Washington has taken steps to protect the privacy and confidentiality of patient health information.  Health care providers may not disclose a patient’s health information to any other person without the patient’s written authorization.1  A patient’s authorization must be signed and dated, identify the contents of the disclosure, to whom the disclosure is being made, the person disclosing the information, and have an expiration date.  The law allows patients the ability to revoke the authorization at any time.2  However, the law does outline exceptions that allow a health care provider to disclose health information without a patient’s authorization.  Patient authorization is not needed if the disclosure is for the patient’s health, health care treatment purposes, payment, or research purposes.  Other exceptions include, but are not limited to disclosure to public health officials or to law enforcement.3  Patients have the right to revoke their authorization for disclosure of confidential medical information at any time in writing.4  The law imposes a separate requirement on disclosure of minors’ health information.  It requires that for disclosure of information contained in a minor’s clinical record, the minor’s clinical record must be updated to include the circumstances of the disclosure, the persons that received the information, and their relationship to the patient.5  All communications pertaining to medical treatment between a patient and physician are privileged, and may not be used for trial purposes.6

        The presumption of health information privacy and confidentiality extends to resident health information in long term care facilities,7 nursing homes,8 and enhanced service facilities.9  Prescription information submitted to the Department of Health must remain confidential, and only be disclosed to pharmacists, providers, law enforcement, and other governmental agencies.10  The law provides civil, monetary sanctions for individuals who improperly disclose this information.11  In addition, adverse health event notifications are subject to confidentiality protections.  However, the notification of the adverse event itself is subject to public disclosure, including any contextual information the medical facility chose to provide.12

        Health information that is provided to a health insurance company is also subject to confidentiality provisions under the law.  Records held by a health plan cannot be disclosed.13  Furthermore, the state health insurance pool may not use or disclose personally identifiable data.14  In addition, records held for and by an independent review committee that investigates insurance denials, are confidential, but must be made accessible to the Insurance Commissioner.15  Health plans may disclose confidential information in accordance with disclosure laws for providers.16

        Washington law requires that the state’s Department of Health maintain the confidentiality of any individually identifiable data according to state and federal HIPAA standards.17  Vital records must be kept confidential and secure to prevent unauthorized use.18  However, vital records may be disclosed for research purposes, as long as there are confidentiality safeguards.19  The law also protects the confidentiality of certain disease specific information.  Generally, the law requires that all reports made for notifiable conditions and diseases that have patient identifying information remain confidential.20  Tuberculosis reports maintained by local health departments must remain confidential, but may be accessible to the Department.21  The law also protects HIV and other sexually transmitted disease test results or diagnoses, specifically, from disclosure.  The law does provide very limited exceptions for which disclosure is permissible, including to a person who may have been exposed to the disease, health care workers or law enforcement officials who came into contact with the patient, or to public health officials for reporting purposes.22  The confidentiality laws pertaining to cancer registry information are similar, and allow the information to only be used for statistical, scientific, medical research and public health purposes.23  The law also provides immunity from liability to individuals who report incidents of cancer to the registry.24

        State agencies that hold confidential health information may disclose identifying information for research purposes if the patient provides a written request to do so.  State agencies may disclose such personal information for research purposes with an individual’s consent when certain criteria have been meet, such as the disclosure request has scientific merit, the disclosure complies with federal laws and regulations, and the stage agency enters into a confidentiality agreement with the entity conducting the research.25

        Mental health treatment records are treated separately from other health records under Washington law.  The law allows mental health providers to disclose information regarding a person’s involuntary commitment or mental health services provided to a person in custody or in the department of corrections to “authorized persons.”26  However, the fact that a person has received mental health services is confidential, and may only be disclosed under certain circumstances.27  The law also requires an individual to have access to his or her own mental health treatment records, and has developed procedures allowing individuals to do so.28  Additionally, Washington has amended the law allowing a patient to release his or her mental health treatment records three times.  Primarily the law and its amendments dictate when treatment records may be released without the patient’s written consent.29  According to Washington’s rules of construction, each amended provision is valid unless there is a conflict in the purpose of the provisions. If such a conflict exists, then the last filed amendment will control.  Washington has separate laws concerning the release of information of a minor’s mental health treatment.  The law requires that this information remain confidential, and may be disclosed only under certain circumstances.30  It is a gross misdemeanor under Washington law, to request or access, under false pretenses, confidential information from mental health treatment records.31