Medical records — health care information access and disclosure

(1) Except as authorized in RCW 70.02.050, a health care provider, an individual who assists a health care provider in the delivery of health care, or an agent and employee of a health care provider may not disclose health care information about a patient to any other person without the patient's written authorization. A disclosure made under a patient's written authorization must conform to the authorization.

     (2) A patient has a right to receive an accounting of disclosures of health care information made by a health care provider or a health care facility in the six years before the date on which the accounting is requested, except for disclosures:

     (a) To carry out treatment, payment, and health care operations;

     (b) To the patient of health care information about him or her;

     (c) Incident to a use or disclosure that is otherwise permitted or required;

     (d) Pursuant to an authorization where the patient authorized the disclosure of health care information about himself or herself;

     (e) Of directory information;

     (f) To persons involved in the patient's care;

     (g) For national security or intelligence purposes if an accounting of disclosures is not permitted by law;

     (h) To correctional institutions or law enforcement officials if an accounting of disclosures is not permitted by law; and

     (i) Of a limited data set that excludes direct identifiers of the patient or of relatives, employers, or household members of the patient.

[2005 c 468 § 2; 1993 c 448 § 2; 1991 c 335 § 201.]

(1) A patient may authorize a health care provider or health care facility to disclose the patient's health care information. A health care provider or health care facility shall honor an authorization and, if requested, provide a copy of the recorded health care information unless the health care provider or health care facility denies the patient access to health care information under RCW 70.02.090.

     (2) A health care provider or health care facility may charge a reasonable fee for providing the health care information and is not required to honor an authorization until the fee is paid.

     (3) To be valid, a disclosure authorization to a health care provider or health care facility shall:

     (a) Be in writing, dated, and signed by the patient;

     (b) Identify the nature of the information to be disclosed;

     (c) Identify the name and institutional affiliation of the person or class of persons to whom the information is to be disclosed;

     (d) Identify the provider or class of providers who are to make the disclosure;

     (e) Identify the patient; and

     (f) Contain an expiration date or an expiration event that relates to the patient or the purpose of the use or disclosure.

     (4) Unless disclosure without authorization is otherwise permitted under RCW 70.02.050 or the federal health insurance portability and accountability act of 1996 and its implementing regulations, an authorization may permit the disclosure of health care information to a class of persons that includes:

     (a) Researchers if the health care provider or health care facility obtains the informed consent for the use of the patient's health care information for research purposes; or

     (b) Third-party payors if the information is only disclosed for payment purposes.

     (5) Except as provided by this chapter, the signing of an authorization by a patient is not a waiver of any rights a patient has under other statutes, the rules of evidence, or common law.

     (6) When an authorization permits the disclosure of health care information to a financial institution or an employer of the patient for purposes other than payment, the authorization as it pertains to those disclosures shall expire ninety days after the signing of the authorization, unless the authorization is renewed by the patient.

     (7) A health care provider or health care facility shall retain the original or a copy of each authorization or revocation in conjunction with any health care information from which disclosures are made.

     (8) Where the patient is under the supervision of the department of corrections, an authorization signed pursuant to this section for health care information related to mental health or drug or alcohol treatment expires at the end of the term of supervision, unless the patient is part of a treatment program that requires the continued exchange of information until the end of the period of treatment.

[2005 c 468 § 3; 2004 c 166 § 19; 1994 sp.s. c 9 § 741; 1993 c 448 § 3; 1991 c 335 § 202.]

(1) A health care provider or health care facility may disclose health care information about a patient without the patient's authorization to the extent a recipient needs to know the information, if the disclosure is:

     (a) To a person who the provider or facility reasonably believes is providing health care to the patient;

     (b) To any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, actuarial services to, or other health care operations for or on behalf of the health care provider or health care facility; or for assisting the health care provider or health care facility in the delivery of health care and the health care provider or health care facility reasonably believes that the person:

     (i) Will not use or disclose the health care information for any other purpose; and

     (ii) Will take appropriate steps to protect the health care information;

     (c) To any other health care provider or health care facility reasonably believed to have previously provided health care to the patient, to the extent necessary to provide health care to the patient, unless the patient has instructed the health care provider or health care facility in writing not to make the disclosure;

     (d) To any person if the health care provider or health care facility reasonably believes that disclosure will avoid or minimize an imminent danger to the health or safety of the patient or any other individual, however there is no obligation under this chapter on the part of the provider or facility to so disclose;

     (e) To immediate family members of the patient, including a patient's state registered domestic partner, or any other individual with whom the patient is known to have a close personal relationship, if made in accordance with good medical or other professional practice, unless the patient has instructed the health care provider or health care facility in writing not to make the disclosure;

     (f) To a health care provider or health care facility who is the successor in interest to the health care provider or health care facility maintaining the health care information;

     (g) For use in a research project that an institutional review board has determined:

     (i) Is of sufficient importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;

     (ii) Is impracticable without the use or disclosure of the health care information in individually identifiable form;

     (iii) Contains reasonable safeguards to protect the information from redisclosure;

     (iv) Contains reasonable safeguards to protect against identifying, directly or indirectly, any patient in any report of the research project; and

     (v) Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project;

     (h) To a person who obtains information for purposes of an audit, if that person agrees in writing to:

     (i) Remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified; and

     (ii) Not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the health care provider;

     (i) To an official of a penal or other custodial institution in which the patient is detained;

     (j) To provide directory information, unless the patient has instructed the health care provider or health care facility not to make the disclosure;

     (k) To fire, police, sheriff, or another public authority, that brought, or caused to be brought, the patient to the health care facility or health care provider if the disclosure is limited to the patient's name, residence, sex, age, occupation, condition, diagnosis, estimated or actual discharge date, or extent and location of injuries as determined by a physician, and whether the patient was conscious when admitted;

     (l) To federal, state, or local law enforcement authorities and the health care provider, health care facility, or third-party payor believes in good faith that the health care information disclosed constitutes evidence of criminal conduct that occurred on the premises of the health care provider, health care facility, or third-party payor;

     (m) To another health care provider, health care facility, or third-party payor for the health care operations of the health care provider, health care facility, or third-party payor that receives the information, if each entity has or had a relationship with the patient who is the subject of the health care information being requested, the health care information pertains to such relationship, and the disclosure is for the purposes described in RCW 70.02.010(8) (a) and (b); or

     (n) For payment.

     (2) A health care provider shall disclose health care information about a patient without the patient's authorization if the disclosure is:

     (a) To federal, state, or local public health authorities, to the extent the health care provider is required by law to report health care information; when needed to determine compliance with state or federal licensure, certification or registration rules or laws; or when needed to protect the public health;

     (b) To federal, state, or local law enforcement authorities to the extent the health care provider is required by law;

     (c) To federal, state, or local law enforcement authorities, upon receipt of a written or oral request made to a nursing supervisor, administrator, or designated privacy official, in a case in which the patient is being treated or has been treated for a bullet wound, gunshot wound, powder burn, or other injury arising from or caused by the discharge of a firearm, or an injury caused by a knife, an ice pick, or any other sharp or pointed instrument which federal, state, or local law enforcement authorities reasonably believe to have been intentionally inflicted upon a person, or a blunt force injury that federal, state, or local law enforcement authorities reasonably believe resulted from a criminal act, the following information, if known:

     (i) The name of the patient;

     (ii) The patient's residence;

     (iii) The patient's sex;

     (iv) The patient's age;

     (v) The patient's condition;

     (vi) The patient's diagnosis, or extent and location of injuries as determined by a health care provider;

     (vii) Whether the patient was conscious when admitted;

     (viii) The name of the health care provider making the determination in (c)(v), (vi), and (vii) of this subsection;

     (ix) Whether the patient has been transferred to another facility; and

     (x) The patient's discharge time and date;

     (d) To county coroners and medical examiners for the investigations of deaths;

     (e) Pursuant to compulsory process in accordance with RCW 70.02.060.

     (3) All state or local agencies obtaining patient health care information pursuant to this section shall adopt rules establishing their record acquisition, retention, and security policies that are consistent with this chapter.

[2007 c 156 § 12; 2006 c 235 § 3; 2005 c 468 § 4; 1998 c 158 § 1; 1993 c 448 § 4; 1991 c 335 § 204.]

(1) Upon receipt of a written request from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall:

     (a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient;

     (b) Inform the patient if the information does not exist or cannot be found;

     (c) If the health care provider does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health care provider who maintains the record;

     (d) If the information is in use or unusual circumstances have delayed handling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, not later than twenty-one working days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise disposed of; or

     (e) Deny the request, in whole or in part, under RCW 70.02.090 and inform the patient.

     (2) Upon request, the health care provider shall provide an explanation of any code or abbreviation used in the health care information. If a record of the particular health care information requested is not maintained by the health care provider in the requested form, the health care provider is not required to create a new record or reformulate an existing record to make the health care information available in the requested form. The health care provider may charge a reasonable fee for providing the health care information and is not required to permit examination or copying until the fee is paid.

[1993 c 448 § 5; 1991 c 335 § 301.]

(1) Subject to any conflicting requirement in the public records act, chapter 42.56 RCW, a health care provider may deny access to health care information by a patient if the health care provider reasonably concludes that:

     (a) Knowledge of the health care information would be injurious to the health of the patient;

     (b) Knowledge of the health care information could reasonably be expected to lead to the patient's identification of an individual who provided the information in confidence and under circumstances in which confidentiality was appropriate;

     (c) Knowledge of the health care information could reasonably be expected to cause danger to the life or safety of any individual;

     (d) The health care information was compiled and is used solely for litigation, quality assurance, peer review, or administrative purposes; or

     (e) Access to the health care information is otherwise prohibited by law.

     (2) If a health care provider denies a request for examination and copying under this section, the provider, to the extent possible, shall segregate health care information for which access has been denied under subsection (1) of this section from information for which access cannot be denied and permit the patient to examine or copy the disclosable information.

     (3) If a health care provider denies a patient's request for examination and copying, in whole or in part, under subsection (1)(a) or (c) of this section, the provider shall permit examination and copying of the record by another health care provider, selected by the patient, who is licensed, certified, registered, or otherwise authorized under the laws of this state to treat the patient for the same condition as the health care provider denying the request. The health care provider denying the request shall inform the patient of the patient's right to select another health care provider under this subsection. The patient shall be responsible for arranging for compensation of the other health care provider so selected.

[2005 c 274 § 331; 1991 c 335 § 302.]

(1) For purposes of accuracy or completeness, a patient may request in writing that a health care provider correct or amend its record of the patient's health care information to which a patient has access under RCW 70.02.080.

     (2) As promptly as required under the circumstances, but no later than ten days after receiving a request from a patient to correct or amend its record of the patient's health care information, the health care provider shall:

     (a) Make the requested correction or amendment and inform the patient of the action;

     (b) Inform the patient if the record no longer exists or cannot be found;

     (c) If the health care provider does not maintain the record, inform the patient and provide the patient with the name and address, if known, of the person who maintains the record;

     (d) If the record is in use or unusual circumstances have delayed the handling of the correction or amendment request, inform the patient and specify in writing, the earliest date, not later than twenty-one days after receiving the request, when the correction or amendment will be made or when the request will otherwise be disposed of; or

     (e) Inform the patient in writing of the provider's refusal to correct or amend the record as requested and the patient's right to add a statement of disagreement.

[1991 c 335 § 401.]

(1) In making a correction or amendment, the health care provider shall:

     (a) Add the amending information as a part of the health record; and

     (b) Mark the challenged entries as corrected or amended entries and indicate the place in the record where the corrected or amended information is located, in a manner practicable under the circumstances.

     (2) If the health care provider maintaining the record of the patient's health care information refuses to make the patient's proposed correction or amendment, the provider shall:

     (a) Permit the patient to file as a part of the record of the patient's health care information a concise statement of the correction or amendment requested and the reasons therefor; and

     (b) Mark the challenged entry to indicate that the patient claims the entry is inaccurate or incomplete and indicate the place in the record where the statement of disagreement is located, in a manner practicable under the circumstances.

     (3) A health care provider who receives a request from a patient to amend or correct the patient's health care information, as provided in RCW 70.02.100, shall forward any changes made in the patient's health care information or health record, including any statement of disagreement, to any third-party payor or insurer to which the health care provider has disclosed the health care information that is the subject of the request.

[2000 c 5 § 3; 1991 c 335 § 402.]

A personal representative of a deceased patient may exercise all of the deceased patient's rights under this chapter. If there is no personal representative, or upon discharge of the personal representative, a deceased patient's rights under this chapter may be exercised by persons who would have been authorized to make health care decisions for the deceased patient when the patient was living under RCW 7.70.065.

[1991 c 335 § 602.]

(1) A person who has complied with this chapter may maintain an action for the relief provided in this section against a health care provider or facility who has not complied with this chapter.

     (2) The court may order the health care provider or other person to comply with this chapter. Such relief may include actual damages, but shall not include consequential or incidental damages. The court shall award reasonable attorneys' fees and all other expenses reasonably incurred to the prevailing party.

     (3) Any action under this chapter is barred unless the action is commenced within two years after the cause of action is discovered.

     (4) A violation of this chapter shall not be deemed a violation of the consumer protection act, chapter 19.86 RCW.

[1991 c 335 § 801.]

Mental health counselors, marriage and family therapists, and social workers licensed under chapter 18.225 RCW are subject to this chapter.

[2001 c 251 § 34.]

(1) This chapter does not restrict a health care provider, a third-party payor, or an insurer regulated under Title 48 RCW from complying with obligations imposed by federal or state health care payment programs or federal or state law.

     (2) This chapter does not modify the terms and conditions of disclosure under Title 51 RCW and chapters 13.50, 26.09, 70.24, *70.39, 70.96A, 71.05, and 71.34 RCW and rules adopted under these provisions.

[2000 c 5 § 4; 1991 c 335 § 901.]