(1) All records and specimens containing or accompanied by patient identifying information are confidential.

(2) Health care providers who know of a person with a notifiable condition, other than a sexually transmitted disease, shall release identifying information only to other individuals responsible for protecting the health and well-being of the public through control of disease, including the local health department.

(3) Health care providers with knowledge of a person with sexually transmitted disease, and following the basic principles of health care providers, which respect the human dignity and confidentiality of patients:

(a) May disclose the identity of a person or release identifying information only as specified in RCW 70.24.105; and

(b) Shall under RCW 70.24.105(6), use only the following customary methods for exchange of medical information:

(i) Health care providers may exchange medical information related to HIV testing, HIV test results, and confirmed HIV or confirmed STD diagnosis and treatment in order to provide health care services to the patient. This means that information shared impacts the care or treatment decisions concerning the patient; and the health care provider requires the information for the patient's benefit.

(ii) Health care providers responsible for office management are authorized to permit access to a patient's medical information and medical record by medical staff or office staff to carry out duties required for care and treatment of a patient and the management of medical information and the patient's medical record.

(c) Health care providers conducting a clinical HIV research project shall report the identity of an individual participating in the project unless:

(i) The project has been approved by an institutional review board; and

(ii) The project has a system in place to remind referring health care providers of their reporting obligations under this chapter.

(4) Health care providers shall establish and implement policies and procedures to maintain confidentiality related to a patient's medical information.