The Public Records Act.
The Public Records Act (PRA), enacted in 1972 as part of Initiative 276, requires that all state and local governmental entities make all public records available to the public unless a specific exemption applies or disclosure is prohibited.? The PRA must be liberally construed; any exemptions to the disclosure requirement must be interpreted narrowly.? Unless statute designates certain information or records as confidential and prohibits disclosure, exemptions are permissive, meaning that an agency, although not required to disclose, has the discretion to provide an exempt record.? Exemptions under the PRA are inapplicable to the extent that information, the disclosure of which would violate personal privacy or vital governmental interests, can be redacted from the requested records.
?
Health Care Privacy Laws.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, and transfer of "protected health information," defined as individually identifiable health information that relates to an individual's past, present, or future physical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual, that identifies the individual or can be used to identify the individual.? Individually identifiable health information includes common identifiers such as name, address, birth date, and social security number.? HIPAA applies to "covered entities," which are health care providers, health plans, health care clearinghouses, and "business associates" which are entities that perform certain functions or activities that involve the use or disclosure of protected health information on behalf of a covered entity.
?
Covered entities must have an individual's authorization to use or disclose protected health care information.? HIPAA permits the use and disclosure of protected health information without an individual's authorization for specified purposes, including:
?
In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. ?The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or written authorization by the patient. ?Statutory exceptions under the UHCIA are similar to those under HIPAA and include disclosures made for:? the provision of health care; quality improvement; legal and administrative services; research purposes; public health and law enforcement activities; and judicial proceedings.
?
The PRA exempts from disclosure requirements various health care related information.? Examples include:
?
Other areas of state law also regulate the the disclosure and privacy of health-related information.? For example, health care related data identifying patients or providers that is obtained by state agencies and provided to the DOH is confidential.? In addition, health carriers and insurers are prohibited from disclosing nonpublic personal health information concerning sensitive health care services provided to a person covered by the health benefit plan or certain minors without their express consent.
?
Other Exemptions.
There are over 500 disclosure exemptions or prohibitions on disclosure that are codified under the PRA or other statutes.? Some of those exemptions specifically apply to children's personal information in files maintained by the Department of Children, Youth, and Families (DCYF) for children enrolled in licensed child care, early learning programs, parks and recreation programs, and youth development programs.? In addition, the statute also limits the disclosure of health and safety information from the DCYF to the Department of Commerce regarding youth who are in foster care and admitted to crisis residential centers.? The PRA also generally exempts personal information in any files maintained for students in public schools.?
?
There are also exemptions applicable to information held by detention facilities and other law enforcement agencies.? For example, body scanner images, information relating to the federal Prison Rape Elimination Act, and an incarcerated or detained individual's health information are exempt from disclosure under the PRA.? Specific intelligence and investigative information completed by law enforcement or penology agencies may be exempt if the information is essential to law enforcement or a person's right to privacy.??
?
In addition, various exemptions exist as it relates to insurance information.? For example, certain confidential or privileged documents, materials, or information filed with the Insurance Commissioner pursuant to the insurance code are exempt.? Likewise, claims, health care, and financial information submitted by school districts to the Office of the Insurance Commissioner and the Health Care Authority are exempt from disclosure.??
Any information pertaining to American Indians, Alaska Natives, or Indian tribes is exempt from disclosure requirements under the PRA if the information is prepared, owned, used, or retained by local health jurisdictions or the following entities:? the Health Care Authority; the Department of Children, Youth, and Families; the Department of Commerce; the Department of Corrections; the Department of Health; the Department of Social and Health Services; the Office of the Insurance Commissioner; the Office of the Superintendent of Public Instruction; and the Washington Health Benefit Exchange.??