§ 11.2 WASHINGTON STATE HEALTH CARE INFORMATION ACT (HCIA), CHAPTER 70.02 RCW
This section discusses Chapter 70.02 RCW, Washington state's Health Care Information Act (HCIA).
(1) Relationship with the Public Records Act
Once a government agency obtains a medical record, the record becomes a "public record" as denned in the PRA, although all or part of it might be exempt from disclosure. Oliver v. Harborview Med. Ctr., 94 Wn.2d 559, 566, 618 P.2d 76 (1980). Under the PRA, a public record must be disclosed unless a specific PRA provision or "other statute" exempts the record from disclosure. RCW 42.56.070. The HCIA is an "other statute" that exempts "health care information of patients" from disclosure, expressly incorporated by RCW 42.56.360(2) (stating that Chapter 70.02 RCW "applies to public inspection and copying of health care information of patients"). Within the HCIA, RCW 70.02.020(1) generally prohibits disclosure of a patient's health care information without the patient's written authorization. See also Prison Legal News, Inc. v. Dep't of Corr, 154 Wn.2d 628, 648-49, 115 P.3d 316 (2005) (discussing incorporation of HCIA into PRA). Thus, when dealing with health care information, the first question is whether the HCIA applies.
(2) Agencies covered by HCIA
Under the HCIA, "a health care provider, an individual who assists a health care provider in the delivery of health care, or an agent and employee of a health care provider may not disclose health care information about a patient to any other person without the patient's written authorization." RCW 70.02.020(1). "Health care" means "any care, service, or procedure provided by a health care provider: (a) To diagnose, treat, or maintain a patient's physical or mental condition; or (b) That affects the structure or any function of the human body." RCW 70.02.010(15). The HCIA defines "health care provider" as a person who is licensed or otherwise authorized to provide health care "in the ordinary course of business or practice of a profession." RCW 70.02.010(19). Thus, the HCIA clearly applies to those government agencies that are in the health care business, such as psychiatric hospitals and public health clinics. The HCIA also restricts disclosure by any "state or federal health benefit program" that is a third-party payor, such as Medicaid and Workers' Compensation. RCW 70.02.010(44); RCW 70.02.045 ("Third-party payors shall not release health care information disclosed under this chapter ... except to the extent that health care providers are authorized to do so under RCW 70.02.050, 70.02.200, and 70.02.210.").
However, in the context of civil liability for acts under the HCIA, courts have held that agencies that are not facilities or providers cannot be found liable for violating the disclosure provisions of the Act. Jeckle u. Crotty, 120 Wn.App. 374, 386, 85 P.3d 931, retnew denied, 152 Wn.2d 1029 (2004) (only health care providers may be liable for damages from improper disclosure under RCW 70.02.170); Fisher v. State ex rel. Dep't of Health, 125 Wn.App. 869, 876-78, 106 P.3d 836 (2005) (an agency cannot be subject to civil liability for improperly disseminating medical records under RCW 70.02.170(1) unless it is "a health care provider or facility" as defined by the HCIA).
The HCIA extends to agencies that are not providers, facilities, or payors in several aspects. An agency not a health care facility or provider that obtains health care information from an entity covered by the HCIA without authorization under the exceptions in the Act must have rules establishing "acquisition, retention, destruction, and security policies" that are consistent with the HCIA. RCW 70.02.290(1). In 2014, this statute was amended to add an obligation by all agencies to adopt a specific policy addressing improper disclosure of health care records in limited circumstances. RCW 70.02.290(2), (3). If these agencies obtain health care information without requesting it and without authorization from a health care provider or facility, they must not disclose it unless permitted by the HCIA, and must either destroy or return the information to the entity providing the information. RCW 70.02.290(2). If information is disclosed in error by an agency, that agency must notify the individual whose information was disclosed. RCW 70.02.290(3). Agencies must adopt a notification policy that addresses a reasonable time to notify and content of the notice, including whether the notice must name the original entity disclosing the information. RCW 70.02.290(3). Rules or policies adopted by non-health care agencies applying to health care records must be publicly available on the agency's website.
| Example : | Notification required. A county provides numerous records to its legal counsel to respond to a discovery request. By clerical mistake, included in those records are copies of the results of testing of patients for infectious diseases at the county health clinic. The prosecuting attorney includes these records in the discovery responses to opposing counsel in an unrelated land-use matter. This situation now has become a breach requiring the prosecuting attorney's office to notify the affected individuals in accordance with its adopted policies, and to destroy or return the health care information to the county health department. |
The HCIA extends to persons or entities providing services to a health care facility or provider. A, E, addressed below in §11.3(3). RCW 70.02.270(1). The entity covered by the HCIA must terminate the contract with the service provider if aware that the provider has engaged in a pattern of behavior that violates the HCIA RCW 70.02.270(2).
(3) Scope of HCIA exemption
The HCIA exempts health care information from disclosure only if it "identifies or can...
