IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
SEATTLE CHILDREN’S HOSPITAL, a ) No. 81175-4-I Washington nonprofit corporation, ) (Consolidated with No. 81295-5-I) ) Appellant, ) DIVISION ONE ) v. ) ) KING COUNTY, a Washington ) municipal corporation; WASHINGTON ) STATE DEPARTMENT OF HEALTH; ) UNPUBLISHED OPINION and KING BROADCASTING ) COMPANY and its affiliates, d/b/a ) KING 5, a Washington corporation, ) ) Respondents. )
BOWMAN, J. — Seattle Children’s Hospital (SCH) moved for a temporary
restraining order against the Washington State Department of Health (DOH) and
a preliminary injunction against King Broadcasting Company and its affiliates
(KING 5) along with Seattle and King County Public Health (KCPH),1 seeking to
prevent the release of documents related to aspergillus mold infections in
surgical patients. The trial court ultimately denied the motions and ordered
release of the records. SCH appeals, arguing the documents fall under the
quality improvement and infection reporting exemptions to the Public Records
1 KCPH did not file briefing or participate in this appeal.
Citations and pin cites are based on the Westlaw online version of the cited material. No. 81175-4-I (Consol. with No. 81295-5-I)/2
Act (PRA), chapter 42.56 RCW. SCH and DOH also urge us to apply the federal
Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-
191, 110 Stat. 1936, deidentification guidelines to any released patient records to
ensure medical confidentiality under Washington’s Uniform Health Care
Information Act (HCIA), chapter 70.02 RCW. We conclude that neither the
quality improvement nor the infection reporting exemption prevents release of the
records in this case. And we decline to impose judicially the HIPAA guidelines
for deidentification of patient information under the HCIA. We affirm denial of the
temporary restraining order and preliminary injunction but remand to the trial
court to ensure that all records comply with the required patient privacy
protections before they are released.
FACTS
Since 2001, SCH has experienced recurring infections in surgical patients
caused by aspergillus mold. In June 2018, SCH reported to KCPH that two more
patients developed aspergillus surgical site infections related to procedures
performed at the hospital. KCPH assisted SCH with its investigation into the
outbreak through August 2018. In May 2019, KCPH learned that SCH closed
their operating rooms because of new aspergillus cases. KCPH contacted the
Centers for Disease Control and Prevention (CDC) to help SCH investigate the
new outbreak. As part of the investigation, KCPH, DOH, and the CDC conducted
a site visit to SCH in July 2019.
2 No. 81175-4-I (Consol. with No. 81295-5-I)/3
In August 2019, a KING 5 news reporter made a PRA request to KCPH for
records related to the SCH aspergillus infections.2 KCPH compiled the records,
reviewed them, and determined no PRA exemptions protected the records from
disclosure. The more than 4,700 pages of records generally consist of e-mail
exchanges between SCH, KCPH, DOH, and the CDC discussing potential
sources of aspergillus infection, sample testing for the presence of aspergillus
mold, procedures to prevent future aspergillus infection of patients, and follow-up
to monitor implementation of those procedures and any new aspergillus
outbreaks. The records also include documents generated or shared in the
course of discussions among the agencies, including during the SCH site visit.
KCPH notified SCH of the KING 5 request and told SCH it intended to
release the records “unredacted.” SCH agreed to the release of most of the
records, objecting to only those it argued “contain information of the hospital and
2 DOH and KCPH received similar requests from several other media outlets, as well as the law firm Stritmatter, Kessler, Koehler, Moore (Stritmatter Firm). These entities are not named as parties on appeal, but several amici curiae briefs represent their interests. The Washington Coalition for Open Government and the Washington Newspaper Publishers Association filed an amici curiae brief in support of affirming the trial court’s orders. Their brief emphasizes the public’s compelling interest in access to information about the serious health risk associated with the recurring aspergillus infections at SCH. The brief also argues for limited redactions of health care records to only information that may lead to the identity of patients. The Washington State Hospital Association, the Association of Washington Public Hospital Districts, the Washington State Medical Association, and the American Medical Association (collectively Medical Associations) filed an amici curiae brief in support of SCH’s claimed quality improvement committee exemption to the PRA. The Medical Associations assert the critical importance of confidentiality in the quality improvement process and argue for broad protection of communications related to the process. Finally, the Stritmatter Firm moved to file an amicus curiae brief in support of KING 5’s arguments for broad public disclosure. A commissioner of this court referred the motion to the panel for consideration. We note that the parties have filed responses to the motion and grant the Stritmatter Firm’s motion to file the amicus brief. The Stritmatter Firm filed a class action lawsuit against SCH on behalf of multiple families of children who contracted aspergillus infections after medical procedures at SCH. All but one of the six named class representatives died after contracting aspergillus infections at SCH. The Stritmatter Firm argues disclosure of the records at issue is in the public’s interest, and public disclosure of the documents will prevent further harm to potential patients and doctors as well as the families and children already affected by the aspergillus outbreaks at SCH.
3 No. 81175-4-I (Consol. with No. 81295-5-I)/4
its patients that is expressly protected from public disclosure under the PRA and
patient privacy laws.” KCPH told SCH that it would release the unredacted
documents unless SCH reached an agreement with KING 5 or obtained an order
from the court enjoining release of the exempt information. SCH and KING 5
could not reach an agreement on how to redact the records.
In October 2019, SCH filed a complaint for declaratory judgment and
injunctive relief to stop KCPH from releasing the remaining unredacted records.
SCH also named defendant KING 5 as a “potentially interested party.” Soon
after, SCH filed a motion for preliminary injunction to prevent disclosure pending
final resolution of its lawsuit, arguing that the records contain protected
information and documents exempt from public disclosure. The court granted the
preliminary injunction, finding that the records were exempt from disclosure
under the HCIA, HIPAA, and the quality improvement (QI) exemption in the PRA.
On November 7, 2019, the court enjoined KCPH from disclosing the remaining
records except in the redacted form proposed by SCH.3 KING 5 moved for
reconsideration, which the trial court treated as a motion to rescind or withdraw
the preliminary injunction. The court set a briefing schedule and hearing date for
KING 5’s motion.
Throughout the proceedings, KCPH continued to search its database for
records related to SCH aspergillus infections. After the preliminary injunction
issued, KCPH produced more responsive records and sent them to SCH for
review. Among those records, SCH found documents it believed should be
3 The court also ordered SCH to remove several redactions of information that the court determined was not exempt from disclosure.
4 No. 81175-4-I (Consol. with No. 81295-5-I)/5
exempt from disclosure. On February 14, 2020, SCH moved to amend the
November 7, 2019 preliminary injunction to prevent disclosure of the new
records.
During this time, DOH also received PRA requests for records related to
aspergillus mold infections at SCH. DOH notified SCH that in February 2020, it
intended to release over 800 pages of records subject to redaction for only
identifiable patient health care information. SCH argued that 117 pages of those
records, many of them duplicative of the records held by KCPH, should be
exempt from disclosure. On February 14, 2020, the same day SCH filed the
preliminary injunction to prevent the release of KCPH’s records, it also filed an
amended complaint to add DOH as a defendant. SCH sought declaratory
judgment and injunctive relief enjoining DOH from releasing its records. SCH
then filed a motion for a temporary restraining order (TRO), seeking to prevent
DOH’s imminent release of their records.
The court set a hearing date of February 28, 2020 on SCH’s motion for a
TRO as to DOH, SCH’s motion to amend the November 2019 preliminary
injunction as to KCPH, and KING 5’s motion to rescind or withdraw the
preliminary injunction. After hearing oral argument, the court denied the motion
for a TRO, finding that new evidence refuted SCH’s claim that the disputed
records are exempt as part of the QI process. The court also denied SCH’s
motion to amend the preliminary injunction. It then granted KING 5’s motion to
rescind the previously issued preliminary injunction against KCPH. The court
entered an order on March 23, 2020, releasing the 125 pages of records still held
5 No. 81175-4-I (Consol. with No. 81295-5-I)/6
by KCPH under the injunction, another 595 pages produced by KCPH after the
injunction issued, and the 117 pages of documents held by DOH. The court
stayed enforcement of its March 23 order pending appeal.
SCH filed a notice for discretionary review of the trial court’s order denying
its motion for a TRO related to the DOH records. A commissioner of this court
granted a temporary injunction to preserve the status quo. The commissioner
accepted review on the issue of whether HIPAA deidentification guidelines apply
when redacting records to protect patient information under the HCIA.4 SCH
then filed an appeal of the court’s order denying its motion to amend their
preliminary injunction against KCPH and granting KING 5’s motion to rescind the
original preliminary injunction. The commissioner consolidated the appeal and
discretionary review as a single appeal under RAP 2.2(a)(3) with an accelerated
briefing schedule.
ANALYSIS
“The PRA is a ‘strongly worded mandate for broad disclosure of public
records.’ ” Cornu-Labat v. Hosp. Dist. No. 2 Grant County, 177 Wn.2d 221, 229,
298 P.3d 741 (2013) (quoting Hearst Corp. v. Hoppe, 90 Wn.2d 123, 127, 580
P.2d 246 (1978)). The act requires state and local agencies to disclose public
records responsive to requests unless a specific exemption applies. Cornu-
Labat, 177 Wn.2d at 229; RCW 42.56.070(1). In keeping with its mandate, “the
PRA explicitly declares its disclosure provisions ‘shall be liberally construed and
4 A few days after the commissioner granted discretionary review, the trial court entered an amended order requiring KCPH to redact health care information from its records. The superior court had no authority to enter the order after this court accepted review. RAP 6.1, 7.2(a). The parties did not seek permission from this court under RAP 7.2(e) to enter the revised order, so we do not consider it on appeal.
6 No. 81175-4-I (Consol. with No. 81295-5-I)/7
its exemptions narrowly construed.’ ” Cornu-Labat, 177 Wn.2d at 229 (quoting
RCW 42.56.030).
Under the PRA, a party may seek to enjoin release of public records if
“examination would clearly not be in the public interest and would substantially
and irreparably damage any person, or would substantially and irreparably
damage vital governmental functions.” RCW 42.56.540. However, “[c]ourts shall
take into account the policy of [the PRA] that free and open examination of public
records is in the public interest, even though such examination may cause
inconvenience or embarrassment to public officials or others.” RCW
42.56.550(3).
In considering an injunction, a trial court must conduct two separate
inquiries. Lyft, Inc. v. City of Seattle, 190 Wn.2d 769, 789, 418 P.3d 102 (2018).
First, the court must determine whether the records are exempt under a provision
of the PRA. Lyft, 190 Wn.2d at 790. If a PRA exemption applies, the court
examines whether disclosure is against public interest and would cause
substantial and irreparable damage. Lyft, 190 Wn.2d at 791. The trial court must
find both inquiries are satisfied before issuing an injunction. Lyft, 190 Wn.2d at
791.
The party seeking an injunction has the burden of proof. Lyft, 190 Wn.2d
at 791. For a preliminary injunction or TRO, the trial court need not resolve the
merits of the issues. Seiu Healthcare 775NW v. Dep’t of Soc. & Health Servs.,
193 Wn. App. 377, 392, 377 P.3d 214 (2016). Instead, it considers only the
likelihood that the moving party will prevail at trial. Seiu Healthcare, 193 Wn.
7 No. 81175-4-I (Consol. with No. 81295-5-I)/8
App. at 392-93. We review de novo the issuance of an injunction under the PRA.
Lyft, 190 Wn.2d at 791.
QI Committee Exemption
SCH argues the KCPH and DOH records should be exempt from
disclosure under the QI committee exemption to the PRA.5 Respondents claim
the exemption does not apply to the documents because they were not created
specifically for a QI committee. We agree with the respondents.
Every hospital must maintain a QI program, including a QI committee with
“the responsibility to review the services rendered in the hospital, both
retrospectively and prospectively, in order to improve the quality of medical care
of patients and to prevent medical malpractice.” RCW 70.41.200(1)(a); Cornu-
Labat, 177 Wn.2d at 235. The QI committee will
oversee and coordinate the quality improvement and medical malpractice prevention program and shall ensure that information gathered pursuant to the program is used to review and to revise hospital policies and procedures.
RCW 70.41.200(1)(a).
Health care information and documents “created specifically for, and
collected and maintained by a quality improvement committee” under RCW
70.41.200, are exempt from disclosure under the PRA. RCW 42.56.360(1)(c);
see RCW 70.41.200(3).6 The QI committee exemption applies to “work product
5 The parties do not dispute that the records at issue are “public records” under RCW 42.56.010(3). The only issue on appeal is whether an exemption under the PRA prevents disclosure. 6 RCW 70.41.200(3) also provides, in pertinent part, “Information and documents . . . created specifically for, and collected and maintained by, a quality improvement committee are not subject to review or disclosure.”
8 No. 81175-4-I (Consol. with No. 81295-5-I)/9
of [hospital] committees that ‘oversee and coordinate the quality improvement
and medical malpractice prevention program.’ ” Cornu-Labat, 177 Wn.2d at 236
(quoting RCW 70.41.200(1)(a)). This exception to the broad disclosure
requirements of the PRA allows hospitals to conduct internal reviews to maintain
quality health care. Cornu-Labat, 177 Wn.2d at 230. Otherwise, “external
access to committee investigations stifles candor and inhibits constructive
criticism thought necessary to effective quality review.” Anderson v. Breda, 103
Wn.2d 901, 905, 700 P.2d 737 (1985).
In construing the scope of RCW 70.41.200(3), our Supreme Court
recognized that “the majority of records a hospital creates might be somehow
related to the quality of care it provides,” and therefore, “[i]t is not necessarily the
case that all records documenting a hospital’s efforts to comply with the
statutorily mandated quality improvement program are privileged.” Fellows v.
Moynihan, 175 Wn.2d 641, 655, 285 P.3d 864 (2012). The requirement of RCW
70.41.200(3) that records “created specifically for, and collected and maintained
by, a quality improvement committee” are privileged serves as a legislative limit
on the protection and prevents a hospital from “funneling records through its
quality improvement committee” to prevent disclosure. Fellows, 175 Wn.2d at
655. To that end, the Supreme Court narrowly construed the phrase “created
specifically for” QI committees to include only “documents created as part of the
inner workings of the committee.” Lowy v. PeaceHealth, 174 Wn.2d 769, 787-88,
280 P.3d 1078 (2012) (citing RCW 70.41.200). The protection does not include
information that “goes into or comes out of the quality improvement committees.”
9 No. 81175-4-I (Consol. with No. 81295-5-I)/10
Lowy, 174 Wn.2d at 787. This narrow application ensures that the QI committee
protection “ ‘may not be used as a shield to obstruct proper discovery of
information generated outside review committee meetings.’ ” Fellows, 175
Wn.2d at 655 (quoting Coburn v. Seda, 101 Wn.2d 270, 277, 677 P.2d 173
(1984)).7
Here, SCH claims that several KCPH and DOH records relating to the
aspergillus infection investigations in 2018 and 2019 are exempt from disclosure
as part of their QI committee process. It argues that records of its e-mail
conversations with and among KCPH, DOH, and the CDC are exempt because
the agencies were acting as “consultants” to the QI committee’s investigation. In
support of its argument, SCH points to the declarations of SCH QI committee
member Dr. Danielle Zerr, explaining that the committee “regularly consults” with
experts from KCPH, CDC, and DOH as part of its investigations.
Dr. Zerr describes the QI process as often involving “a back-and-forth
exchange of ideas, information, suggestions, and recommendations” with
external agencies. She claims that the records at issue fall under the QI
committee exemption because they were generated as part of her conversations
with those agencies seeking “assistance in evaluating the issues, laboratory
testing, and to validate that [SCH]’s corrective actions were appropriate and
comprehensive” during the aspergillus investigations. She asserts that the
agencies knew that the conversations were protected under the QI exemption
7 Existing case law considers RCW 70.41.200 only in the context of protecting certain QI committee records from discovery. Because we narrowly construe both the discovery privilege and the PRA exemption in favor of disclosure, case law analysis of the statute’s scope is apt here as well. See Fellows, 175 Wn.2d at 649; Lyft, 190 Wn.2d at 779.
10 No. 81175-4-I (Consol. with No. 81295-5-I)/11
because she labelled all of her communications with KCPH, CDC, and DOH as
“privileged and confidential.”
But the QI committee exemption does not apply to a record just because it
has Dr. Zerr’s label of “confidential and protected quality improvement
information per RCW 4.24.250 and 70.41.200.” The exemption applies to only
those records created specifically for and maintained by a QI committee. RCW
42.56.360(1)(c). Construed narrowly, only “documents created as part of the
inner workings of the committee” are exempt under the PRA. Lowy, 174 Wn.2d
at 787.
And SCH’s argument that the records are exempt because KCPH, DOH,
and the CDC were acting as consultants to the SCH QI committee is not
persuasive. KCPH, CDC, and DOH are not members of SCH’s QI committee.
Nor were the agencies knowingly consulting with the committee for QI purposes.
According to KCPH Health Officer Dr. Jeff Duchin, “[i]nformation shared at the
two-day July [2019] CDC site visit meeting and in subsequent telephone calls
were QI [related] in Children’s view but part of a public health investigation about
a notifiable condition to us at Public Health.” And KCPH medical epidemiologist
Dr. Meagan Kay stated that she did not recall being informed that
communications with SCH were part of the QI process. Rather, Dr. Kay believed
the discussions were part of KCPH’s investigation into the new cluster of
aspergillus infections in May 2019. Finally, during oral argument at the February
28, 2020 hearing, counsel for DOH told the trial court that DOH representatives
did not “believe they were part of the [SCH] QI process.” DOH counsel said,
11 No. 81175-4-I (Consol. with No. 81295-5-I)/12
“[T]he Department only has the authority to do those things outlined in the statute
or implied by statute. I don’t know of any statute that authorizes the Department
to serve . . . as a QI resource for hospitals.”
The record shows that DOH and KCPH were acting in their independent
investigatory and supervisory roles when communicating with SCH. They were
not acting on behalf of, or as consultants for, the SCH QI committee. While SCH
may have viewed the information as useful to its QI process, the communications
exchanged between SCH and the external agencies is information that “goes into
or comes out of” a QI committee rather than generated as “part of the inner
workings of the committee.” See Lowy, 174 Wn.2d at 787. The trial court did not
err in concluding that the QI committee exemption under RCW 42.56.360(1)(c)
does not protect the KCPH and DOH records from disclosure.
Infection Reporting Exemption
SCH also contends the infection reporting exemption under the PRA
applies to some of the KCPH and DOH records. It claims the exemption applies
because aspergillus surgical site infections are “health care-associated
infections,” triggering mandatory notification to the local health department under
the Washington Administrative Code.8 But the plain language of the PRA
exemption is limited in scope and does not apply to the KCPH or DOH
documents.
8 WAC 246-101-305(1)(a)(iv). Dr. Duchin of KCPH acknowledged the aspergillus infections were a “notifiable condition” under WAC 246-101-305(1)(a)(iv).
12 No. 81175-4-I (Consol. with No. 81295-5-I)/13
Under the PRA, information and documents created specifically by a
hospital “for reporting of health care-associated infections under RCW 43.70.056”
are exempt from disclosure. RCW 42.56.360(1)(c). RCW 43.70.056(2)(a)
mandates that a hospital must collect data on health care-associated infections in
cases of “[c]entral line-associated bloodstream infection in all hospital inpatient
areas where patients normally reside at least twenty-four hours” and “[s]urgical
site infection for colon and abdominal hysterectomy procedures.” The exemption
does not apply to the aspergillus surgical site infections in this case.
HCIA and HIPAA
SCH asserts DOH and KCPH should redact their records to protect patient
privacy consistent with both the state and federal health care information statutes
because “Washington’s HCIA has adopted language directly mirroring HIPAA’s
statutory language and regulations.”9 Generally, HIPAA applies to only “covered
entit[ies].” See 45 C.F.R. §§ 160.103, .102(a), (b).10 KCPH agrees that it is a
“covered entity” under HIPAA and that the guidelines apply to its records.11 DOH
asserts that HIPAA does not apply to its disputed records but asks us to
conclude that the HCIA and HIPAA “are coextensive for purposes of disclosing
9 Compare RCW 70.02.050 (disclosure without patient’s authorization), and RCW 70.02.270 (prohibited use or disclosure of health care information), with 45 C.F.R. § 164.512 (uses and disclosure for which authorization is not required), and 45 C.F.R. § 164.502 (general rules for use and disclosure of protected health information). 10 Under HIPAA, a “covered entity” is a health care plan, health care clearinghouse, or certain health care providers. 45 C.F.R. §§ 160.103, .102(a), (b). As a health care provider, SCH must comply with HIPAA regulations. 45 C.F.R. § 106.102(a). 11 KCPH provides no briefing on this issue, but during oral argument, counsel for KCPH acknowledged that KCPH is a covered entity under HIPAA. KCPH is a hybrid entity but applies HIPAA to its public health function because of its significant health care services.
13 No. 81175-4-I (Consol. with No. 81295-5-I)/14
health care information” to ensure that medical records are “deidentified in a
consistent manner, no matter who possesse[s] the information.”12
The PRA specifically calls for HCIA protections to “public inspection and
copying of health care information of patients.” RCW 42.56.360(2). The HCIA
recognizes that “[h]ealth care information is personal and sensitive information
that if improperly used or released may do significant harm to a patient’s interests
in privacy, health care, or other interests.” RCW 70.02.005(1). In keeping with
these interests, the HCIA prohibits health care providers from disclosing health
care information without written authorization from the patient. RCW
70.02.020(1).
The HCIA defines “health care information” as “any information, whether
oral or recorded in any form or medium, that identifies or can readily be
associated with the identity of a patient and directly relates to the patient’s health
care.” RCW 70.02.010(17). The broad mandate favoring disclosure under the
PRA requires an agency seeking exemption to “demonstrate that each patient’s
health care information is ‘readily associated’ with that patient in order to withhold
the health care information under RCW 70.02.010[(17)].” Prison Legal News,
Inc. v. Dep't of Corr., 154 Wn.2d 628, 645, 115 P.3d 316 (2005). Health care
information that “does not identify an individual and with respect to which there is
no reasonable basis to believe that the information can be used to identify an
12 DOH is a “hybrid entity” with both covered and noncovered functions. 45 C.F.R. § 164.103. Only a hybrid entity’s “designate[d] health care components” are subject to HIPAA regulations. 45 C.F.R. §§ 164.103, .105. DOH has only one designated health care component, and it is not involved with the SCH aspergillus investigations. As a result, HIPAA does not apply to records held by DOH in this case.
14 No. 81175-4-I (Consol. with No. 81295-5-I)/15
individual” is “deidentified.” RCW 70.02.010(6). An agency can disclose
deidentified patient information without authorization because the information is
no longer a risk to patient privacy. See RCW 70.02.050(1)(b)(ii).
DOH redacted its records to remove information protected by the HCIA.
SCH argues, however, that DOH’s redactions do not adequately protect
unauthorized disclosure of health care information. For example, SCH (quoting
RCW 70.02.010(17)) points to documents that include detailed information about
patient health care and asserts that
due to the very small number of affected patients, the unique clinical nature of their procedures and diagnoses, and the significant media attention . . . , [SCH] has a reasonable basis to believe such information can . . . “readily [be] associated with the identity of” particular patients in violation of [patient health care information] privacy laws.
To protect patient privacy, SCH advocates applying the more detailed
deidentification guidelines under HIPAA to the DOH records.
Like Washington’s law, HIPAA protects disclosure of patient health care
information. HIPAA defines “individually identifiable health information” as any
information “created or received by a health care provider, health plan, employer,
or health care clearinghouse” that relates to past, present, or future health care
and “identifies the individual” or where “there is a reasonable basis to believe that
the information can be used to identify the individual.” 42 U.S.C. § 1320d(6).
HIPAA also provides for deidentification of health information:
Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the
15 No. 81175-4-I (Consol. with No. 81295-5-I)/16
information can be used to identify an individual is not individually identifiable health information.
45 C.F.R. § 164.514(a). But unlike the HCIA, HIPAA establishes specific
standards for deidentification, including removal of “[a]ll elements of dates
(except year) for dates directly related to an individual, including birth date,
admission date, discharge date,” and “[a]ny other unique identifying number,
characteristic, or code.” 45 C.F.R. § 164.514(b)(2)(i)(C), (R).13
13 45 C.F.R. section 164.514(b) provides: Implementation specifications: Requirements for deidentification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if: (1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable: (i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and (ii) Documents the methods and results of the analysis that justify such determination; or (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers;
16 No. 81175-4-I (Consol. with No. 81295-5-I)/17
SCH argues that the “state and federal prohibitions on disclosure should
be construed in the same fashion” because the HCIA “adopted language directly
mirroring HIPAA’s statutory language and regulations.” See Anfinson v. FedEx
Ground Package Sys., Inc., 174 Wn.2d 851, 868, 281 P.3d 289 (2012) (“At least
where there is no contrary legislative intent, when a state statute is ‘taken
substantially verbatim from [a] federal statute, it carries the same construction as
the federal law and the same interpretation as federal case law.’ ”)14 (quoting
State v. Bobic, 140 Wn.2d 250, 264, 996 P.2d 610 (2000)). But HIPAA enacted
its guidelines more than a decade before our legislature amended the HCIA to
include “deidentification” and our legislature chose not to include them in our
statute.15 “Where the legislature omits language from a statute, whether
intentionally or inadvertently, this court will not read into the statute the language
it believes was omitted.” Qwest Corp. v. City of Kent, 157 Wn.2d 545, 553, 139
P.3d 1091 (2006).
SCH and DOH also point to WAC 246-08-390 in support of their argument
that we apply HIPAA deidentification guidelines to patient records released by
(M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and (ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. 14 Alteration in original; internal quotation marks omitted. 15 Federal regulations enacted the concept of deidentification and standards to protect privacy of individually identifiable health information as part of a HIPAA final rule in 2000. 65 Fed. Reg. 82802 (Dec. 28, 2000). The Washington Legislature amended the HCIA to define “deidentification” in 2013. LAWS OF 2013, ch. 200, § 1 (effective July 1, 2014).
17 No. 81175-4-I (Consol. with No. 81295-5-I)/18
DOH to ensure consistency under the HCIA. WAC 246-08-390 governs DOH’s
handling of health care information under the HCIA, including applying the HCIA
and PRA to public inspection and copying of health information. WAC 246-08-
390(6)(a). It provides:
Health information that identifies or can readily be associated with the identity of a patient and directly relates to the patient’s health care is not available for public inspection and copying. Health information that is not individually identifiable is described as “deidentified.”
WAC 246-08-390(6)(a)(i). The same provision gives DOH the option of applying
the HIPAA guidelines when deidentifying health care information:
The department may consider analogous federal standards for deidentification of protected health information when determining if deidentification of health information is possible.
WAC 246-08-390(6)(a)(iii). In other words, current rules and regulations give
DOH the discretion to apply the specific and robust HIPAA protections when
deidentifying health care information from records it intends to release for public
inspection. We decline the invitation by SCH and DOH to fill the “implementation
gap” between the HCIA and HIPAA by interpreting WAC 246-08-390(6)(a)(iii) as
a mandate because we cannot add words to a regulation where the plain
meaning is clear and unambiguous. Children’s Hosp. & Med. Ctr. v. Dep’t of
Health, 95 Wn. App. 858, 868-69, 975 P.2d 567 (1999).
We conclude that the trial court did not err in determining that the QI
committee and infection reporting exemptions under the PRA do not prevent
18 No. 81175-4-I (Consol. with No. 81295-5-I)/19
release of the KCPH or DOH records. But we remand for the trial court to ensure
that the records comply with the applicable patient privacy requirements.
Affirmed.
WE CONCUR: