(1) Public records and information may be exempt from disclosure or production under chapter 42.56 RCW or other state or federal laws. Commonly applicable exemptions include, but are not limited to, the following:

(a) Under RCW 42.56.230(1), personal information in files maintained for WDVA clients. Personal information includes, but is not limited to:

(i) Names;

(ii) Telephone numbers;

(iii) Fax numbers;

(iv) Email addresses;

(v) Social Security numbers;

(vi) VA claim numbers;

(vii) VA disability percentages;

(viii) DOD type of military separation, characterization of service, narrative reason for separation, reentry code, separation code;

(ix) Account numbers;

(x) Certificate or license numbers;

(xi) Vehicle identifiers and serial numbers, including license plate numbers;

(xii) Device identifiers and serial numbers;

(xiii) Web universal resource locators (URLs);

(xiv) Internet protocol (IP) address numbers;

(xv) Biometric identifiers, including finger and voice prints;

(xvi) Full face photographic images and any comparable images;

(xvii) Any other unique identifying number, characteristic, or code;

(xviii) All geographic subdivisions smaller than a state, including street address, mailing address, city, county, precinct, geocodes, and zip code, except for the initial three digits of a zip code; and

(xix) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death.

(b) Under chapter 70.02 RCW and related federal laws, protected health care information and medical records.

(c) Under RCW 42.56.230(3), personal information in files maintained for WDVA employees or elected officials to the extent that disclosure would violate their right to privacy.

(d) Under RCW 42.56.230(5), credit card numbers, debit card numbers, electronic check numbers, card expiration dates, or bank or other financial information as defined in RCW 9.35.005 including Social Security numbers, except when disclosure is expressly required by or governed by other law.

(e) Under RCW 42.56.250, the following information from personnel records, public employment related records, volunteer rosters, or included in any mailing list of employees or volunteers of any public agency:

(i) Residential addresses;

(ii) Residential phone numbers;

(iii) Personal wireless telephone numbers;

(iv) Personal email addresses;

(v) Social Security numbers;

(vi) Driver's license numbers;

(vii) Identicard numbers;

(viii) Emergency contact information; and

(ix) Names, dates of birth, residential addresses, residential telephone numbers, personal wireless telephone numbers, personal email addresses, Social Security numbers, and emergency contact information of dependents of employees or volunteers of a public agency.

(f) Under RCW 42.56.235, records that relate to or contain personally identifying information about an individual's religious beliefs, practices, or affiliation.

(g) Effective July 1, 2020, agency employee records described under RCW 42.56.660.

(h) Effective July 1, 2020, lists of state agency employee names under RCW 42.56.675.

(i) Under RCW 42.56.640 and 43.17.410, sensitive personal information of vulnerable individuals and in-home caregivers for vulnerable populations, except as allowed under subsection (3) of this section.

(j) Under RCW 42.56.440, veteran discharge or separation documents held by the department of veteran affairs are confidential and not subject to disclosure, except as provided in RCW 43.60A.290.

(2) If the requested public record contains information that is exempt from public disclosure, WDVA may:

(a) As appropriate, release the nonexempt portion, explaining what exemptions apply to redacted portions of the record;

(b) As appropriate, deny release of the entire record, sending a written explanation and citing the exemption that applies to the denial, while also giving the requestor the option to ask for an internal review of the records denial should they wish to do so; or

(c) Neither confirm or deny the existence of the requested records and provide the legal basis for confidentiality as if the responsive records existed, when a denial would reveal information that is confidential and must not be disclosed.

(3) Sensitive personal information under subsection (1)(i) of this section may be disclosed or produced if WDVA determines that the requestor:

(a) Meets the criteria under RCW 42.56.645; and

(b) Has complied with any procedures developed by WDVA to protect the confidentiality of the information.