Effective Date of Rule: Thirty-one days after filing.

     Purpose: The purpose of this rule is to: (1) Retain HIV case reports by name through a confidential name-based reporting system; and (2) expand HIV laboratory reporting to include all HIV-related laboratory tests results. This rule: (1) Allows Washington to maintain its current level of federal funding for HIV prevention and care services; (2) enhance HIV reporting accuracy to determine HIV service delivery needs; and (3) provide streamlined control of HIV by local-level names retention.

     Citation of Existing Rules Affected by this Order: Amending WAC 246-101-201, 246-101-520, and 246-101-635.

     Statutory Authority for Adoption: RCW 70.24.125.

      Adopted under notice filed as WSR 06-10-018 on August [May] 1, 2006.

     Changes Other than Editing from Proposed to Adopted Version: New language in WAC 246-101-520 (1)(b) and (c) clarifies that local health jurisdictions can maintain asymptomatic HIV case data through a name-based surveillance system as long as Center for Disease Control and Prevention's (CDC) confidentiality and security standards for HIV name-based reporting are followed and they cooperate with the department in biennial reviews. New language in WAC 246-101-635(12) also requires the department to report to the board if CDC no longer requires name-based HIV reporting.

     A final cost-benefit analysis is available by contacting Jessica Peterson, DOH IDRH, P.O. Box 47838, Olympia, WA 98504-7838, phone (360) 236-3412, fax (360) 586-5440, e-mail Jessica.Peterson@doh.wa.gov.

     Number of Sections Adopted in Order to Comply with Federal Statute: New 0, Amended 0, Repealed 0; Federal Rules or Standards: New 0, Amended 3, Repealed 0; or Recently Enacted State Statutes: New 0, Amended 0, Repealed 0.

     Number of Sections Adopted at Request of a Nongovernmental Entity: New 0, Amended 0, Repealed 0.

     Number of Sections Adopted on the Agency's Own Initiative: New 0, Amended 0, Repealed 0.

     Number of Sections Adopted in Order to Clarify, Streamline, or Reform Agency Procedures: New 0, Amended 0, Repealed 0.

     Number of Sections Adopted Using Negotiated Rule Making: New 0, Amended 0, Repealed 0;      Pilot Rule Making: New 0, Amended 0, Repealed 0; or Other Alternative Rule Making: New 0, Amended 3, Repealed 0.

     Date Adopted: August 1, 2006.

Craig McLaughlin

Executive Director

OTS-8544.7

AMENDATORY SECTION(Amending WSR 05-03-055, filed 1/11/05, effective 2/11/05)

WAC 246-101-201   Notifiable conditions and laboratories.   This section describes the conditions about which Washington's laboratories must notify public health authorities of on a statewide basis. The board finds that the conditions in the table below (Table Lab-1) are notifiable for the prevention and control of communicable and noninfectious diseases and conditions in Washington. The board also finds that submission of specimens for many of these conditions will further prevent the spread of disease. Laboratory directors ((shall)) must notify public health authorities of positive cultures and preliminary test results as individual case reports and provide specimen submissions using procedures described throughout this chapter. Local health officers may require additional conditions to be notifiable within the local health officer's jurisdiction.

     WAC 246-101-205, 246-101-210, 246-101-215, 246-101-220, 246-101-225, and 246-101-230 also include requirements for how notifications and specimen submissions are made, when they are made, the content of these notifications and specimen submissions, and how information regarding notifiable conditions cases must be handled and may be disclosed.

Table Lab-1 (Conditions Notifiable by Laboratory Directors)

     (1) Laboratory directors may notify either local health departments or the department or both of other laboratory results through cooperative agreement.

     (2) Laboratory directors may submit malaria cultures to the state public health laboratories.

[Statutory Authority: RCW 43.20.050, 70.24.125. 05-03-055, § 246-101-201, filed 1/11/05, effective 2/11/05. Statutory Authority: RCW 43.20.050, 70.24.125 and 70.28.010. 00-23-120, § 246-101-201, filed 11/22/00, effective 12/23/00.]

     (a) Use identifying information on HIV-infected individuals only:

     (i) For purposes of contacting the HIV-positive individual to provide test results and post-test counseling; or

     (ii) To contact persons who have experienced substantial exposure, including sex and injection equipment-sharing partners, and spouses; or

     (iii) To link with other name-based public health disease registries when doing so will improve ability to provide needed care services and counseling and disease prevention; or

     (iv) As specified in WAC 246-100-072; or

     (v) To provide case reports to the state health department.

     (b) Destroy case report identifying information on asymptomatic HIV-infected individuals received as a result of this chapter within three months of receiving a complete case report((.

     (c))), or maintain HIV case reports in secure systems that meet the following standards and are consistent with the 2006 Security and Confidentiality Guidelines developed by the Centers for Disease Control and Prevention:

     (i) Secure systems must be described in written policies that are reviewed annually by the local health officer;

     (ii) Access to case report information must be limited to health department staff who need it to perform their job duties and a current list of these staff must be maintained by the local health officer;

     (iii) All physical locations containing electronic or paper copies of surveillance data must be enclosed in a locked, secured area with limited access and not accessible by window;

     (iv) Paper copies or electronic media containing surveillance information must be housed inside locked file cabinets that are in the locked, secured area;

     (v) A crosscut shredder must be available for destroying information and electronic media must be appropriately sanitized prior to disposal;

     (vi) Files or data bases containing confidential information must reside on either stand-alone computers with restricted access or on networked drives with proper access controls, encryption software and firewall protection;

     (vii) Electronic communication of confidential information must be protected by encryption standards that are reviewed annually by the local health officer;

     (viii) Locking briefcases must be available for transporting confidential information;

     (c) If maintaining identifying information on asymptomatic HIV-infected individuals more than ninety days following receipt of a completed case report, cooperate with the department of health in biennial review of system security measures described in (b) of this subsection.

     (d) Destroy documentation of referral information established in WAC 246-100-072 ((and this subsection)) containing identities and identifying information on HIV-infected individuals and at-risk partners of those individuals immediately after notifying partners or within three months, whichever occurs first unless such documentation is being used in an investigation of conduct endangering the public health or of behaviors presenting an imminent danger to the public health pursuant to RCW 70.24.022 or 70.24.024.

     (((d))) (e) Not disclose identifying information received as a result of this chapter unless:

     (i) Explicitly and specifically required to do so by state or federal law; or

     (ii) Authorized by written patient consent.

     (2) Local health department personnel are authorized to use HIV identifying information obtained as a result of this chapter only for the following purposes:

     (a) Notification of persons with substantial exposure, including sexual or syringe-sharing partners;

     (b) Referral of the infected individual to social and health services;

     (c) Linkage to other public health data bases, provided that the identity or identifying information on the HIV-infected person is not disclosed outside of the health department; and

     (d) Investigations pursuant to RCW 70.24.022 or 70.24.024.

     (3) Public health data bases do not include health professions licensing records, certifications or registries, teacher certification lists, other employment rolls or registries, or data bases maintained by law enforcement officials.

     (4) Local health officials will report ((asymptomatic)) HIV infection cases to the state health department ((according to a standard code developed by the state health department)).

     (5) Local health officers ((shall)) must require and maintain signed confidentiality agreements with all health department employees with access to HIV identifying information. These agreements will be renewed at least annually and include reference to criminal and civil penalties for violation of chapter 70.24 RCW and other administrative actions that may be taken by the department.

     (6) Local health officers ((shall)) must investigate potential breaches of the confidentiality of HIV identifying information by health department employees. All breaches of confidentiality ((shall)) must be reported to the state health officer or their designee for review and appropriate action.

     (7) Local health officers and local health department personnel must assist the state health department to reascertain the identities of previously reported cases of HIV infection.

[Statutory Authority: RCW 70.24.130 and 70.24.380. 05-11-110, § 246-101-520, filed 5/18/05, effective 6/18/05. Statutory Authority: RCW 43.20.050 and 70.24.125. 00-23-120, § 246-101-520, filed 11/22/00, effective 12/23/00.]

     (1) Department personnel ((shall)) must not disclose identifying information received as a result of receiving information regarding a notifiable conditions report of a case of AIDS or HIV unless:

     (a) Explicitly and specifically required to do so by state or federal law; or

     (b) Authorized by written patient consent.

     (2) Department personnel are authorized to use HIV identifying information received as a result of receiving information regarding a notifiable conditions report of a case of AIDS or HIV only for the following purposes:

     (a) Notification of persons with substantial exposure, including sexual or syringe-sharing partners;

     (b) Referral of the infected individual to social and health services; and

     (c) Linkage to other public health data bases, provided that the identity or identifying information on the HIV-infected person is not disclosed outside of the health department.

     (3) For the purposes of this chapter, public health data bases do not include health professions licensing records, certifications or registries, teacher certification lists, other employment rolls or registries, or data bases maintained by law enforcement officials.

     (4) The state health officer ((shall)) must require and maintain signed confidentiality agreements with all department employees with access to HIV identifying information. These agreements will be renewed at least annually and include reference to criminal and civil penalties for violation of chapter 70.24 RCW and other administrative actions that may be taken by the department.

     (5) The state health officer ((shall)) must investigate potential breaches of the confidentiality of HIV identifying information by department employees. All breaches of confidentiality shall be reported to the state health officer or their authorized representative for review and appropriate action.

     (6) The department must maintain all HIV case reports in a name-based surveillance system solely for the purpose of complying with HIV reporting guidelines from the federal Centers for Disease Control and Prevention, and must not disclose or otherwise use any information contained in that system for any other purpose, except as expressly permitted by this section.

     (7) Authorized representatives of the department must review available records to reascertain the identities of previously reported cases of asymptomatic HIV infection and retain those cases in a confidential name-based system.

     (8) The department must maintain HIV case reports in secure systems that meet the following standards and are consistent with the 2006 Security and Confidentiality Guidelines developed by the Centers for Disease Control and Prevention:

     (a) Secure systems must be described in written policies that are reviewed annually by the overall responsible party;

     (b) Access to case report information must be limited to health department staff who need it to perform their job duties and a current list of these staff must be maintained by the overall responsible party;

     (c) All physical locations containing electronic or paper copies of surveillance data must be enclosed in a locked, secured area with limited access and not accessible by window;

     (d) Paper copies or electronic media containing surveillance information must be housed inside locked file cabinets that are in the locked, secured area;

     (e) A crosscut shredder must be available for destroying information and electronic media must be appropriately sanitized prior to disposal;

     (f) Files or data bases containing confidential information must reside on either stand-alone computers with restricted access or on networked drives with proper access controls, encryption software and firewall protection;

     (g) Electronic communication of confidential information must be protected by encryption standards that are reviewed annually by the overall responsible party;

     (h) Locking briefcases must be available for transporting confidential information.

     (9) The state health officer or designee must conduct a biennial review of system security measures described in WAC 246-101-520 (1)(b) at local health jurisdictions that are maintaining records by name.

     (10) When providing technical assistance to a local health department, authorized representatives of the department may temporarily and subject to the time limitations in WAC ((246-101-525(2))) 246-101-520 receive the names of reportable cases of ((asymptomatic)) HIV infection for the purpose of ((HIV surveillance,)) partner notification, or special studies. Upon completion of the activities by representatives of the state health department, named information will be((:

     (a))) provided to the local health department subject to the provisions of WAC ((246-101-525(2); and

     (b) Converted to code and maintained as code only until the person is diagnosed with AIDS)) 246-101-520.

     (((7) Within twelve months of the effective date of the HIV infection notification system (by September 1, 2000), established in this chapter,)) (11) By December 2007, the state health officer, in cooperation with local health officers, will report to the board on:

     (a) The ability of the HIV reporting system to meet surveillance performance standards established by the federal Centers for Disease Control and Prevention;

     (b) The cost of the reporting system for state and local health departments;

     (c) The reporting system's effect on disease control activities; ((and))

     (d) The impact of HIV reporting on HIV testing among persons at increased risk of HIV infection; and

     (e) The availability of anonymous HIV testing in the state.

     (12) The state health officer must provide a report to the state board of health if federal policy no longer requires that HIV surveillance systems be name-based.

[Statutory Authority: RCW 43.20.050, 70.24.125 and 70.28.010. 00-23-120, § 246-101-635, filed 11/22/00, effective 12/23/00.]

© Washington State Code Reviser's Office