READ FIRST TIME 02/07/14.   

     AN ACT Relating to state and local agencies that obtain patient health care information; amending RCW 70.02.290, 43.70.052, and 43.71.075; and providing an effective date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

Sec. 1   RCW 70.02.290 and 2013 c 200 s 13 are each amended to read as follows:
     (1) All state or local agencies obtaining patient health care information pursuant to RCW 70.02.050 and 70.02.200 through 70.02.240 that are not health care facilities or providers shall adopt rules establishing their record acquisition, retention, destruction, and security policies that are consistent with this chapter.
     (2) State and local agencies that are not health care facilities or providers that have not requested health care information and are not authorized to receive this information under this chapter:
     (a) Must not use or disclose this information unless permitted under this chapter; and
     (b) Must destroy the information in accordance with the policy developed under subsection (1) of this section or return the information to the entity that provided the information to the state or local agency if the entity is a health care facility or provider and subject to this chapter.
     (3) A person who has health care information disclosed in violation of subsection (2)(a) of this section, must be informed of the disclosure by the state or local agency improperly making the disclosure. State and local agencies that are not health care facilities or providers must develop a policy to establish a reasonable notification period and what information must be included in the notice, including whether the name of the entity that originally provided the information to the agency must be included.
     (4) Rules or policies adopted under this section must be available through each agency's web site.

Sec. 2   RCW 43.70.052 and 2012 c 98 s 1 are each amended to read as follows:
     (1) To promote the public interest consistent with the purposes of chapter 492, Laws of 1993 as amended by chapter 267, Laws of 1995, the department shall continue to require hospitals to submit hospital financial and patient discharge information, which shall be collected, maintained, analyzed, and disseminated by the department. The department shall, if deemed cost-effective and efficient, contract with a private entity for any or all parts of data collection. Data elements shall be reported in conformance with a uniform reporting system established by the department. This includes data elements identifying each hospital's revenues, expenses, contractual allowances, charity care, bad debt, other income, total units of inpatient and outpatient services, and other financial and employee compensation information reasonably necessary to fulfill the purposes of this section. Data elements relating to use of hospital services by patients shall be the same as those currently compiled by hospitals through inpatient discharge abstracts. The department shall encourage and permit reporting by electronic transmission or hard copy as is practical and economical to reporters.
     (2) In identifying financial reporting requirements, the department may require both annual reports and condensed quarterly reports from hospitals, so as to achieve both accuracy and timeliness in reporting, but shall craft such requirements with due regard of the data reporting burdens of hospitals.
     (3)(a) Beginning with compensation information for 2012, unless a hospital is operated on a for-profit basis, the department shall require a hospital licensed under chapter 70.41 RCW to annually submit employee compensation information. To satisfy employee compensation reporting requirements to the department, a hospital shall submit information as directed in (a)(i) or (ii) of this subsection. A hospital may determine whether to report under (a)(i) or (ii) of this subsection for purposes of reporting.
     (i) Within one hundred thirty-five days following the end of each hospital's fiscal year, a nonprofit hospital shall file the appropriate schedule of the federal internal revenue service form 990 that identifies the employee compensation information with the department. If the lead administrator responsible for the hospital or the lead administrator's compensation is not identified on the schedule of form 990 that identifies the employee compensation information, the hospital shall also submit the compensation information for the lead administrator as directed by the department's form required in (b) of this subsection.
     (ii) Within one hundred thirty-five days following the end of each hospital's calendar year, a hospital shall submit the names and compensation of the five highest compensated employees of the hospital who do not have any direct patient responsibilities. Compensation information shall be reported on a calendar year basis for the calendar year immediately preceding the reporting date. If those five highest compensated employees do not include the lead administrator for the hospital, compensation information for the lead administrator shall also be submitted. Compensation information shall include base compensation, bonus and incentive compensation, other payments that qualify as reportable compensation, retirement and other deferred compensation, and nontaxable benefits.
     (b) To satisfy the reporting requirements of this subsection (3), the department shall create a form and make it available no later than August 1, 2012. To the greatest extent possible, the form shall follow the format and reporting requirements of the portion of the internal revenue service form 990 schedule relating to compensation information. If the internal revenue service substantially revises its schedule, the department shall update its form.
     (4) The health care data collected, maintained, and studied by the department shall only be available for retrieval in original or processed form to public and private requestors pursuant to subsection (7) of this section and shall be available within a reasonable period of time after the date of request. The cost of retrieving data for state officials and agencies shall be funded through the state general appropriation. The cost of retrieving data for individuals and organizations engaged in research or private use of data or studies shall be funded by a fee schedule developed by the department that reflects the direct cost of retrieving the data or study in the requested form.
     (5) The department shall, in consultation and collaboration with the federally recognized tribes, urban or other Indian health service organizations, and the federal area Indian health service, design, develop, and maintain an American Indian-specific health data, statistics information system. ((The department rules regarding confidentiality shall apply to safeguard the information from inappropriate use or release.))
     (6) All persons subject to the data collection requirements of this section shall comply with departmental requirements established by rule in the acquisition of data.
     (7) The department must maintain the confidentiality of patient discharge data it collects under subsection (1) of this section. Patient discharge data that includes direct and indirect identifiers is not subject to public inspection and the department may only release such data as allowed for in this section. Any agency that receives patient discharge data under (a) or (b) of this subsection must also maintain the confidentiality of the data and may not release the data except as consistent with subsection (8)(b) of this section. The department may release the data as follows:
     (a) Data that includes direct and indirect patient identifiers, as specifically defined in rule, may be released to:
     (i) Federal, state, and local government agencies upon receipt of a signed data use agreement with the department; and
     (ii) Researchers with approval of the Washington state institutional review board upon receipt of a signed confidentiality agreement with the department.
     (b) Data that does not contain direct patient identifiers but may contain indirect patient identifiers may be released to agencies, researchers, and other persons upon receipt of a signed data use agreement with the department.
     (c) Data that does not contain direct or indirect patient identifiers may be released on request.
     (8) Recipients of data under subsection (7)(a) and (b) of this section must agree in a written data use agreement, at a minimum, to:
     (a) Take steps to protect direct and indirect patient identifying information as described in the data use agreement; and
     (b) Not re-disclose the data except as authorized in their data use agreement consistent with the purpose of the agreement.
     (9) Recipients of data under subsection (7)(b) and (c) of this section must not attempt to determine the identity of persons whose information is included in the data set or use the data in any manner that identifies individuals or their families.
     (10) For the purposes of this section:
     (a) "Direct patient identifier" means information that identifies a patient; and
     (b) "Indirect patient identifier" means information that may identify a patient when combined with other information.
     (11) The department must adopt rules necessary to carry out its responsibilities under this section. The department must consider national standards when adopting rules.

Sec. 3   RCW 43.71.075 and 2012 c 87 s 25 are each amended to read as follows:
     (1) A person or entity functioning as a navigator consistent with the requirements of section 1311(i) of P.L. 111-148 of 2010, as amended, shall not be considered soliciting or negotiating insurance as stated under chapter 48.17 RCW.
     (2)(a) A person or entity functioning as a navigator may only request health care information that is relevant to the specific assessment and recommendation of health plan options. Any health care information received by a navigator may not be disclosed to any third party that is not part of the enrollment process and must be destroyed after enrollment has been completed.
     (b) If a person's health care information is received and disclosed to a third party in violation of (a) of this subsection, the navigator must notify the person of the breach. The exchange must develop a policy to establish a reasonable notification period and what information must be included in the notice. This policy and information on the exchange's confidentiality policies must be made available on the exchange's web site.
     (3) For the purposes of this section, "health care information" has the meaning provided in RCW 70.02.010.

NEW SECTION.  Sec. 4   This act takes effect July 1, 2014.