(1) If the office accepts a complaint and conducts an investigation, the office will notify the person(s) that is the subject of the complaint in writing.

(2) The notice will include the following information:

(a) The factual allegations supporting each alleged inappropriate disclosure or use of protected information violation in terms sufficient to put the persons on notice of the specific reasons for the investigation;

(b) The statutory and administrative code provisions addressing the allegations, if applicable;

(c) A request that the person provide a written response to the allegations including any documents that support the response, and notice that failure to respond will result in the office making a decision without the person's input; and

(d) A directive to cease using or destroy the data received from the WA-APCD until the investigation has been completed and the person is notified that he/she may again use the data provided. The person shall complete an attestation that the person has complied with this directive. A violation of this directive shall be grounds for finding a separate violation of the inappropriate disclosure or use of protected information.

(3) The lead organization and the data vendor shall cooperate with the investigator and timely respond to requests for information or documents during the course of an investigation.

(4) At the conclusion of the investigation, the investigator will issue a report to the WA-APCD program director that includes the following information:

(a) Facts found by the investigator;

(b) Whether the facts support finding inappropriate disclosures or uses of protected information; and

(c) A recommendation to dismiss the complaint with no further action or to issue an order with a penalty, which recommendation may include a penalty amount and any other actions that the office should take as a result of the violation(s).

(5) A finding that the person inappropriately disclosed or used protected information is a violation for purposes of this section. In the case of a continuing inappropriate disclosure or use of protected information, each day of the inappropriate disclosure or use is a separate violation.