The name of the healthcare professional providing treatment for the bullet wound, gunshot wound or stab wound.
b. If law enforcement is present, they may be given any bullets, clothing or other foreign objects that are removed from a patient for whom UW Medicine is required to make a report under this policy.
- Mandatory reporting of PHI when requested by law enforcement.
Workforce members must disclose certain PHI in response to a verbal or written request for information about a patient from law enforcement only when the patient is being treated for a/an:
a. Bullet wound;
b. Gunshot wound;
c. Powder burn;
d. Other injury arising from or caused by the discharge of a firearm;
e. Injury caused by a knife, an ice pick or any other sharp or pointed instrument which federal, state or local law enforcement authorities reasonably believed to have been intentionally inflicted upon a person; or
f. Blunt force injury that federal, state or local law enforcement authorities reasonably believe resulted from a criminal act.
In the above situations, workforce members must disclose only the following PHI, if known. The disclosure may not include substance abuse treatment program, STD or mental health records unless another exception applies:
a. Name of the patient;
b. Patient’s residence;
c. Patient’s gender;
d. Patient’s age;
e. Patient’s condition;
f. Patient’s diagnosis, or extent and location of injuries as determined by a healthcare professional;
g. Whether the patient was conscious when admitted;
h. Name of the healthcare professional making the determination of the patient’s condition, diagnosis or extent and location of injuries, and whether the patient was conscious when admitted;
i. Whether the patient has been transferred to another facility; and
j. Patient’s discharge time and date.
- Requirement to disclose PHI for abuse of vulnerable adults and children
Workforce members who have reasonable cause to believe that a vulnerable adult or a child has suffered abandonment, abuse or neglect are legally obligated to report the incident according to entity procedures. In such cases, workforce members may disclose PHI without authorization as outlined below.
a. Disclosure of PHI for vulnerable adult or child abuse, including copies of all relevant medical records (all information that may be helpful in establishing the nature and extent of abuse), shall be made without authorization of the parents/guardian to any of the following:
i. Child Protective Services, Washington State Department of Children, Youth, and Families (DCYF);
ii. Adult Protective Services, Department of Social and Health Services (DSHS);
iii. Law enforcement;
iv. City or County Prosecuting Attorney;
Signed authorization is required for disclosure to any other person/agency.
The disclosure may include the patient’s mental health and STD records as relevant, but may only include relevant substance abuse treatment program records when reporting suspected child abuse/neglect – not for vulnerable adults.
b. The workforce member shall promptly inform the patient or Personal Representative/Surrogate Decision Maker that a report has been made unless:
i. The workforce member believes informing the patient or Personal Representative/Surrogate Decision Maker would place the patient at risk of serious harm; or
ii. The workforce member would be informing a person who he/she believes may be responsible for the abuse, neglect or injury, and such a disclosure would not be in the best interest of the patient.
2. Disclosure of PHI for competent adults who are victims of domestic violence
a. While there are no mandatory reporting requirements on behalf of competent adults injured as a result of domestic violence, workforce members shall assist victims in involving appropriate law enforcement if the victim chooses this action and gives authorization for release of information.a. While there are no mandatory reporting requirements on behalf of competent adults injured as a result of domestic violence, workforce members shall assist victims in involving appropriate law enforcement if the victim chooses this action and gives authorization for release of information.
b. If the adult injured as a result of domestic violence is unable to agree because of incapacity and an authorized law enforcement officer or public official represents that the PHI sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon disclosure would be materially and adversely affected by waiting until individual is capable of giving authorization, workforce members may disclose PHI to the extent expressly authorized by law.
- Victims of sexual offenses
a. Upon a sexual offense victim’s request, workforce members shall disclose the offender’s STD test results without patient authorization. Victims receive notification of their right to such a disclosure from the county prosecuting attorney.
b. Sexual assault program records may not be released to any defense attorney as part of discovery in a sexual assault case without an authorized court order.
- General principles
a. Fundraising includes any activity in which a solicitation or request for charitable contribution occurs.
b. All fundraising efforts shall be coordinated with the UW Medicine Advancement office.
c. UW Medicine shall not prohibit or condition treatment or payment on a patient’s choice with respect to the receipt of fundraising communications.
2. Use of PHI for fundraising activities
a. Workforce members may use or disclose only the following PHI for fundraising purposes without patient authorization (with exceptions as outlined in item b), and may do so only if the UW Medicine Notice of Privacy Practices informs patients of this use of PHI and their ability to opt out of the practice:
i. Demographic information relating to an individual (including name, address, other contact information, age, gender, and date of birth);
ii. Dates of service;
iii. Department of service;
iv. Treating physician;
v. Outcome information;
vi. Health insurance status.
b. Exception: In compliance with the RCW, PHI requiring heightened confidentiality – including information related to mental health conditions, substance abuse treatment programs, STD testing and treatment, or HIV – may not be used or disclosed to identify patients for fundraising activities without patient authorization.
c. Caregivers may refer patients to the UW Medicine Advancement office if the referral is made using only the information approved for fundraising as outlined in item II.K.2.a above.
d. Use of PHI for fundraising other than as described in item a above requires patient authorization.
3. Opting out of or back in to receiving fundraising communications
a. Patients may opt out of the use of their PHI for purposes of fundraising. If a patient opts out of fundraising, UW Medicine removes the patient from future fundraising communications.
b. All fundraising communications must tell the patient how to opt out of future communications.
c. UW Medicine may provide a patient who has elected not to receive further fundraising communications with information about how to opt back in to receive such communications.
d. Workforce members who receive questions from patients about how to opt out of fundraising shall advise patients of their right not to receive fundraising materials and refer them to UW Medicine Compliance.
e. Workforce members who receive questions from patients about how to opt back in to fundraising should refer them to UW Medicine Compliance.
f. Patients who wish to opt out of or back in to receiving fundraising communications should direct their requests to:
UW Medicine Compliance
Seattle, WA 98195-8049
Main Line: 206.543.3098 or 855.211.6193 (toll free)
Anonymous Hotline: 206.616.5248 or 866.964.7744 (toll free)
- Military and veteran activities
Workforce members may disclose PHI without patient authorization to military healthcare professionals for treatment purposes.
- Homeland and national security activities
Workforce members may disclose PHI without patient authorization to authorized federal officials in the following situations. The disclosure may not include substance abuse treatment records, mental health records or STD records unless another exception permitting the disclosure (for example, averting a serious threat) is met:
a. Homeland Security: The Department of Homeland Security is an umbrella agency consisting of numerous smaller agencies. Homeland Security does not include the Federal Bureau of Investigation (FBI) or the Central Intelligence Agency (CIA), but does include, among others, the Immigration and Naturalization Service and the Secret Service. Many Homeland Security agents do not have a law enforcement basis for requiring the disclosure of PHI. Upon encountering an individual from Homeland Security who requests access to PHI, workforce members shall identify which specific agency the requester is from, whether or not the requester has law enforcement power, the reason the requester wants the information, and the specific types of PHI that the requester seeks. If the individual does not have law enforcement power, then no PHI shall be disclosed to the requestor.
b. The Secret Service: Workforce members may disclose PHI without patient authorization to the Secret Service when the Secret Service is acting in its capacity of providing protective services to the President, the President’s immediate family, past Presidents and certain heads of state.
c. National security issues: Workforce members may disclose PHI without patient authorization to the Secret Service or other authorized federal officials relating to the conduct of lawful intelligence, counterintelligence and other national security activities conducted by the FBI and CIA only if another exception permitting disclosure is met (imminent danger, appropriate law enforcement exception).
d. USA PATRIOT Act Court Orders: The USA PATRIOT Act, as it amends the Foreign Intelligence Surveillance Act, allows the FBI to obtain specialized court orders for “any tangible thing” that could relate to “international terrorism or clandestine intelligence activities.” The court order must be made by a qualified court and the court order itself cannot be disclosed to any persons other than those necessary to carry out the order. Although Washington State law generally requires notifying a patient of a healthcare professional’s disclosure of PHI, state law is preempted in this case. This means that the patient is not allowed to know that his or her PHI is being disclosed—this is the critical difference between a USA PATRIOT Act court order and any other court order presented to a hospital for the disclosure of PHI. USA PATRIOT Act court orders shall not be made part of the medical record or included in a disclosure log.
Under federal and Washington state laws, certain types of PHI are subject to heightened confidentiality. These types of PHI include mental health treatment records, records relating to testing or treatment for HIV/AIDS or other STDs, and substance abuse treatment program records.
1. Mental health treatment. Under Washington state law, workforce members may use or disclose records relating to treatment for mental illness without patient authorization only for TPO or in the following situations:
a. For the conduct of research when all applicable requirements are met;
b. For public health activities;
c. For health oversight activities;
d. To make appropriate notifications of information necessary to prevent or lessen a serious and imminent threat to health or safety.
e. As authorized by an appropriate court order;
f. To comply with state laws mandating the reporting of suspected child or vulnerable adult abuse/neglect;
g. To respond to requests for a child’s records for proceedings regarding the abuse or neglect of that child;
h. For involuntary commitment/treatment decisions or related activities (for details, see Section II.I.3.b of this policy)
i. To comply with reporting requirements for patients who are released or escape from Involuntary Treatment Act after dismissal of a sex, violent or felony harassment offense;
j. To the attorney of a detained person; or
k. To a patient’s counsel or guardian ad litem for involuntary commitment activities.
Note that the above disclosures of mental health treatment records do not include access to “psychotherapy notes” (see Section IV of this policy regarding psychotherapy notes).
2. STD testing or treatment, including HIV/AIDS: Under Washington state law, workforce members may use or disclose records relating to testing or treatment for HIV/AIDS or other STDs without patient authorization only for TPO or in the following situations:
a. For the conduct of research when all applicable requirements are met;
b. For public health activities, including exposure-related requests for test results;
c. For health oversight activities;
d. To facilitate the donation and transplantation of organs;
e. To make appropriate notifications of information as necessary to prevent or lessen a serious and imminent threat to health or safety;
f. As authorized by an appropriate court order;
g. To law enforcement when a patient commits a crime on UW Medicine premises or against a UW Medicine workforce member or threatens to do so;
h. To comply with state laws mandating the reporting of suspected child or vulnerable adult abuse/neglect;
i. To respond to requests for a child’s records for proceedings regarding the abuse or neglect of that child and in response to requests for information for proceedings related to the same;
j. To victims of sexual offenses who request the perpetrator’s STD test results; or
k. To a DCYF or child placing agency worker or a guardian ad litem who is responsible for making or reviewing placement or case-planning decisions/recommendations to the court for a child under 14 years of age who has an STD and is in the custody of DCYF or a licensed child placing agency.
3. Substance abuse treatment program. Federal law contains specific provisions that apply to all federally-assisted alcohol or drug abuse treatment programs. Those provisions include heightened confidentiality for the medical records of such a program, which are subject to much more restricted accessibility than standard medical records. Under federal as well as Washington state laws, workforce members may use or disclose substance abuse treatment program records without patient authorization only for treatment activities within the program itself (not for general UW Medicine TPO purposes) or in the following situations:
a. For the conduct of research when all applicable requirements are met;
b. As necessary for medical emergencies;
c. Or health oversight activities, such as audits or other evaluations of the treatment program;
d. As authorized by an appropriate court order;
e. To comply with state laws mandating the reporting of suspected child abuse or neglect; or
f. To law enforcement when a patient commits a crime on UW Medicine premises or against a UW Medicine workforce member or threatens to do so.
1. Inpatient facility directory – General
Except in the situations outlined in Sections III.A.2 and III.A.5 below, each UW Medicine hospital shall maintain the following PHI in its inpatient facility directory:
a. Patient’s name
b. Patient’s location within UW Medicine
c. Patient’s religious affiliation (if patient consents to have this information available to clergy); and
d. Patient’s condition using one of the following descriptions:
i. UNDETERMINED: The patient is awaiting a physician and an assessment.
ii. TREATED AND RELEASED: The patient has been treated by
UW Medicine and has been released. (In this instance, “treated” is the condition and “released” is the location.) Generally, this indicates the patient’s condition was satisfactory upon release.
iii. STABILIZED AND TRANSFERRED: The patient was stabilized at
UW Medicine, and has been transferred to another facility for further care. (In this instance, “stabilized” is the condition and “transferred” is the location.) UW Medicine shall not disclose where the patient was transferred. This classification does not imply a patient’s condition, simply that the patient is located in another facility.
iv. SATISFACTORY: Vital signs (heartbeat, breathing, blood pressure, temperature) are stable and within normal limits. The patient is conscious and comfortable. Indicators are good.
v. SERIOUS: Vital signs may be unstable and not within normal limits. Patient is acutely ill. Indicators are questionable.
vi. CRITICAL: Vital signs are unstable or not within normal limits. The patient may be unconscious. There is some doubt the patient will recover. Death could be imminent.
vii. DECEASED: The death of a patient may be reported to the authorities by UW Medicine, as required by law. Typically, a report will be made after efforts have been made to notify the next-of-kin. If the media inquires about the condition of the patient, UW Medicine may disclose that the patient is deceased only if the next-of-kin has been notified and the patient’s body is still in the hospital.
viii. RELEASED: If a patient has been released, and UW Medicine receives an inquiry about the patient by name, UW Medicine may confirm that the patient is no longer in the hospital, but cannot give the release date, admission date, length of stay or any other information.
2. Individual’s opportunity to object to inclusion in the inpatient directory
a. Workforce members shall:
i. Inform patients that the UW Medicine entity maintains an inpatient facility directory and tell them what PHI is contained in the directory;
ii. Inform patients about the people to whom directory information may be disclosed;
iii. Ask patients if UW Medicine may include their religious affiliation in the directory for release only to clergy (a patient may elect not to have his or her religious preference listed and still be listed in the inpatient directory); and
iv. Give patients the opportunity to request that all disclosures be prohibited and provide them with an explanation of the impact of that decision.
b. If a patient changes his or her earlier decision about inclusion in the inpatient facility directory, the workforce member shall implement the patient’s new decision.
3. Permitted uses or disclosures after an opportunity to object
Workforce members may use or disclose inpatient facility directory information to people who ask for a patient by name, with the following exceptions:
a. Religious affiliation shall not be disclosed except to clergy who request a list of patients of the same religious preference as the clergy; the list shall include only those patients who have consented to the disclosure of their religious affiliation.
b. Media inquiries shall be handled by UW Medicine Strategic Marketing & Communications.
4. Permitted uses or disclosures for emergency treatment or during an individual’s incapacity
a. When a patient cannot practicably be provided an opportunity to object because of incapacity or the need for emergency treatment, workforce members may use or disclose some or all of the directory information if the disclosure is:
i. Consistent with a prior expressed preference of the patient, if known; and
ii. In the patient’s best interest, as determined by their healthcare professional in the exercise of professional judgment.
b. As soon as practicable, a workforce member shall inform the patient of the PHI that is included in the inpatient facility directory and give the patient an opportunity to object to such inclusion.
5. Special circumstances for inpatient facility directories
a. Prisoner patients
Workforce members shall automatically opt-out of the inpatient directory all inmates in correctional facilities as well as arrestees who are in custody of law enforcement and under continuous guard. Workforce members may disclose information to family or media only under a special agreement between the correctional facility, community relations, and/or entity representative that is documented in the medical record.
Arrestees (or their legally authorized surrogate) who are not in custody of law enforcement and not under guard may decide whether or not to be included in the facility directory. Based upon information provided by law enforcement, the entity representative may make an administrative decision to opt the patient out of the directory.
b. Patients guarded by law enforcement for their protection
The patient or legally authorized surrogate may decide whether or not the patient is included in the facility directory. Law enforcement may provide information to an entity representative, who may make an administrative decision to opt the patient out of the directory.
c. More restrictive state or federal laws
The UW Medicine entity shall not include patients in the inpatient facility directory when doing so would violate other state or federal laws that are more restrictive on the release of information for certain patient populations. Examples include, but are not limited to:
i. Federally funded drug and alcohol treatment programs (42 C.F.R. §2);
ii. Voluntary and involuntary psychiatric admissions However, if a psychiatric patient is competent to give permission and wishes to be included the inpatient directory, UW Medicine may do so;
iii. Patient or workforce safety concerns (at the discretion of hospital administration.)
Workforce members may disclose proof of immunization about a patient who is a student or prospective student to a school that is required by State or other law to have proof of immunization prior to admitting the patient. The workforce member must have agreement, which may be verbal, from a parent, guardian or other person acting in loco parentis for the patient, or from the patient himself or herself, if the patient is an adult or emancipated minor. The workforce member must document the agreement in the patient’s medical record.
When a patient arrives from an accident or incident in which law enforcement is interested but the patient is not in the custody of law enforcement, law enforcement officials may not photograph the patient, obtain evidence or enter the patient care area unless the healthcare entity obtains the patient’s permission.
If the patient is not able to provide permission, a manager/ administrator may exercise professional judgment as appropriate to allow law enforcement to photograph the patient and/or obtain evidence.
1. Use or disclosure requirements.
UW Medicine workforce members may use or disclose PHI to assist in the patient’s care or to notify a family member, personal representative or other person responsible for the care of the patient only in one of the following situations:
a. When the patient agrees to the use or disclosure.
b. When the patient is given an opportunity to agree or object and does not object to the use or disclosure.
c. When the patient is a minor and the disclosure complies with section 5 below.
d. When the patient is not present or is incapacitated, or the circumstances are emergent, and the workforce member has determined, based upon professional judgment or good medical practice, that the use or disclosure is in the best interest of the patient.
e. When the patient is deceased and a personal representative of the deceased patient exercises all of the deceased patient’s rights. If there is no personal representative, or upon discharge of the personal representative, a deceased patient’s rights may be exercised by persons who would have been authorized to make healthcare decisions for the deceased patient when the patient was living.
Patients may instruct UW Medicine in writing not to make disclosures to the patient’s immediate family members (including a patient’s state registered domestic partner), a personal representative, or any other individual with whom the patient is known to have a close personal relationship.
Additionally, a personal representative or legally authorized surrogate decision-maker can make decisions concerning the use, access and disclosure of a patient’s PHI. For information on how family members can act as surrogate decision makers for healthcare services, see the UW Medicine Consent Manual (VMC workforce, see VMC Risk Management).
2. Abuse, neglect, and endangerment situations.
UW Medicine workforce, in exercising professional judgment, may elect not to disclose PHI to a person, personal representative or legally authorized surrogate of a patient, if there is a reasonable belief that the patient has been, or may be subjected to domestic violence, abuse or neglect by such person, or that disclosing PHI to such person could endanger the patient.
3. Disclosure limitations.
When disclosure is determined to be appropriate, UW Medicine workforce members may disclose to the patient’s immediate family members (including a patient’s state registered domestic partner), a personal representative, or any other individual with whom the patient is known to have a close personal relationship, only the PHI which is directly relevant to the individual’s involvement in the:
a. Treatment and care of the patient; or
b. Payment related to the patient’s healthcare
If the use or disclosure is made in accordance with item III.D.1 above, UW Medicine workforce members may use or disclose PHI to notify or assist in the notification of (including identifying or locating) the patient’s immediate family members (including a patient’s state registered domestic partner), a personal representative or others responsible for the patient’s care, of the location, general condition, or death of the patient.
5. Disaster relief purposes.
Workforce members may use or disclose PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities to notify or assist in the notification of (including identifying or locating) a family member, a personal representative of the patient or another person responsible for the care of the patient about the patient’s location, general condition or death. The use or disclosure must be made in accordance with the requirements outlined in item 1 above, to the extent that the workforce member, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.
6. Minor patients.
a. Workforce members may disclose PHI to a minor patient’s parent, guardian or other person acting in loco parentis who has authority to make decisions for a minor regarding the use, access or disclosure of the minor’s PHI, except in the following situations:
i. When the minor is emancipated, the minor is treated the same as an adult with respect to use and disclosure of the minor’s PHI.
ii. When the minor may lawfully consent to a healthcare service without parental consent under Washington State law and the minor does not want information about the service disclosed to a parent, guardian or other person acting in loco parentis, workforce members shall not disclose the visit information or services to a parent or others, or bill the services to the parent’s or other’s insurance, without the minor’s consent (with one exception* noted below).
In Washington State, minors may request that PHI related to the following services not be disclosed to a parent, guardian or other person acting in loco parentis, or billed to that individual’s insurance:
a) STD treatment/testing, to include HIV (if 14 years of age or older);
b) Birth control services (any age);
c) Abortion services (any age);
d) Prenatal care services (any age);
e) Outpatient or inpatient mental health services* (if 13 years of age or older);
f) Outpatient substance abuse treatment (if 13 years of age or older);
g) Inpatient substance abuse treatment (if 13 years of age or older and the Washington State Department of Social and Health Services determines he or she is a child in need of services).
Exception: Workforce members shall disclose the following information to a minor’s parent(s) in order to comply with Washington state reporting requirements for a minor’s voluntary admission for inpatient mental health services:
• The minor has been admitted to inpatient treatment;
• The location and telephone number of the facility providing such treatment;
• The name of a professional person on the staff of the facility providing treatment who is designated to discuss the minor’s need for inpatient treatment with the parent;
• The medical necessity for admission
iii. When a parent who has the authority to consent for a minor chooses to permit certain healthcare services to be confidential between healthcare professionals and the minor, the minor may make decisions concerning UW Medicine’s use and disclosure of the PHI related to the services.
iv. When there is documentation that a court has terminated the parental rights of one or both parents, UW Medicine workforce members shall not release records to the parent who has lost parental rights. In the absence of such documentation, both parents are deemed to have equal rights and access.
b. If the parent has the right to access the minor’s medical record, UW Medicine workforce members may release records to both custodial and non-custodial parents.
c. When a minor’s mental health information is disclosed for any purpose, the UW Medicine workforce member must document the following in the minor’s medical record:
i. The date of the disclosure;
ii. The circumstances under which the disclosure is made;
iii. The name or names of the persons or agencies to whom such disclosure is made;
iv. The relationship, if any, to the minor; and
v. The information disclosed.
7. Patient portal proxy access to a patient’s online personal health information.
Patients can use UW Medicine patient portals, which are secure internet tools, to access their care team and PHI. Proxy access allows an authorized person to have online patient portal access for the patient.
a. Patients under 13 years old.
A parent, guardian or other person acting in loco parentis may be granted proxy access for the patient.
b. Patients 13 years and older.
Patient portal proxy access is not allowed for minor patients 13 years and older except in the following situations:
i. When the minor is emancipated; or
ii. When a healthcare professional determines that the minor patient has diminished capacity and that proxy access is in the patient’s best interest.
c. Adult patients.
Patient portal proxy access for an adult patient is allowed only when the adult patient or his/her guardian has authorized that proxy access can be granted to a representative.
Uses or disclosures of PHI other than those described in Sections II or III of this policy require written patient authorization. This section provides additional information about certain types of such disclosures.
1. Psychotherapy notes are notes, recorded in any medium, by a behavioral health professional, 1) analyzing or detailing the explicit contents of conversation during a private counseling session or a group, joint, or family counseling session and 2) that are separated from the rest of the individual’s medical record. Examples of Psychotherapy notes include documentation of intimate personal content, details of fantasies and dreams, process interactions, sensitive information about other individuals in the patient’s life or the mental healthcare professional’s personal reactions, hypotheses or speculations as a result of a patient or group interaction.
2. Psychotherapy notes are a narrowly defined subset of PHI with stronger privacy protections than other types of PHI. The purpose for the heightened protection is to foster effective treatment by increasing patient confidence that intimate mental healthcare information will not be used or disclosed without the patient’s authorization, except in certain instances.
3. Mental health records that do not qualify as psychotherapy notes are subject to the same general privacy protections as for other PHI (with certain restrictions as outlined in Section II.M. of this policy).
4. Psychotherapy notes are not part of the designated record set. All original copies are maintained in separate therapist files or stored similarly in electronic format. Psychotherapy notes maintained in electronic format must only be accessible by the author of the notes. The author of psychotherapy notes is responsible for the maintenance, storage and safeguarding of the notes. The author of the notes determines the retention timeframe based upon when the notes are no longer useful for treatment and/or after treatment has been concluded.
5. The general exceptions allowing use or disclosure of PHI without patient authorization do not apply to psychotherapy notes. Workforce members may not use or disclose psychotherapy notes without patient authorization for any purpose other than the following:
a. Use by the author of the psychotherapy notes for treatment;
b. Use or disclosure to conduct UW Medicine training programs in which students, trainees or practitioners in mental health learn, under supervision, to practice or improve their skill in group, joint, family or individual counseling;
c. Use or disclosure for a UW Medicine entity to defend a legal action or other proceeding, such as a complaint, brought by the patient;
d. Use or disclosure to the Secretary of the U.S. Department of Health and Human Services (DHHS) to assure compliance with HIPAA;
e. Use or disclosure to a health oversight agency for the purpose of oversight of the author of the psychotherapy notes;
f. Use or disclosure to a coroner or medical examiner for official duties (Section II.E);
g. Use or disclosure as necessary and as reasonably able to prevent or lessen a serious or imminent threat to the health and safety of a person or the public (see Section II.F);
h. Use or disclosure to respond as required for judicial and administrative proceedings (see Section II.H);
i. Use or disclosure to law enforcement as required by law (see Section II.I); or
j. Use or disclosure to report suspected child abuse or neglect as required by law (see Section II.J).
Heightened standards of confidentiality are required when using or disclosing PHI pertaining to mental health, HIV testing and other STDs. Other than for TPO, most uses or disclosures of this information require patient authorization – exceptions are noted in Section II.M of this policy.
Workforce members may use or disclose PHI for research purposes in accordance with HIPAA, the Common Rule and Washington law.
1. PHI, including the PHI of decedents, may be used or disclosed for research purposes only when one of the five following conditions is met:
a. With a valid authorization of the patient or the patient’s personal representative. In the absence of a personal representative for decedents, authorization may be provided by the individual who had authority to make healthcare decisions on behalf of the deceased patient. See UW Medicine Consent Manual (VMC workforce, see VMC Risk Management).
i. An authorization is not applicable to additional future research unless the authorization specifically and clearly states that the data will be used in the future for additional research.
ii. Researchers are advised to use the UW Medicine approved HIPAA Authorization template (but may use an equivalent form): https://www.washington.edu/research/forms-and-templates/template-hipaa-authorization/.
b. When an IRB waives the requirement for patient authorization, in accordance with federal and state patient privacy laws, and all of the following conditions are met:
i. The waiver or alteration of authorization document contains the following elements:
a) The identity of the IRB (IRB federal registration number and local identifying name).
b) The date on which the alteration or waiver of authorization was approved.
c) A brief description of the PHI for which use or access has been determined to be necessary by the IRB or Privacy Board.
d) Statement that the alteration or waiver of authorization has been reviewed and approved under either full IRB or expedited review procedures as follows:
1) The IRB followed the requirements of the federal human subjects regulations, including the criteria for full or expedited IRB review; and
2) The IRB chair or designee has signed the documentation of the alteration or waiver of authorization.
e) Statement that the IRB has determined that the alteration or waiver of authorization, in whole or in part, satisfies the following criteria:
1) Use or disclosure of PHI involves no more than minimal risk to the privacy of individuals, based on, at least, the presence of the following elements:
• An adequate plan to safeguard the identifiers from improper use and disclosure;
• An adequate plan to destroy the identifiers consistent with the conduct of the research and in accordance with retention policies, , unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and
• Adequate written assurances that the PHI will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of PHI would be permitted.
2) The research could not practicably be conducted without the alteration or waiver.
3) The research could not practicably be conducted without access to and use of PHI.
ii. The researcher has entered into a confidentiality agreement with the designated data custodian or the data custodian’s designee in accordance with Washington State law (RCW 42.48). (See additional guidance and an agreement template at http://www.washington.edu/research/forms-and-templates/zipline-and-paper-template-confidentiality-agreement/).
iii. The researcher obtaining PHI under a waiver of authorization accounts for the disclosure of all PHI used, in accordance with the accounting of disclosures section in COMP.104 Patient Rights Related to PHI.
c. When the health information is de-identified prior to its release for research and the following conditions are met:
i. De-identification must be in accordance with Section VI of this policy.
ii. De-identification may be made by an individual who is designated and trained to perform this function, is either part of the UW Medicine workforce or a business associate of UW Medicine and is not a member of the research team to which the de-identified information will be provided.
e. When the information is collected as preparatory to researchand the researcher has attested to the following three conditions:
i. Use or disclosure of the PHI is sought solely to review it for the purpose of preparing a research protocol or planning the research activity. (For example, a researcher may review PHI to design a research study or to assess whether a sufficient number or type of records exist to conduct the research);
ii. No PHI will be removed from the UW Medicine covered entity by the researcher in the course of the review;
iii. The PHI for which use or disclosure is sought is necessary for the research purposes.
Receipt of or access to patient names and contact information to identify possible research participants requires IRB approval, including patient authorization or a waiver of HIPAA authorization.
2. Case Reports/Studies
The policy requirements articulated in Section IV.C of this policy regarding research apply to case reports and case studies that meet the federal definition of research. The Human Subjects Division website provides information on how to fulfill IRB requirements if any are applicable.
1. Workforce members shall not use or disclose PHI for marketing without written patient authorization, except when the communication is in the form of:
a. A face-to-face communication between a workforce member and the patient; or
b. A promotional gift of nominal value provided by UW Medicine.
2. If the marketing involves financial remuneration to UW Medicine from a third party, the patient authorization must state that such remuneration is involved.
3. The following types of communications from UW Medicine to patients are not considered to be marketing (unless UW Medicine receives financial remuneration in exchange for making the communication):
a. Communications to describe health-related products or services (or payment for such products or services);
b. Communications about a patient’s treatment, health-related products or services, case management or care coordination;
c. Refill reminders or other communications about a patient’s current prescriptions for drugs or biologics (if UW Medicine receives financial remuneration in exchange for making the communication and the remuneration is reasonably related to the cost of making the communication, it is not considered to be marketing);
d. Directives or recommendations for alternative treatments, therapies or healthcare professionals, or for settings of care for the patient. For example, it is not marketing when a physician describes and refers a patient to the services offered by another UW Medicine healthcare professional specializing in care that is appropriate to the patient’s treatment plan.
4. UW Medicine occasionally purchases external mailing lists for direct mail marketing activities. Patients who wish to be removed from these lists shall be directed to the mailing house that owns the list. UW Medicine will make information pertaining to commercial mailing lists available upon request.
Except as defined below, a signed patient authorization is not a waiver of any rights a patient has under other statutes, the rules of evidence or common law.
1. A valid authorization to allow use and disclosure of PHI shall be written in plain language and contain at least the following core elements:
a. The patient’s name, signature and date, or the signature and date of the patient’s personal representative or surrogate decision maker;
b. A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion;
c. The name or other identification of the person(s) or class of persons, agency, or organization authorized to make the requested use or disclosure;
d. The name or other identification of the person(s) or class of persons, agency, or organization to whom UW Medicine is authorized to make the requested disclosure;
e. A description of each purpose of the requested use or disclosure (a workforce member may add the statement “at the request of the patient” when a patient initiates the authorization and does not, or elects not to, provide a statement of the purpose);
f. An expiration date or an expiration event that relates to the patient or the purpose of the use or disclosure;
i. Where the patient is under the supervision of the department of corrections, an authorization signed pursuant to this section for healthcare information related to mental health or drug or alcohol treatment expires at the end of the term of supervision; unless the patient is part of a treatment program that requires the continued exchange of information until the end of the period of treatment;
g. A statement of the patient’s right to revoke the authorization in writing, the exceptions to the patient’s right to revoke the authorization, and a description of how the patient can make a revocation;
h. A statement that UW Medicine will not condition treatment or payment based on the patient’s provision of an authorization for the requested use or disclosure, except:
i. UW Medicine may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of PHI for such research; or
ii. UW Medicine may condition the provision of healthcare that is solely for the purpose of creating PHI for disclosure to a third party on provision of an authorization for the disclosure of the PHI to such third party;
i. A statement that when the information is used or disclosed in accordance with a signed authorization, it may be subject to re-disclosure by the recipient and may no longer be protected by state and federal laws protecting healthcare information; and
j. If the authorization is signed by the patient’s personal representative or surrogate decision maker, the authorization shall include a description of the signatory’s authority.
2. Certain types of PHI are entitled to heightened confidentiality. Workforce members shall not disclose these types of PHI unless the authorization explicitly documents the patient’s authorization to release them. These types of PHI include information about:
• STDs, including but not limited to AIDS or HIV;
• Behavioral or mental health services; and
• Treatment for alcohol or drug abuse.
a. When disclosure of the above types of PHI about patients is not for TPO purposes, workforce members shall add a written confidentiality statement to the authorization form addressing the prohibition of re-disclosure of any PHI. The statement must include the following or substantially similar language:
“This information has been disclosed to you from records whose confidentiality is protected by state law. State law prohibits you from making any further disclosure of it without the specific written authorization of the person to whom it pertains, or as otherwise permitted by state law. A general authorization for the release of medical or other information is NOT sufficient for this purpose.”
b. If the non-TPO disclosure is made verbally, the same written confidentiality statement as above is required; the workforce member shall send the statement within 10 days of the disclosure. Whenever a workforce member makes a verbal disclosure of PHI related to STDs, the workforce member must complete an authorization that captures all required information and add it to the patient’s designated record set. The The 103.F9 UH1866: Record of the Verbal Disclosure of Protected Health Information form (VMC, see here) may be used for this purpose.
3. The authorization may contain other elements or information if not inconsistent with Section V.A. of this policy.
An authorization is invalid under any of the following circumstances:
1. The authorization lacks one of the required core elements of a valid authorization as defined in Section V.A of this policy;
2. The expiration date has passed or the expiration event is known by UW Medicine to have occurred;
3. UW Medicine is aware that the authorization has been revoked by the patient;
4. The authorization violates the prohibitions stated in Section V.C of this policy;
5. A UW Medicine workforce member receives an authorization that contains information that the workforce member knows to be false;
6. The patient makes any revisions or alterations to the required core elements of the authorization form.
UW Medicine shall not condition provision of individual treatment or payment on the provision of an authorization except in the following situations:
1. Research-related treatment may be conditioned on provision of an authorization for the use or disclosure of PHI for such research; or
2. Healthcare that is solely for the purpose of creating PHI for disclosure to a third party may be conditioned on provision of an authorization for the disclosure of the PHI to such third party.
An authorization for use or disclosure of PHI shall not be combined with any other document except in the following situations:
1. An authorization for the use or disclosure of PHI for a research study may be combined with any other type of written permission for the same or another research study. This includes creating a compound authorization for the use or disclosure of PHI for a research study with:
a. Another authorization for the same research study,
b. An authorization for the creation or maintenance of a research database or repository, or
c. A consent to participate in research.
Where UW Medicine has conditioned the provision of research-related treatment on the provision of one of the authorizations, any compound authorization created shall clearly differentiate between the conditioned and unconditioned components. For the unconditioned components, workforce members shall provide the patient with an opportunity to opt in to the research activities described in the authorization.
2. For psychotherapy notes, authorization for use or disclosure may only be combined with another authorization for a use or disclosure of psychotherapy notes.
1. When a patient provides written authorization for a use or disclosure, workforce members shall adhere to the conditions and limitations of the authorization.
2. Authorization forms shall be directed to the applicable HIM department for processing.
3. UW Medicine shall act upon all authorizations within 15 working days as required by state law.
4. UW Medicine shall provide the patient with a copy of the signed authorization.
5. UW Medicine shall document and retain in electronic or written format all signed authorizations and actions taken in response to the authorizations in the designated record set.
Patients (or their personal representatives or surrogate decision makers) may revoke authorizations in writing at any time unless:
1. UW Medicine has already taken substantial action based on the original authorization; or
2. The authorized use or disclosure is necessary for UW Medicine to be compensated for treatment already provided to the patient.
A patient’s revocation instruction shall be shared with all impacted HIM departments.
1. Limited data set description
A limited data set is PHI that excludes the following direct identifiers of the patient or of relatives, employers, or household members of the patient:
b. Postal address information, other than town or city, state and zip code;
c. Telephone numbers;
d. Fax numbers;
e. Electronic mail addresses;
f. Social security numbers;
g. Medical record numbers;
h. Health plan beneficiary numbers;
i. Account numbers;
j. Certificate/license numbers;
k. Vehicle identifiers and serial numbers, including license plate numbers;
l. Device identifiers and serial numbers;
m. Web universal resource locators (URLs);
n. Internet protocol (IP) address numbers;
o. Biometric identifiers, including finger and voice prints; and
p. Full face photographic images and any comparable images.
2. Permitted purposes for uses and disclosures of limited data sets
a. Workforce members may use or disclose a limited data set only when the following conditions are met:
i. The use or disclosure of the limited data set is for the purpose of research, public health or healthcare operations; and
ii. The workforce member has obtained satisfactory assurance, in the form of a data use agreement that meets the requirements in Section VI.A.4 below, that the recipient will only use or disclose the PHI for limited and specified purposes.
3. Creating limited data sets
Workforce members may use PHI to create a limited data set that meets the requirements in Section VI.A.2 above, or disclose PHI to a business associate for such purpose, regardless of whether the limited data set is to be used by UW Medicine.
4. Data use agreement requirements
a. The data use agreement shall not authorize the recipient to use or further disclose the information in a manner that, if done by UW Medicine, would violate the requirements of this policy.
b. The data use agreement between UW Medicine and the limited data set recipient shall:
i. Establish the permitted uses and disclosures of the limited data set by the recipient for purposes of research, public health, or healthcare operations;
ii. Establish who is permitted to use or receive the limited data set;
iii. Require that the recipient will:
a) Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;
b) Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement;
c) Report to UW Medicine any use or disclosure of information that is not allowed by the data use agreement;
d) Ensure that any agents to whom it provides the limited data set agree to and abide by the same restrictions and conditions that apply to the limited data set recipient; and
e) Not try to identify the information or contact the patients.
5. Non-compliance with data use agreement:
a. If UW Medicine learns of a pattern of activity or practice by the limited data set recipient that constitutes a material breach or violation of the data use agreement, UW Medicine shall take reasonable steps to cure the breach or end the violation, as applicable. If such steps are unsuccessful, UW Medicine shall:
i. Discontinue disclosure of PHI to the recipient; and
ii. Report the problem to the Secretary of the U.S. Department of Health and Human Services (DHHS).
b. A UW Medicine workforce member who suspects or discovers a violation of a data use agreement shall report the matter to UW Medicine Compliance for investigation and resolution of any confirmed violation.
c. If UW Medicine is the recipient of a limited data set and a workforce member suspects or discovers a violation of the associated data use agreement, the workforce member shall report the matter to UW Medicine Compliance for investigation and immediate resolution of any confirmed violation.
UW Medicine Compliance shall take immediate steps to stop any unauthorized disclosure, cure any resulting breach of confidentiality, and report any violation of the data use agreement to the disclosing entity.
Federal and state law do not protect health information that does not identify an individual and cannot be used to identify an individual.
1. Requirements for de-identification of PHI
One of the following two methods shall be used to demonstrate that PHI is de-identified:
a. Method One. A workforce member removes all of the following eighteen (18) identifiers of the patient or of the patient’s relatives, employers or household members, provided that the workforce member does not have knowledge that the information could be used alone or in combination with other information to identify the patient. The eighteen (18) identifiers are:
ii. All geographic subdivisions smaller than state including:
a) Street Address
e) Zip code and equivalent geo code
except if the initial three digits of a zip code:
1) Represents a geographic unit in which combining all zip codes with the same 3 initial digits contains more than 20,000 people; and
2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people are changed to “000.”
iii. All elements of dates (except year) directly related to an individual including:
a) Birth date;
b) Admission date;
c) Discharge date;
d) Date of death; and
e) All ages over 89, including date elements indicative of such age, including year, except when all ages of 90 or older can be aggregated into a single category;
iv. Telephone numbers;
v. Fax numbers;
vi. E-mail addresses;
vii. Social security numbers;
viii. Medical record numbers;
ix. Health plan beneficiary numbers;
x. Account numbers;
xi. Certificate/license numbers;
xii. Vehicle identifiers and serial numbers (including license plate numbers);
xiii. Device identifiers and serial numbers;
xiv. Web universal resource locators (URLs);
xv. Internet protocol (IP) address numbers;
xvi. Biometric identifiers, including finger/voice prints;
xvii. Full face photographic images and any comparable images; and
xviii. Any other unique identifying number, characteristic or code;
b. Method Two. A person with appropriate knowledge and experience applying generally accepted statistical and scientific methods for rendering information not individually identifiable:
i. Applies such principles/methods;
ii. Determines the risk is very small that the information could be used alone or in combination with other available information to identify an individual; and
iii. Documents the methods and results of the analysis that justify the determination.
2. Re-identification requirements
A workforce member may assign a code or other means of record identification to allow information that has been de-identified through Method One or Two in Section VI.B.1 above to be re-identified, provided that the following two conditions are met:
a. The code or other means of record identification is not derived from or related to information about the patient and cannot otherwise be translated to identify the patient; and
b. The workforce member does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism used for re-identification.
The workforce member determines where to maintain the codes for re-identification and how they are secured.
Inappropriate use or disclosure of the code or other means of record identification may constitute a disclosure of PHI and may trigger a breach or violation of a data use agreement.
Members of the public may make requests for information from the University through the UW Office of Public Records. If the Office of Public Records receives a request for UW Medicine information, the Office of Public Records works with the appropriate UW Medicine contact to process the request. UW Medicine shall comply with state and federal patient privacy laws when responding to such requests.
There are three options when processing a public records request that includes patient information:
1. If the request is for an individual’s patient medical record, the Office of Public Records refers the requestor to the appropriate health information management department. These types of requests require a valid authorization.
2. If there is a reasonable basis to believe that the requested information can be used to identify a UW Medicine patient(s) (a relative, the employer or a household member of the individual patient) the information cannot be provided to the requestor without a valid patient authorization. The workforce member shall inform the requestor that the information cannot be released because it might lead to identification of UW Medicine patients (or a relative, the employer or a household member of the individual patient), and that authorization from those unnamed patients is required for release.
3. If the request is for multiple patients or information that contains multiple patients’ information, the patient information must be de-identified before it is released. In processing the request, the entity contact highlights the information that may need to be redacted before it is sent to the Office of Public Records. The Office of Public Records reviews the information to ensure that all appropriate individual identifiers are redacted before it is released to the requestor. Workforce members shall use the following guiding principles when reviewing the information:
• De-identify all information about individuals if they cannot be clearly identified as workforce members on the job or if there is evidence to conclude that:
o The individual is seeking care;
o It is a relative of an individual seeking care;
o It is an employer of an individual seeking care; or
o It is a household member of an individual seeking care.
Workforce members may disclose PHI to a Business Associate only when all requirements outlined in COMP.106 Use and Disclosure of PHI by Business Associates are met.
- UW Medicine Compliance Glossary.
- 103.F1 UH2883 Mandatory Violent Injury Report. (VMC, see here)
- 103.F2 Release of Patient Property to Law Enforcement Form.
- 103.F3 UH2884 Law Enforcement Request for Information.
(VMC, see here)
- 103.F4 UH1868 Patient Information for Inclusion in the UW Medicine Patient Directory.
(VMC, see here)
- 103.F5 UH3293 UW Medicine Request for Minor Proxy eCare Access.. (VMC, see here)
- 103.F6 UH3292 UW Medicine Request for Adult Proxy eCare Access. (VMC, see here)
- 103.F7 UH0626 Patient Authorization for UW Medicine to Disclose, Release or Obtain PHI.
(VMC, see here)
- 103.F8 Release of Information Coordination And Action Response Form.
- 103.F9 UH1866 Record of Verbal Disclosure of PHI. (VMC, see here)
- 103.F10 UH3031 Patient Authorization to Use & Disclose PHI for Publication. (VMC, see here)
- 103.F11 UH0324 Patient Authorization to Use or Disclose Photography/Video Tape. (VMC, see here)
- 103.F12 UH1874 Patient Authorization for UW Medicine to Use or Disclose PHI for Publicity.
(VMC, see here)
- 103.G1 Treatment, Payment and Healthcare Operations.
- 103.G2 Minimum Necessary Decision Tree.
- 103.G3 Law Enforcement Requests Disclosure of Patient Information.
- 103.G4 Parent / Guardian eCare Account Request Process.
- 103.G5 Adult/Proxy eCare Account Request Process.
- 103.G6 Deactivation of eCare Proxy Access.
- 103.G7 Prohibition on Re-disclosure.
- 103.T1 Sample Letter: Subpoena Unenforceable.
- 103.T2 Sample Letter: Subpoena Rejection.
- 103.T3 Sample Letter: Rejection, Out of State Subpoena.
- 103.T4 Sample Letter: PHI – Incomplete Request.
- 103.T5 Sample Letter: UW Medicine Authorization to Disclose PHI Status Update Letter to Patient.
- 103.T6 Data Use Agreement for Limited Data Set (for individuals or entities NOT part of UW Medicine workforce).
- 103.T7 Data Use Agreement for Limited Data Set for UW Medicine workforce.
- 002.F1 Privacy, Confidentiality, and Information Security Agreement.
- 104.F1 Joint Notice of Privacy Practices of UW Medicine. (Joint Notice of Privacy Practices)
- Wearable Technology Guidance.
- UW Administrative Policy Statement (APS) 2.4: Information Security and Privacy Roles, Responsibilities, and Definitions.
- UW Data Security and Privacy Agreement.
- UW Medicine Informed Consent Manual. (VMC, see VMC Risk Management)
- UW Research – Case Report – IRB and HIPAA Requirements.
- UW Research – Human Subjects Division – Subject Privacy, Confidentiality and Identifiable Data.
- UW Research Confidentiality Agreement.
- Protection of Human Subjects, 21 C.F.R. § 50.3.
- Mine Safety and Health Act, 29 C.F.R. §§ 50-90.
- Occupational Safety and Health Act, 29 CFR §§1904 – 1928.
- Confidentiality of Substance Abuse Disorder Patient Records, 42 CFR §2.
- Protection of Human Subjects, 45 C.F.R. § 46.
- General Provisions, 45 C.F.R. § 160, Subpart A.
- Compliance and Investigations, 45 C.F.R. § 160, Subpart C.
- General Provisions, 45 C.F.R. § 164, Subpart A.
- Security Standards for the Protection of Electronic PHI, 45 C.F.R. § 164, Subpart C.
- Notification in the Case of Breach of Unsecured PHI, 45 C.F.R. § 164, Subpart D.
- Privacy of Individually Identifiable Health Information, 45 C.F.R. § 164, Subpart E.
- RCW 7.70.050 Failure to secure informed consent — Necessary elements of proof — Emergency situations.
- RCW 7.70.065 Informed consent – Persons authorized to provide for patients who are not competent.
- RCW 9.02.100 Reproductive privacy — Public policy.
- RCW 13.34.060 Juvenile Court Act – Shelter care — Placement — Custody — Duties of parties.
- RCW 18.130 Regulation Of Health Professions — Uniform Disciplinary Act.
- RCW 26.28.010 Age of majority.
- RCW 26.44.020 Abuse of Children – Definitions.
- RCW 26.44.030 Abuse of Children – Reports — Duty and authority to make — Duty of receiving agency — Duty to notify — Case planning and consultation — Penalty for unauthorized exchange of information — Filing dependency petitions — Investigations — Interviews of children — Records — Risk assessment process.
- RCW 26.44.060 Immunity from civil or criminal liability—Confidential communications not violated—Actions against state not affected—False report, penalty.
- RCW 42.56 Public Records Act.
- RCW 42.48 Release of Records for Research.
- RCW 46.20.308 Drivers’ Licenses – Implied consent – Test refusal – Procedures.
- RCW 46.61.506 Persons under influence of intoxicating liquor or drug—Evidence—Tests—Information concerning tests.
- RCW 49.17 WA Industrial Safety and Health Act.
- RCW 51.36.060 Washington Workers’ Compensation Act – Duties of Attending Physician.
- RCW 68.50 Human Remains.
- RCW 70.02 Medical Records – Healthcare Information Access and Disclosure.
- RCW 70.24.110 Minors — Treatment, consent, liability for payment for care.
- RCW 70.24.340 Convicted persons—Mandatory testing and counseling for certain offenses—Employees’ substantial exposure to bodily fluids—Procedure and court orders.
- RCW 70.41.020 Hospital Licensing and Regulations Definitions.
- RCW 70.41.440 Duty to report violent injuries — Preservation of evidence — Immunity — Privilege.
- RCW 70.58 Vital Statistics.
- RCW 70.96A — Treatment for Alcoholism, Intoxication, and Drug Addiction.
- RCW 71.05.120 Exemptions from Liability.
- RCW 71.05.330 Early release—Notice to court and prosecuting attorney—Petition for hearing.
- RCW 71.05.340 Outpatient treatment or care—Conditional release.
- RCW 71.05.425 Persons committed following dismissal of sex, violent, or felony harassment offense—Notification of conditional release, final release, leave, transfer, or escape—To whom given—Definitions.
- RCW 71.05. 445 Court-ordered mental health treatment of persons subject to department of corrections supervision—Initial assessment inquiry—Required notifications—Rules.
- RCW 71.05.620 Court files and records closed—Exceptions—Rules.
- RCW 71.34.500 Minor thirteen or older may be admitted for inpatient mental treatment without parental consent — Professional person in charge must concur — Written renewal of consent required.
- RCW 71.34.530 Age of consent — Outpatient treatment of minors.
- RCW 74.34.035 Abuse of Vulnerable Adults – Reports – Mandated and Permissive – Contents – Confidentiality.
- Washington Administrative Code (WAC) 246-08-400 “How much can a health care provider charge for searching and duplicating medical records?”
- WAC 246-101-010(40) Definition of Sexually Transmitted Disease.
- WAC 246-320-166 Management of information.
- WAC 296-62 General Occupational Health Standards.
- WAC 388-865-0640 Community Mental Health and Involuntary Treatment Records – Written requests.
- Const. art. 1, § 11.
- Washington State Hospital Association (October 2014). Guide For Cooperation For Physicians, Hospitals, and Media in the State of Washington. Retrieved from http://www.wsha.org/wp-content/uploads/GUIDE-FOR-COOPERATION-2014.pdf.
- Washington State Hospital Association (November 2017). Hospital and Law Enforcement Guide to Health Care Related Disclosure. Retrieved from http://www.wsha.org/wp-content/uploads/Law-Enforcement-Guide-2017-11.20.17-FINAL.pdf.
- State v. Koome, 84 Wn.2d 901 (1975).
- Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT Act) Act, Pub. Law 107–56 (Oct. 26, 2001).
- Access to certain business records for foreign intelligence and international terrorism investigations, 50 U.S.C. §1861(d).