Chapter 70

(1) Health care information is personal and sensitive information that if improperly used or released may do significant harm to a patient's interests in privacy, health care, or other interests.

(2) Patients need access to their own health care information as a matter of fairness to enable them to make informed decisions about their health care and correct inaccurate or incomplete information about themselves.

(3) In order to retain the full trust and confidence of patients, health care providers have an interest in assuring that health care information is not improperly disclosed and in having clear and certain rules for the disclosure of health care information.

(4) Persons other than health care providers obtain, use, and disclose health record information in many different contexts and for many different purposes. It is the public policy of this state that a patient's interest in the proper use and disclosure of the patient's health care information survives even when the information is held by persons other than health care providers.

(5) The movement of patients and their health care information across state lines, access to and exchange of health care information from automated data banks, and the emergence of multistate health care providers creates a compelling need for uniform law, rules, and procedures governing the use and disclosure of health care information.

[1991 c 335 § 101.]

RCW 70.02.010
Definitions.
The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Audit" means an assessment, evaluation, determination, or investigation of a health care provider by a person not employed by or affiliated with the provider to determine compliance with:

(a) Statutory, regulatory, fiscal, medical, or scientific standards;

(b) A private or public program of payments to a health care provider; or

(2) "Directory information" means information disclosing the presence, and for the purpose of identification, the name, residence, sex, and the general health condition of a particular patient who is a patient in a health care facility or who is currently receiving emergency health care in a health care facility.

(3) "General health condition" means the patient's health status described in terms of "critical," "poor," "fair," "good," "excellent," or terms denoting similar conditions.

(4) "Health care" means any care, service, or procedure provided by a health care provider:

(a) To diagnose, treat, or maintain a patient's physical or mental condition; or

(b) That affects the structure or any function of the human body.

(5) "Health care facility" means a hospital, clinic, nursing home, laboratory, office, or similar place where a health care provider provides health care to patients.

(6) "Health care information" means any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient's health care, including a patient's deoxyribonucleic acid and identified sequence of chemical base pairs. The term includes any record of disclosures of health care information.

(7) "Health care provider" means a person who is licensed, certified, registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession.

(8) "Institutional review board" means any board, committee, or other group formally designated by an institution, or authorized under federal or state law, to review, approve the initiation of, or conduct periodic review of research programs to assure the protection of the rights and welfare of human research subjects.

(9) "Maintain," as related to health care information, means to hold, possess, preserve, retain, store, or control that information.

(10) "Patient" means an individual who receives or has received health care. The term includes a deceased individual who has received health care.

(11) "Person" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or any other legal or commercial entity.

(12) "Reasonable fee" means the charges for duplicating or searching the record, but shall not exceed sixty-five cents per page for the first thirty pages and fifty cents per page for all other pages. In addition, a clerical fee for searching and handling may be charged not to exceed fifteen dollars. These amounts shall be adjusted biennially in accordance with changes in the consumer price index, all consumers, for Seattle-Tacoma metropolitan statistical area as determined by the secretary of health. However, where editing of records by a health care provider is required by statute and is done by the provider personally, the fee may be the usual and customary charge for a basic office visit.

(13) "Third-party payor" means an insurer regulated under Title 48 RCW authorized to transact business in this state or other jurisdiction, including a health care service contractor, and health maintenance organization; or an employee welfare benefit plan; or a state or federal health benefit program.

[2002 c 318 § 1; 1993 c 448 § 1; 1991 c 335 § 102.]

NOTES:

Reviser's note: For charges or fees under subsection (12) of this section as adjusted by the secretary of health, see chapter 246-08 WAC.

Effective date -- 1993 c 448: "This act is necessary for the immediate preservation of the public peace, health, or safety, or support of the state government and its existing public institutions, and shall take effect July 1, 1993." [1993 c 448 § 9.]

RCW 70.02.020
Disclosure by health care provider.
Except as authorized in RCW 70.02.050, a health care provider, an individual who assists a health care provider in the delivery of health care, or an agent and employee of a health care provider may not disclose health care information about a patient to any other person without the patient's written authorization. A disclosure made under a patient's written authorization must conform to the authorization.

Health care providers or facilities shall chart all disclosures, except to third-party payors, of health care information, such chartings to become part of the health care information.

[1993 c 448 § 2; 1991 c 335 § 201.]

NOTES:

Effective date -- 1993 c 448: See note following RCW 70.02.010.

RCW 70.02.030
Patient authorization of disclosure.
(1) A patient may authorize a health care provider to disclose the patient's health care information. A health care provider shall honor an authorization and, if requested, provide a copy of the recorded health care information unless the health care provider denies the patient access to health care information under RCW 70.02.090.

(2) A health care provider may charge a reasonable fee for providing the health care information and is not required to honor an authorization until the fee is paid.

(3) To be valid, a disclosure authorization to a health care provider shall:

(a) Be in writing, dated, and signed by the patient;

(b) Identify the nature of the information to be disclosed;

(d) Except for third-party payors, identify the provider who is to make the disclosure; and

(e) Identify the patient.

(4) Except as provided by this chapter, the signing of an authorization by a patient is not a waiver of any rights a patient has under other statutes, the rules of evidence, or common law.

(5) A health care provider shall retain each authorization or revocation in conjunction with any health care information from which disclosures are made. This requirement shall not apply to disclosures to third-party payors.

(6) Except for authorizations given pursuant to an agreement with a treatment or monitoring program or disciplinary authority under chapter 18.71 or 18.130 RCW or to provide information to third-party payors, an authorization may not permit the release of health care information relating to future health care that the patient receives more than ninety days after the authorization was signed. Patients shall be advised of the period of validity of their authorization on the disclosure authorization form. If the authorization does not contain an expiration date, it expires ninety days after it is signed.

[1994 sp.s. c 9 § 741; 1993 c 448 § 3; 1991 c 335 § 202.]

NOTES:

Severability -- Headings and captions not law -- Effective date -- 1994 sp.s. c 9: See RCW 18.79.900 through 18.79.902.

Effective date -- 1993 c 448: See note following RCW 70.02.010.

RCW 70.02.040
Patient's revocation of authorization for disclosure.
A patient may revoke in writing a disclosure authorization to a health care provider at any time unless disclosure is required to effectuate payments for health care that has been provided or other substantial action has been taken in reliance on the authorization. A patient may not maintain an action against the health care provider for disclosures made in good-faith reliance on an authorization if the health care provider had no actual notice of the revocation of the authorization.

[1991 c 335 § 203.]

RCW 70.02.045
Third-party payor release of information.
Third-party payors shall not release health care information disclosed under this chapter, except to the extent that health care providers are authorized to do so under RCW 70.02.050.

[2000 c 5 § 2.]

NOTES:

Intent -- Purpose -- 2000 c 5: See RCW 48.43.005.

Application -- Short title -- Captions not law -- Construction -- Severability -- Application to contracts -- Effective dates -- 2000 c 5: See notes following RCW 48.43.500.

RCW 70.02.050
Disclosure without patient's authorization.
(1) A health care provider may disclose health care information about a patient without the patient's authorization to the extent a recipient needs to know the information, if the disclosure is:

(a) To a person who the provider reasonably believes is providing health care to the patient;

(b) To any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to the health care provider; or for assisting the health care provider in the delivery of health care and the health care provider reasonably believes that the person:

(i) Will not use or disclose the health care information for any other purpose; and

(ii) Will take appropriate steps to protect the health care information;

(c) To any other health care provider reasonably believed to have previously provided health care to the patient, to the extent necessary to provide health care to the patient, unless the patient has instructed the health care provider in writing not to make the disclosure;

(d) To any person if the health care provider reasonably believes that disclosure will avoid or minimize an imminent danger to the health or safety of the patient or any other individual, however there is no obligation under this chapter on the part of the provider to so disclose;

(e) Oral, and made to immediate family members of the patient, or any other individual with whom the patient is known to have a close personal relationship, if made in accordance with good medical or other professional practice, unless the patient has instructed the health care provider in writing not to make the disclosure;

(f) To a health care provider who is the successor in interest to the health care provider maintaining the health care information;

(g) For use in a research project that an institutional review board has determined:

(i) Is of sufficient importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;

(ii) Is impracticable without the use or disclosure of the health care information in individually identifiable form;

(iii) Contains reasonable safeguards to protect the information from redisclosure;

(iv) Contains reasonable safeguards to protect against identifying, directly or indirectly, any patient in any report of the research project; and

(v) Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project;

(h) To a person who obtains information for purposes of an audit, if that person agrees in writing to:

(i) Remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified; and

(ii) Not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the health care provider;

(i) To an official of a penal or other custodial institution in which the patient is detained;

(j) To provide directory information, unless the patient has instructed the health care provider not to make the disclosure;

(k) In the case of a hospital or health care provider to provide, in cases reported by fire, police, sheriff, or other public authority, name, residence, sex, age, occupation, condition, diagnosis, or extent and location of injuries as determined by a physician, and whether the patient was conscious when admitted.

(2) A health care provider shall disclose health care information about a patient without the patient's authorization if the disclosure is:

(a) To federal, state, or local public health authorities, to the extent the health care provider is required by law to report health care information; when needed to determine compliance with state or federal licensure, certification or registration rules or laws; or when needed to protect the public health;

(b) To federal, state, or local law enforcement authorities to the extent the health care provider is required by law;

(d) Pursuant to compulsory process in accordance with RCW 70.02.060.

(3) All state or local agencies obtaining patient health care information pursuant to this section shall adopt rules establishing their record acquisition, retention, and security policies that are consistent with this chapter.

[1998 c 158 § 1; 1993 c 448 § 4; 1991 c 335 § 204.]

NOTES:

Effective date -- 1993 c 448: See note following RCW 70.02.010.

RCW 70.02.060
Discovery request or compulsory process.
(1) Before service of a discovery request or compulsory process on a health care provider for health care information, an attorney shall provide advance notice to the health care provider and the patient or the patient's attorney involved through service of process or first class mail, indicating the health care provider from whom the information is sought, what health care information is sought, and the date by which a protective order must be obtained to prevent the health care provider from complying. Such date shall give the patient and the health care provider adequate time to seek a protective order, but in no event be less than fourteen days since the date of service or delivery to the patient and the health care provider of the foregoing. Thereafter the request for discovery or compulsory process shall be served on the health care provider.

(2) Without the written consent of the patient, the health care provider may not disclose the health care information sought under subsection (1) of this section if the requestor has not complied with the requirements of subsection (1) of this section. In the absence of a protective order issued by a court of competent jurisdiction forbidding compliance, the health care provider shall disclose the information in accordance with this chapter. In the case of compliance, the request for discovery or compulsory process shall be made a part of the patient record.

(3) Production of health care information under this section, in and of itself, does not constitute a waiver of any privilege, objection, or defense existing under other law or rule of evidence or procedure.

[1991 c 335 § 205.]

RCW 70.02.070
Certification of record.
Upon the request of the person requesting the record, the health care provider or facility shall certify the record furnished and may charge for such certification in accordance with RCW 36.18.016(5). No record need be certified until the fee is paid. The certification shall be affixed to the record and disclose:

(1) The identity of the patient;

(2) The kind of health care information involved;

(3) The identity of the person to whom the information is being furnished;

(4) The identity of the health care provider or facility furnishing the information;

(5) The number of pages of the health care information;

(6) The date on which the health care information is furnished; and

(7) That the certification is to fulfill and meet the requirements of this section.

[1995 c 292 § 20; 1991 c 335 § 206.]

RCW 70.02.080
Patient's examination and copying -- Requirements.
(1) Upon receipt of a written request from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall:

(a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient;

(b) Inform the patient if the information does not exist or cannot be found;

(c) If the health care provider does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health care provider who maintains the record;

(d) If the information is in use or unusual circumstances have delayed handling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, not later than twenty-one working days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise disposed of; or

(e) Deny the request, in whole or in part, under RCW 70.02.090 and inform the patient.

(2) Upon request, the health care provider shall provide an explanation of any code or abbreviation used in the health care information. If a record of the particular health care information requested is not maintained by the health care provider in the requested form, the health care provider is not required to create a new record or reformulate an existing record to make the health care information available in the requested form. The health care provider may charge a reasonable fee for providing the health care information and is not required to permit examination or copying until the fee is paid.

[1993 c 448 § 5; 1991 c 335 § 301.]

NOTES:

Effective date -- 1993 c 448: See note following RCW 70.02.010.

RCW 70.02.090
Patient's request -- Denial of examination and copying.
(1) Subject to any conflicting requirement in the public disclosure act, chapter 42.17 RCW, a health care provider may deny access to health care information by a patient if the health care provider reasonably concludes that:

(a) Knowledge of the health care information would be injurious to the health of the patient;

(b) Knowledge of the health care information could reasonably be expected to lead to the patient's identification of an individual who provided the information in confidence and under circumstances in which confidentiality was appropriate;

(c) Knowledge of the health care information could reasonably be expected to cause danger to the life or safety of any individual;

(d) The health care information was compiled and is used solely for litigation, quality assurance, peer review, or administrative purposes; or

(e) Access to the health care information is otherwise prohibited by law.

(2) If a health care provider denies a request for examination and copying under this section, the provider, to the extent possible, shall segregate health care information for which access has been denied under subsection (1) of this section from information for which access cannot be denied and permit the patient to examine or copy the disclosable information.

(3) If a health care provider denies a patient's request for examination and copying, in whole or in part, under subsection (1)(a) or (c) of this section, the provider shall permit examination and copying of the record by another health care provider, selected by the patient, who is licensed, certified, registered, or otherwise authorized under the laws of this state to treat the patient for the same condition as the health care provider denying the request. The health care provider denying the request shall inform the patient of the patient's right to select another health care provider under this subsection. The patient shall be responsible for arranging for compensation of the other health care provider so selected.

[1991 c 335 § 302.]

RCW 70.02.100
Correction or amendment of record.
(1) For purposes of accuracy or completeness, a patient may request in writing that a health care provider correct or amend its record of the patient's health care information to which a patient has access under RCW 70.02.080.

(2) As promptly as required under the circumstances, but no later than ten days after receiving a request from a patient to correct or amend its record of the patient's health care information, the health care provider shall:

(a) Make the requested correction or amendment and inform the patient of the action;

(b) Inform the patient if the record no longer exists or cannot be found;

(c) If the health care provider does not maintain the record, inform the patient and provide the patient with the name and address, if known, of the person who maintains the record;

(d) If the record is in use or unusual circumstances have delayed the handling of the correction or amendment request, inform the patient and specify in writing, the earliest date, not later than twenty-one days after receiving the request, when the correction or amendment will be made or when the request will otherwise be disposed of; or

(e) Inform the patient in writing of the provider's refusal to correct or amend the record as requested and the patient's right to add a statement of disagreement.

[1991 c 335 § 401.]

RCW 70.02.110
Correction or amendment or statement of disagreement -- Procedure.
(1) In making a correction or amendment, the health care provider shall:

(a) Add the amending information as a part of the health record; and

(b) Mark the challenged entries as corrected or amended entries and indicate the place in the record where the corrected or amended information is located, in a manner practicable under the circumstances.

(2) If the health care provider maintaining the record of the patient's health care information refuses to make the patient's proposed correction or amendment, the provider shall:

(a) Permit the patient to file as a part of the record of the patient's health care information a concise statement of the correction or amendment requested and the reasons therefor; and

(b) Mark the challenged entry to indicate that the patient claims the entry is inaccurate or incomplete and indicate the place in the record where the statement of disagreement is located, in a manner practicable under the circumstances.

(3) A health care provider who receives a request from a patient to amend or correct the patient's health care information, as provided in RCW 70.02.100, shall forward any changes made in the patient's health care information or health record, including any statement of disagreement, to any third-party payor or insurer to which the health care provider has disclosed the health care information that is the subject of the request.

[2000 c 5 § 3; 1991 c 335 § 402.]

NOTES:

Intent -- Purpose -- 2000 c 5: See RCW 48.43.005.

Application -- Short title -- Captions not law -- Construction -- Severability -- Application to contracts -- Effective dates -- 2000 c 5: See notes following RCW 48.43.500.

RCW 70.02.120
Notice of information practices -- Display conspicuously.
(1) A health care provider who provides health care at a health care facility that the provider operates and who maintains a record of a patient's health care information shall create a "notice of information practices" that contains substantially the following:

NOTICE

"We keep a record of the health care services we provide you. You may ask us to see and copy that record. You may also ask us to correct that record. We will not disclose your record to others unless you direct us to do so or unless the law authorizes or compels us to do so. You may see your record or get more information about it at . . . . . ."

(2) The health care provider shall place a copy of the notice of information practices in a conspicuous place in the health care facility, on a consent form or with a billing or other notice provided to the patient.

[1991 c 335 § 501.]

RCW 70.02.130
Consent by others -- Health care representatives.
(1) A person authorized to consent to health care for another may exercise the rights of that person under this chapter to the extent necessary to effectuate the terms or purposes of the grant of authority. If the patient is a minor and is authorized to consent to health care without parental consent under federal and state law, only the minor may exercise the rights of a patient under this chapter as to information pertaining to health care to which the minor lawfully consented. In cases where parental consent is required, a health care provider may rely, without incurring any civil or criminal liability for such reliance, on the representation of a parent that he or she is authorized to consent to health care for the minor patient regardless of whether:

(a) The parents are married, unmarried, or separated at the time of the representation;

(b) The consenting parent is, or is not, a custodial parent of the minor;

(c) The giving of consent by a parent is, or is not, full performance of any agreement between the parents, or of any order or decree in any action entered pursuant to chapter 26.09 RCW.

(2) A person authorized to act for a patient shall act in good faith to represent the best interests of the patient.

[1991 c 335 § 601.]

RCW 70.02.140
Representative of deceased patient.
A personal representative of a deceased patient may exercise all of the deceased patient's rights under this chapter. If there is no personal representative, or upon discharge of the personal representative, a deceased patient's rights under this chapter may be exercised by persons who would have been authorized to make health care decisions for the deceased patient when the patient was living under RCW 7.70.065.

[1991 c 335 § 602.]

RCW 70.02.150
Security safeguards.
A health care provider shall effect reasonable safeguards for the security of all health care information it maintains.

Reasonable safeguards shall include affirmative action to delete outdated and incorrect facsimile transmission or other telephone transmittal numbers from computer, facsimile, or other data bases. When health care information is transmitted electronically to a recipient who is not regularly transmitted health care information from the health care provider, the health care provider shall verify that the number is accurate prior to transmission.

[2001 c 16 § 2; 1991 c 335 § 701.]

RCW 70.02.160
Retention of record.
A health care provider shall maintain a record of existing health care information for at least one year following receipt of an authorization to disclose that health care information under RCW 70.02.040, and during the pendency of a request for examination and copying under RCW 70.02.080 or a request for correction or amendment under RCW 70.02.100.

[1991 c 335 § 702.]

RCW 70.02.170
Civil remedies.
(1) A person who has complied with this chapter may maintain an action for the relief provided in this section against a health care provider or facility who has not complied with this chapter.

(2) The court may order the health care provider or other person to comply with this chapter. Such relief may include actual damages, but shall not include consequential or incidental damages. The court shall award reasonable attorneys' fees and all other expenses reasonably incurred to the prevailing party.

(3) Any action under this chapter is barred unless the action is commenced within two years after the cause of action is discovered.

(4) A violation of this chapter shall not be deemed a violation of the consumer protection act, chapter 19.86 RCW.

[1991 c 335 § 801.]

RCW 70.02.180
Licensees under chapter 18.225 RCW -- Subject to chapter.
Mental health counselors, marriage and family therapists, and social workers licensed under chapter 18.225 RCW are subject to this chapter.

[2001 c 251 § 34.]

NOTES:

Severability -- 2001 c 251: See RCW 18.225.900.

RCW 70.02.900
Conflicting laws.
(1) This chapter does not restrict a health care provider, a third-party payor, or an insurer regulated under Title 48 RCW from complying with obligations imposed by federal or state health care payment programs or federal or state law.

(2) This chapter does not modify the terms and conditions of disclosure under Title 51 RCW and chapters 13.50, 26.09, 70.24, 70.39, 70.96A, 71.05, and 71.34 RCW and rules adopted under these provisions.

[2000 c 5 § 4; 1991 c 335 § 901.]

NOTES:

Intent -- Purpose -- 2000 c 5: See RCW 48.43.005.

Application -- Short title -- Captions not law -- Construction -- Severability -- Application to contracts -- Effective dates -- 2000 c 5: See notes following RCW 48.43.500.

RCW 70.02.901
Application and construction -- 1991 c 335.
This act shall be applied and construed to effectuate its general purpose to make uniform the law with respect to the subject of this act among states enacting it.

[1991 c 335 § 903.]

RCW 70.02.902
Short title.
This act may be cited as the uniform health care information act.

[1991 c 335 § 904.]

RCW 70.02.903
Severability -- 1991 c 335.
If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

[1991 c 335 § 905.]

RCW 70.02.904
Captions not law -- 1991 c 335.
As used in this act, captions constitute no part of the law.

[1991 c 335 § 906.]