The Public Records Act (PRA) requires state and local agencies to make all public records available for public inspection and copying unless a record falls within an exemption under the PRA or another statute that exempts or prohibits disclosure of specific information or records. Exemptions under the PRA are permissive, meaning that an agency, although not required to disclose, has the discretion to provide an exempt record. The exemptions under the PRA are inapplicable to the extent that information, the disclosure of which would violate personal privacy or vital governmental interests, can be redacted from the specific records sought. The PRA is liberally construed, and its exemptions are narrowly construed.
Identity of human subjects in research. The United States Department of Health and Human Services (HHS) issues regulations, known as the Common Rule, for the protection of human subjects participating in research conducted, supported, or otherwise subject to regulation by a federal department or agency. One requirement of the Common Rule is the review and approval of research by institutional review boards (IRB) to ensure researchers follow HHS rules and ethical guidelines as they carry out their study. Approval by an IRB may only be given if certain conditions are met including, when appropriate, that adequate provisions are provided to protect the privacy of subjects and maintain the confidentiality of data. In addition, the Food and Drug Administration (FDA) issues human subject protection regulations which require that informed consent from research subjects contain a statement describing the extent to which confidentiality of records identifying the subject will be maintained. Also on the federal level, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, and transfer of "protected health information" by covered entities. The HIPAA Privacy Rule establishes conditions under which protected health information may be used or disclosed by covered entities for research purposes.
In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA prohibits a health care provider from disclosing health care information about a patient unless there is a statutory exception or written authorization by the patient. The UHCIA authorizes disclosure of patient health care information without prior authorization for research purposes if an IRB has determined that certain statutory criteria are met, including that the research project contains reasonable safeguards to protect against identifying any patient in any report of the research project. The My Health My Data Act (MHMDA) is another body of law which protects consumer health data collected or used by a regulated entity. However, the MHMDA does not apply to identifiable private information for purposes of the federal policy for the protection of human subjects under the HHS's Common Rule regulations or the FDA's human subject protection regulations, or to identifiable private information that is otherwise collected as part of human subject research pursuant to the good clinical practice guidelines issued by the International Council for Harmonization. Moreover, certain state agencies are subject to state laws governing the release of records for research. Generally, a covered agency may provide access to individually identifiable personal records for research purposes if the subject of the record consents to the disclosure or if other specified statutory conditions are met.
Proprietary information and drafts. The PRA exempts from public disclosure valuable formulae, designs, drawings, computer source code or object code, and research data obtained by any agency within five years of the request for disclosure if disclosure of the information would lead to private gain and public loss. In addition, preliminary drafts, notes, recommendations, and intra-agency memorandums in which opinions are expressed or policies formulated or recommended are exempt from public disclosure requirements so long as the record is not publicly cited by an agency in connection with an agency action.
The following information is exempt from public disclosure under the PRA:
The definitions of "human subject" and "research" are the same as those contained in the HHS Common Rules. Specifically, human subject means a living individual about whom an investigator conducting research: (1) obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or (2) obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Certain activities are not considered research, including: scholarly and journalistic activities including the collection and use of information, that focus directly on the specific individuals about whom the information is collected; public health surveillance activities, including the collection and testing of information or biospecimens, conducted, supported, requested, ordered, required, or authorized by a public health authority; the collection and analysis of information, biospecimens, or records by or for a criminal justice agency for activities authorized by law or court order solely for criminal justice or criminal investigative purposes; and authorized operational activities in support of intelligence, homeland security, defense, or other national security missions.