"NEW SECTION.  Sec. 901   (1) By July 1, 2012, the department of health shall, in consultation with the department of agriculture, adopt rules for the creation, implementation, maintenance, and timely upgrading of a secure and confidential registration system that allows:
     (a) A peace officer to verify at any time whether a health care professional has registered a person who has been contacted by that peace officer and has provided that peace officer information necessary to verify his or her registration as either a qualifying patient or a designated provider;
     (b) A peace officer to verify at any time during ordinary business hours of the department of health whether a health care professional has registered a person as either a qualifying patient or a designated provider, or an address as the primary residence of a qualifying patient or designated provider; and
     (c) A peace officer to verify at any time during ordinary business hours of the department of health whether a person, location, or business is licensed by the department of agriculture or the department of health as a licensed producer, licensed processor of cannabis products, or licensed dispenser.
     (2) The department of agriculture must, in consultation with the department of health, create and maintain a secure and confidential list of persons to whom it has issued a license to produce cannabis for medical use or a license to process cannabis products, and the physical addresses of the licensees' production and processing facilities. The list must meet the requirements of subsection (9) of this section and be transmitted to the department of health to be included in the registry established by this section.
     (3) The department of health must, in consultation with the department of agriculture, create and maintain a secure and confidential list of the persons to whom it has issued a license to dispense cannabis for medical use that meets the requirements of subsection (9) of this section and must be included in the registry established by this section.
     (4) Law enforcement shall comply with Article I, section 7 of the state Constitution when accessing the registration system for criminal investigations, which, at a minimum, requires an articulated individualized suspicion of: (a) Criminal activity; or (b) the possession, use, manufacture, production, processing, delivery, transport, or distribution of cannabis, whether criminal or noncriminal.
     (5) Registration in the system shall be optional for qualifying patients and designated providers, not mandatory, and registrations are valid for one year, except that qualifying patients must be able to remove themselves from the registry at any time. For licensees, registrations are valid for the term of the license and the registration must be removed if the licensee's license is expired or revoked. The department of health must adopt rules providing for registration renewals and for removing expired registrations and expired or revoked licenses from the registry.
     (6) Fees, including renewal fees, for qualifying patients and designated providers participating in the registration system shall be adequate to recapture the cost to the state of implementing, maintaining, and enforcing the provisions of this section and the rules adopted to carry out its purposes.
     (7) The department of health, in conjunction with the department of agriculture, must establish and collect reasonable fees for the dissemination of information to employees of state and local law enforcement agencies relating to whether a person is a licensed producer, processor of cannabis products, or dispenser, or that a location is the recorded address of a license producer, processor of cannabis products, or dispenser, and for the dissemination of log records relating to such requests for information to the subjects of those requests.
     (8) During the rule-making process, the department of health shall consult with stakeholders and persons with relevant expertise, to include, but not be limited to, qualifying patients, designated providers, health care professionals, state and local law enforcement agencies, and the University of Washington computer science and engineering security and privacy research lab.
     (9) The registration system shall meet the following requirements:
     (a) Any personally identifiable information included in the registration system must be "nonreversible," pursuant to definitions and standards set forth by the national institute of standards and technology;
     (b) Any personally identifiable information included in the registration system must not be susceptible to linkage by use of data external to the registration system;
     (c) The registration system must incorporate current best differential privacy practices, allowing for maximum accuracy of registration system queries while minimizing the chances of identifying the personally identifiable information included therein; and
     (d) The registration system must be upgradable and updated in a timely fashion to keep current with state of the art privacy and security standards and practices.
     (10) The registration system shall maintain a log of each verification query submitted by a peace officer, including the peace officer's name, agency, and identification number, for a period of no less than three years from the date of the query. Personally identifiable information of qualifying patients and designated providers included in the log shall be confidential and exempt from public disclosure, inspection, or copying under chapter 42.56 RCW: PROVIDED, That:
     (a) Names and other personally identifiable information from the list may be released only to:
     (i) Authorized employees of the department of agriculture and the department of health as necessary to perform official duties of either department; or
     (ii) Authorized employees of state or local law enforcement agencies, only as necessary to verify that the person or location is a qualified patient, designated provider, licensed producer, licensed processor of cannabis products, or licensed dispenser, and only after the inquiring employee has provided adequate identification. Authorized employees who obtain personally identifiable information under this subsection may not release or use the information for any purpose other than verification that a person or location is a qualified patient, designated provider, licensed producer, licensed processor of cannabis products, or licensed dispenser;
     (b) Information contained in the registration system may be released in aggregate form, with all personally identifying information redacted, for the purpose of statistical analysis and oversight of agency performance and actions;
     (c) The subject of a registration query may appear during ordinary department of health business hours and inspect or copy log records relating to him or her upon adequate proof of identity; and
     (d) The subject of a registration query may submit a written request to the department of health, along with adequate proof of identity, for copies of log records relating to him or her.
     (11) This section does not prohibit a department of agriculture employee or a department of health employee from contacting state or local law enforcement for assistance during an emergency or while performing his or her duties under this chapter.
     (12) Fees collected under this section must be deposited into the health professions account under RCW 43.70.320."