(1) Except as authorized in subsections (2) and (3) of this section, or pursuant to court order under RCW 70.123.075, a domestic violence program, an individual who assists a domestic violence program in the delivery of services, or an agent, employee, or volunteer of a domestic violence program shall not disclose information about a recipient of shelter, advocacy, or counseling services without the informed authorization of the recipient. In the case of an unemancipated minor, the minor and the parent or guardian must provide the authorization. For the purposes of this section, a "domestic violence program" means an agency that provides shelter, advocacy, or counseling for domestic violence victims in a supportive environment.

(2)(a) A recipient of shelter, advocacy, or counseling services may authorize a domestic violence program to disclose information about the recipient. The authorization must be in writing, signed by the recipient, or if an unemancipated minor is the recipient, signed by the minor and the parent or guardian, and must contain a reasonable time limit on the duration of the recipient's authorization. If the authorization does not contain a date upon which the authorization to disclose information expires, the recipient's authorization expires ninety days after the date it was signed.

(b) The domestic violence program's disclosure of information shall be only to the extent authorized by the recipient. The domestic violence program, if requested, shall provide a copy of the disclosed information to the recipient.

(c) Except as provided under this chapter, an authorization is not a waiver of the recipient's rights or privileges under other statutes, rules of evidence, or common law.

(3) If disclosure of a recipient's information is required by statute or court order, the domestic violence program shall make reasonable attempts to provide notice to the recipient affected by the disclosure of information. If personally identifying information is or will be disclosed, the domestic violence program shall take steps necessary to protect the privacy and safety of the persons affected by the disclosure of the information.

(4) To comply with tribal, federal, state, or territorial reporting, evaluation, or data collection requirements, domestic violence programs may share data in the aggregate that does not contain personally identifying information and that: (a) Pertains to services to their clients; or (b) is demographic information.