(1) A government agency requesting data files that contain direct patient identifiers for nonresearch purposes must comply with the requirement of RCW 43.70.052 and this section. The department will not release data to a government agency requesting data from the department pursuant to this section until all requirements of this section have been completed to the satisfaction of the department.

(2) A government agency submitting a data request under this section for nonresearch purposes must submit all of the following to the department in the form or format required by the department:

(a) A completed application on the form provided by the department;

(b) A signed data use agreement with the department that conforms with WAC 246-455-400;

(c) All information required in subsection (3) of this section; and

(d) All fees required by WAC 246-455-990.

(3) A government agency submitting a data request under this section for nonresearch purposes must submit to the department all of the following information:

(a) Name, title, organizational affiliation, and contact information (mailing address, telephone number, and email address) of the requestor, the organization official authorized to execute agreements, the organization information technology security officer, and organization privacy officer;

(b) Purpose or intended use of the data being requested, including any proposed redisclosure of the data;

(c) Length of time and frequency of the data being requested;

(d) Physical and electronic security measures to be taken to assure confidentiality and security of identifying information, including stored information;

(e) Provision for return or destruction of the information at the conclusion of use;

(f) Population of interest;

(g) Names and titles of all persons who will have access to the data;

(h) The plan for use of the data and certification to abide by the department's small numbers guidelines;

(i) Patient discharge data elements needed to achieve the purpose; and

(j) Years of the requested data.

(4) The department may request additional information regarding the request for patient discharge data containing direct identifiers. If additional information is requested, the government agency must submit the information within 30 days of the department's request or the request for data may be denied.

(5) If the department determines the request for data submitted pursuant to this section is in fact for research purposes, the department will require the government agency to comply with the provisions of WAC 246-455-200.

(6) If the department suspects or is unsure if the request for data submitted pursuant to this section is for research purposes, the department may require the government agency to comply with the provisions of WAC 246-455-200.

(7) The department may deny a request for data if the government agency submitting a data request under this section fails to meet any of the requirements of this chapter or RCW 43.70.052.