(1) The state health officer or designee shall establish and maintain confidentiality procedures related to employee handling of all reports of cases and suspected cases, prohibiting disclosure of report information identifying an individual case or suspected cases except:

(a) To employees of the local health department, other local health departments, or other official agencies needing to know for the purpose of administering public health laws and these regulations.

(b) To health care providers, specific designees of health care facilities, laboratory directors, and others for the purpose of collecting additional information about a case or suspected case as required for disease prevention and control.

(c) For research approved by an institutional review board as indicated under chapter 42.48 RCW. The institutional review board applies federal and state privacy laws to research requests for confidential information.

(2) All department employees, contractors, and others with access to identifying information related to a case or suspected case of a person diagnosed with a notifiable condition shall be required to sign a confidentiality agreement. The confidentiality agreements shall be renewed annually and shall include reference to criminal and civil penalties for violation of chapters 70.02 and 70.24 RCW and other administrative actions that may be taken by the department.