Before giving a subrecipient access to protected personal information, the recipient must validate that the subrecipient demonstrates the following minimum requirements:

(1) The subrecipient has a permissible use under federal or Washington state laws, whichever is more restrictive.

(2) The subrecipient is a qualified recipient under federal or Washington state laws.

(3) The subrecipient has sufficient protections in place to secure the privacy of the protected personal information in accordance with the data sharing agreement.