(1) All records and specimens containing or accompanied by patient identifying information are confidential.

(2) Personnel in health care facilities who know of a person with a notifiable condition, other than a sexually transmitted disease, shall release identifying information only to other individuals responsible for protecting the health and well-being of the public through control of disease.

(3) Personnel in health care facilities with knowledge of a person with sexually transmitted disease, and following the basic principles of health care providers, which respect the human dignity and confidentiality of patients:

(a) May disclose the identity of a person or release identifying information only as specified in RCW 70.24.105; and

(b) Shall under RCW 70.24.105(6), use only the following customary methods for exchange of medical information:

(i) Health care providers may exchange medical information related to HIV testing, HIV test results, and confirmed HIV or confirmed STD diagnosis and treatment in order to provide health care services to the patient.

(ii) This means that information shared impacts the care or treatment decisions concerning the patient; and the health care provider requires the information for the patient's benefit.

(4) Personnel responsible for health care facility management are authorized to permit access to medical information as necessary to fulfill professional duties. Health care facility administrators shall advise those persons permitted access under this section of the requirement to maintain confidentiality of such information as defined under this section and chapter 70.24 RCW. Professional duties means the following activities or activities that are functionally similar:

(a) Medical record or chart audits;

(b) Peer reviews;

(c) Quality assurance;

(d) Utilization review purposes;

(e) Research as authorized under chapters 42.48 and 70.02 RCW;

(f) Risk management; and

(g) Reviews required under federal or state law or rules.

(5) Personnel responsible for health care facility management are authorized to permit access to a patient's medical information and medical record by medical staff or health care facility staff to carry out duties required for care and treatment of a patient and the management of medical information and the patient's medical record.

(6) Health care facilities conducting a clinical HIV research project shall report the identity of an individual participating in the project unless:

(a) The project has been approved by an institutional review board; and

(b) The project has a system in place to remind referring health care providers of their reporting obligations under this chapter.

(7) Health care facilities shall establish and implement policies and procedures to maintain confidentiality related to a patient's medical information.