Strike everything after the enacting clause and insert the following:

"NEW SECTION.  Sec. 1. (1) No person may disclose COVID-19 health data unless the person first obtains affirmative express consent from each individual who is linked to, or associated with, the COVID-19 health data.

(2) For the purposes of this section:

(a)(i) "Affirmative express consent" means an affirmative act by an individual that clearly and conspicuously communicates the individual's authorization of an act or practice and is:

(A) Made in the absence of any mechanism that has the purpose or substantial effect of obscuring, subverting, or impairing decision making or choice to obtain consent; and

(B) Taken after the individual has been presented with a clear and conspicuous disclosure that is separate from other options or acceptance of general terms and that includes a concise and easy to understand description of each act or practice for which the individual's consent is sought.

(ii) For the purposes of this subsection (2)(a), affirmative express consent may not be inferred from the inaction of an individual or the individual's continued use of a service or product.

(iii) Affirmative express consent must be freely given and nonconditioned.

(b) "COVID-19 health data" means data that is collected or used in connection with COVID-19 or the related public health response and that is linked to an individual or device.

(c) "Disclose" means the releasing, transferring, selling, providing access to, licensing, or divulging in any manner of COVID-19 health data.

(d) "Person" means a natural or legal person, or any legal, commercial, or governmental entity of any kind or nature.

Sec. 2. RCW 42.56.360 and 2020 c 323 s 2 are each amended to read as follows:

(1) The following health care information is exempt from disclosure under this chapter:

(a) Information obtained by the pharmacy quality assurance commission as provided in RCW 69.45.090;

(b) Information obtained by the pharmacy quality assurance commission or the department of health and its representatives as provided in RCW 69.41.044, 69.41.280, and 18.64.420;

(c) Information and documents created specifically for, and collected and maintained by a quality improvement committee under RCW 43.70.510, 70.230.080, or 70.41.200, or by a peer review committee under RCW 4.24.250, or by a quality assurance committee pursuant to RCW 74.42.640 or 18.20.390, or by a hospital, as defined in RCW 43.70.056, for reporting of health care-associated infections under RCW 43.70.056, a notification of an incident under RCW 70.56.040(5), and reports regarding adverse events under RCW 70.56.020(2)(b), regardless of which agency is in possession of the information and documents;

(d)(i) Proprietary financial and commercial information that the submitting entity, with review by the department of health, specifically identifies at the time it is submitted and that is provided to or obtained by the department of health in connection with an application for, or the supervision of, an antitrust exemption sought by the submitting entity under RCW 43.72.310;

(ii) If a request for such information is received, the submitting entity must be notified of the request. Within ten business days of receipt of the notice, the submitting entity shall provide a written statement of the continuing need for confidentiality, which shall be provided to the requester. Upon receipt of such notice, the department of health shall continue to treat information designated under this subsection (1)(d) as exempt from disclosure;

(iii) If the requester initiates an action to compel disclosure under this chapter, the submitting entity must be joined as a party to demonstrate the continuing need for confidentiality;

(e) Records of the entity obtained in an action under RCW 18.71.300 through 18.71.340;

(f) Complaints filed under chapter 18.130 RCW after July 27, 1997, to the extent provided in RCW 18.130.095(1);

(g) Information obtained by the department of health under chapter 70.225 RCW;

(h) Information collected by the department of health under chapter 70.245 RCW except as provided in RCW 70.245.150;

(i) Cardiac and stroke system performance data submitted to national, state, or local data collection systems under RCW 70.168.150(2)(b);

(j) All documents, including completed forms, received pursuant to a wellness program under RCW 41.04.362, but not statistical reports that do not identify an individual;

(k) Data and information exempt from disclosure under RCW 43.371.040; and

(l) Medical information contained in files and records of members of retirement plans administered by the department of retirement systems or the law enforcement officers' and firefighters' plan 2 retirement board, as provided to the department of retirement systems under RCW 41.04.830.

(2) Chapter 70.02 RCW applies to public inspection and copying of health care information of patients.

(3)(a) Documents related to infant mortality reviews conducted pursuant to RCW 70.05.170 are exempt from disclosure as provided for in RCW 70.05.170(3).

(b)(i) If an agency provides copies of public records to another agency that are exempt from public disclosure under this subsection (3), those records remain exempt to the same extent the records were exempt in the possession of the originating entity.

(ii) For notice purposes only, agencies providing exempt records under this subsection (3) to other agencies may mark any exempt records as "exempt" so that the receiving agency is aware of the exemption, however whether or not a record is marked exempt does not affect whether the record is actually exempt from disclosure.

(4) Information and documents related to maternal mortality reviews conducted pursuant to RCW 70.54.450 are confidential and exempt from public inspection and copying.

On page 1, line 2 of the title, after "data" strike the remainder of the title and insert "; amending RCW 42.56.360; adding a new chapter to Title 70 RCW; and declaring an emergency."