The department may create and release data files with patient discharge information as allowed under RCW 43.70.052. The type of information contained in the file, including direct and indirect patient identifiers, determines the category and permitted release of the data file.

(1) Confidential data files contain one or more direct patient identifiers.

(a) The department may distribute a confidential data file to:

(i) Government agencies after entering into a data use agreement; or

(ii) Researchers with approval from the Washington state IRB and a signed confidentiality agreement.

(b) Direct patient identifier means information that identifies a patient. Direct identifiers include:

(i) Patient first name;

(ii) Patient middle name(s);

(iii) Patient last name;

(iv) Social Security number;

(v) Patient control number or medical record number;

(vi) Patient zip code + four digits;

(vii) Dates that include day, month, and year; and

(viii) Admission and discharge dates in combination.

(c) Government agencies include: Washington state boards, commissions, committees, departments, educational institutions, or other Washington state agencies which are created by or pursuant to statute, other than courts and the legislature; Washington county or city agencies, U.S. federal agencies.

(d) In order to comply with RCW 70.02.240 protecting mental health information for youth, for patients under age eighteen, the confidential data file will not include mental health related diagnosis or procedure codes or any diagnosis related groups or major diagnosis category.

(e) In order to comply with WAC 246-490-110 protecting the identity of facilities that provide abortions, for any hospitalization that includes a diagnosis or procedure code indicating an induced termination of pregnancy, the confidential file will not include patient name, facility ID, provider identifiers, or geographic identifiers less than state.

(f) The department may provide the fewest data elements necessary for the stated purpose of the project.

(2) Potentially identifiable data files contain indirect patient identifiers.

(a) The department may distribute a potentially identifiable data file to anyone after entering into a data use agreement with the requestor or requesting organization.

(b) Indirect patient identifier means information that may identify a patient when combined with other information. Identification of a specific patient is more likely when a file contains a group of ten or fewer similar hospitalizations.

(c) Indirect patient identifiers include the following data elements, in combination or individually, when they create a group of ten or fewer similar hospitalizations in a file:

(i) Hospital or provider identifiers;

(ii) Five digit zip code;

(iii) County, state, and country of residence;

(iv) Dates that include month and year;

(v) Admission and discharge hour;

(vi) Secondary diagnosis, procedure, present on admission, external cause of injury, and payer codes;

(vii) Age in years;

(viii) Race and ethnicity.

(d) The potentially identifiable data file does not contain any direct identifiers listed in subsection (1)(b)(i) through (viii) of this section.

(3) Public data file with no patient identifiers:

(a) The department may release an unrestricted public data file that does not contain information that alone or in combination with other information identifies a patient.

(b) The department may create a public file by:

(i) Removing all data elements identified in subsection (2)(c)(i) through (viii) of this section; or

(ii) By aggregating or anonymizing data identified in subsection (2)(c)(i) through (v), (vii), and (viii) of this section so that each combination of indirect patient identifiers remaining in the public file must appear at least ten times.

(c) The public data file does not contain any direct identifiers listed in subsection (1)(b)(i) through (viii) of this section.