Traditional Contact Tracing.
Case investigation and contact tracing are core public health strategies used to reduce the spread of communicable diseases, such as COVID-19, a novel acute respiratory syndrome coronavirus.  Case investigation is the identification and investigation of patients with confirmed and probable diagnoses of a disease, which involves working with the patient who has been diagnosed with the disease to identify other people who may have been infected through exposure to the patient.  Contact tracing is the subsequent identification, monitoring, and support of those contacts who have been exposed to, and possibly infected with, the virus.  In Washington, local health departments, with the support of the Department of Health (DOH), are responsible for performing case investigations and contact tracing.

Uniform Health Care Information Act.
The state Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees.  The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or written authorization by the patient.  Some exceptions include disclosures to persons who require health care information for the provision of planning, legal, actuarial, and administrative services.  A health care provider may also disclose health care information to any person if the health care provider or health care facility believes that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.  A health care provider must disclose health care information, with exceptions, to certain governmental entities for specified reasons.  Disclosures to these entities are exempt from the Public Records Act (PRA).  A health care provider must also disclose health care information when needed to protect the public health.

Public Records Act.
The PRA requires state and local agencies to make all public records available for public inspection and copying, unless a record falls within an exemption in the PRA or another statute that exempts or prohibits disclosure of specific information or records.  To the extent required to prevent an unreasonable invasion of personal privacy interests, an agency must delete identifying details when it makes a public record available.  A person's right to privacy is violated only if disclosure would be highly offensive to a reasonable person and is not of legitimate concern to the public.  The PRA is liberally construed and its exemptions interpreted narrowly.
 
Exemptions under the PRA are permissive, meaning that an agency, although not required to disclose, has the discretion to provide an exempt record.  With exceptions, the exemptions under the PRA are inapplicable to the extent that information, the disclosure of which would violate personal privacy or vital governmental interests, can be deleted from the specific records sought.  
 
Personal information in any files maintained for patients or clients of public institutions or public health entities are exempt from disclosure under the PRA.  Certain health care information is exempt from disclosure under the PRA such as health information created for and collected and maintained by a quality improvement committee, quality assurance committee, hospital, or for reporting of certain health care-associated infections.

Health-related personal information is exempt from disclosure under the PRA if that information, alone or in combination with any other information, may reveal the identity of an individual that is submitted to or obtained by an agency for the purpose of investigating, controlling, preventing, or protecting the public from any disease, notifiable or provisionally notifiable condition as defined by the Department of Health, or condition constituting a threat to the public health.
 
Exempt information includes:  name; birth month, day, or year; place of birth; telephone number; street or mailing address or other location information; email address or other contact information; place of employment; photograph of an individual; and information about an individual's physical characteristics that is submitted to or obtained by an agency for the purpose of investigating, controlling, preventing, or protecting the public from any disease, notifiable condition, or condition constituting a threat to the public health.