IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
SEATTLE CHILDREN’S HOSPITAL, a ) No. 81175-4-I Washington nonprofit corporation, ) (Consolidated with No. 81295-5-I)
)
Appellant, ) DIVISION ONE )
v. )
)
KING COUNTY, a Washington ) municipal corporation; WASHINGTON ) STATE DEPARTMENT OF HEALTH; ) UNPUBLISHED OPINION and KING BROADCASTING ) COMPANY and its affiliates, d/b/a ) KING 5, a Washington corporation, )
)
Respondents. )
BOWMAN, J. — Seattle Children’s Hospital (SCH) moved for a temporary restraining order against the Washington State Department of Health (DOH) and a preliminary injunction against King Broadcasting Company and its affiliates (KING 5) along with Seattle and King County Public Health (KCPH),1 seeking to prevent the release of documents related to aspergillus mold infections in surgical patients. The trial court ultimately denied the motions and ordered release of the records. SCH appeals, arguing the documents fall under the quality improvement and infection reporting exemptions to the Public Records
1 KCPH did not file briefing or participate in this appeal.
Citations and pin cites are based on the Westlaw online version of the cited material.
Act (PRA), chapter 42.56 RCW. SCH and DOH also urge us to apply the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104- 191, 110 Stat. 1936, deidentification guidelines to any released patient records to ensure medical confidentiality under Washington’s Uniform Health Care Information Act (HCIA), chapter 70.02 RCW. We conclude that neither the quality improvement nor the infection reporting exemption prevents release of the records in this case. And we decline to impose judicially the HIPAA guidelines for deidentification of patient information under the HCIA. We affirm denial of the temporary restraining order and preliminary injunction but remand to the trial court to ensure that all records comply with the required patient privacy protections before they are released.
FACTS
Since 2001, SCH has experienced recurring infections in surgical patients caused by aspergillus mold. In June 2018, SCH reported to KCPH that two more patients developed aspergillus surgical site infections related to procedures performed at the hospital. KCPH assisted SCH with its investigation into the outbreak through August 2018. In May 2019, KCPH learned that SCH closed their operating rooms because of new aspergillus cases. KCPH contacted the Centers for Disease Control and Prevention (CDC) to help SCH investigate the new outbreak. As part of the investigation, KCPH, DOH, and the CDC conducted a site visit to SCH in July 2019.
3
In August 2019, a KING 5 news reporter made a PRA request to KCPH for records related to the SCH aspergillus infections.2 KCPH compiled the records, reviewed them, and determined no PRA exemptions protected the records from disclosure. The more than 4,700 pages of records generally consist of e-mail exchanges between SCH, KCPH, DOH, and the CDC discussing potential sources of aspergillus infection, sample testing for the presence of aspergillus mold, procedures to prevent future aspergillus infection of patients, and follow-up to monitor implementation of those procedures and any new aspergillus outbreaks. The records also include documents generated or shared in the course of discussions among the agencies, including during the SCH site visit.
KCPH notified SCH of the KING 5 request and told SCH it intended to release the records “unredacted.” SCH agreed to the release of most of the records, objecting to only those it argued “contain information of the hospital and
2 DOH and KCPH received similar requests from several other media outlets, as well as the law firm Stritmatter, Kessler, Koehler, Moore (Stritmatter Firm). These entities are not named as parties on appeal, but several amici curiae briefs represent their interests. The Washington Coalition for Open Government and the Washington Newspaper Publishers Association filed an amici curiae brief in support of affirming the trial court’s orders. Their brief emphasizes the public’s compelling interest in access to information about the serious health risk associated with the recurring aspergillus infections at SCH. The brief also argues for limited redactions of health care records to only information that may lead to the identity of patients. The Washington State Hospital Association, the Association of Washington Public Hospital Districts, the Washington State Medical Association, and the American Medical Association (collectively Medical Associations) filed an amici curiae brief in support of SCH’s claimed quality improvement committee exemption to the PRA. The Medical Associations assert the critical importance of confidentiality in the quality improvement process and argue for broad protection of communications related to the process. Finally, the Stritmatter Firm moved to file an amicus curiae brief in support of KING 5’s arguments for broad public disclosure. A commissioner of this court referred the motion to the panel for consideration. We note that the parties have filed responses to the motion and grant the Stritmatter Firm’s motion to file the amicus brief. The Stritmatter Firm filed a class action lawsuit against SCH on behalf of multiple families of children who contracted aspergillus infections after medical procedures at SCH. All but one of the six named class representatives died after contracting aspergillus infections at SCH. The Stritmatter Firm argues disclosure of the records at issue is in the public’s interest, and public disclosure of the documents will prevent further harm to potential patients and doctors as well as the families and children already affected by the aspergillus outbreaks at SCH.
4
its patients that is expressly protected from public disclosure under the PRA and patient privacy laws.” KCPH told SCH that it would release the unredacted documents unless SCH reached an agreement with KING 5 or obtained an order from the court enjoining release of the exempt information. SCH and KING 5 could not reach an agreement on how to redact the records.
In October 2019, SCH filed a complaint for declaratory judgment and injunctive relief to stop KCPH from releasing the remaining unredacted records. SCH also named defendant KING 5 as a “potentially interested party.” Soon after, SCH filed a motion for preliminary injunction to prevent disclosure pending final resolution of its lawsuit, arguing that the records contain protected information and documents exempt from public disclosure. The court granted the preliminary injunction, finding that the records were exempt from disclosure under the HCIA, HIPAA, and the quality improvement (QI) exemption in the PRA. On November 7, 2019, the court enjoined KCPH from disclosing the remaining records except in the redacted form proposed by SCH.3 KING 5 moved for reconsideration, which the trial court treated as a motion to rescind or withdraw the preliminary injunction. The court set a briefing schedule and hearing date for KING 5’s motion.
Throughout the proceedings, KCPH continued to search its database for records related to SCH aspergillus infections. After the preliminary injunction issued, KCPH produced more responsive records and sent them to SCH for review. Among those records, SCH found documents it believed should be
3 The court also ordered SCH to remove several redactions of information that the court determined was not exempt from disclosure.
5
exempt from disclosure. On February 14, 2020, SCH moved to amend the November 7, 2019 preliminary injunction to prevent disclosure of the new records.
During this time, DOH also received PRA requests for records related to aspergillus mold infections at SCH. DOH notified SCH that in February 2020, it intended to release over 800 pages of records subject to redaction for only identifiable patient health care information. SCH argued that 117 pages of those records, many of them duplicative of the records held by KCPH, should be exempt from disclosure. On February 14, 2020, the same day SCH filed the preliminary injunction to prevent the release of KCPH’s records, it also filed an amended complaint to add DOH as a defendant. SCH sought declaratory judgment and injunctive relief enjoining DOH from releasing its records. SCH then filed a motion for a temporary restraining order (TRO), seeking to prevent DOH’s imminent release of their records.
The court set a hearing date of February 28, 2020 on SCH’s motion for a TRO as to DOH, SCH’s motion to amend the November 2019 preliminary injunction as to KCPH, and KING 5’s motion to rescind or withdraw the preliminary injunction. After hearing oral argument, the court denied the motion for a TRO, finding that new evidence refuted SCH’s claim that the disputed records are exempt as part of the QI process. The court also denied SCH’s motion to amend the preliminary injunction. It then granted KING 5’s motion to rescind the previously issued preliminary injunction against KCPH. The court entered an order on March 23, 2020, releasing the 125 pages of records still held
6
by KCPH under the injunction, another 595 pages produced by KCPH after the injunction issued, and the 117 pages of documents held by DOH. The court stayed enforcement of its March 23 order pending appeal.
SCH filed a notice for discretionary review of the trial court’s order denying its motion for a TRO related to the DOH records. A commissioner of this court granted a temporary injunction to preserve the status quo. The commissioner accepted review on the issue of whether HIPAA deidentification guidelines apply when redacting records to protect patient information under the HCIA.4 SCH then filed an appeal of the court’s order denying its motion to amend their preliminary injunction against KCPH and granting KING 5’s motion to rescind the original preliminary injunction. The commissioner consolidated the appeal and discretionary review as a single appeal under RAP 2.2(a)(3) with an accelerated briefing schedule.
ANALYSIS
“The PRA is a ‘strongly worded mandate for broad disclosure of public records.’ ” Cornu-Labat v. Hosp. Dist. No. 2 Grant County, 177 Wn.2d 221, 229, 298 P.3d 741 (2013) (quoting Hearst Corp. v. Hoppe, 90 Wn.2d 123, 127, 580 P.2d 246 (1978)). The act requires state and local agencies to disclose public records responsive to requests unless a specific exemption applies. Cornu- Labat, 177 Wn.2d at 229; RCW 42.56.070(1). In keeping with its mandate, “the PRA explicitly declares its disclosure provisions ‘shall be liberally construed and
4 A few days after the commissioner granted discretionary review, the trial court entered an amended order requiring KCPH to redact health care information from its records. The superior court had no authority to enter the order after this court accepted review. RAP 6.1, 7.2(a). The parties did not seek permission from this court under RAP 7.2(e) to enter the revised order, so we do not consider it on appeal.
7
its exemptions narrowly construed.’ ” Cornu-Labat, 177 Wn.2d at 229 (quoting RCW 42.56.030).
Under the PRA, a party may seek to enjoin release of public records if “examination would clearly not be in the public interest and would substantially and irreparably damage any person, or would substantially and irreparably damage vital governmental functions.” RCW 42.56.540. However, “[c]ourts shall take into account the policy of [the PRA] that free and open examination of public records is in the public interest, even though such examination may cause inconvenience or embarrassment to public officials or others.” RCW 42.56.550(3).
In considering an injunction, a trial court must conduct two separate inquiries. Lyft, Inc. v. City of Seattle, 190 Wn.2d 769, 789, 418 P.3d 102 (2018). First, the court must determine whether the records are exempt under a provision of the PRA. Lyft, 190 Wn.2d at 790. If a PRA exemption applies, the court examines whether disclosure is against public interest and would cause substantial and irreparable damage. Lyft, 190 Wn.2d at 791. The trial court must find both inquiries are satisfied before issuing an injunction. Lyft, 190 Wn.2d at 791.
The party seeking an injunction has the burden of proof. Lyft, 190 Wn.2d at 791. For a preliminary injunction or TRO, the trial court need not resolve the merits of the issues. Seiu Healthcare 775NW v. Dep’t of Soc. & Health Servs., 193 Wn. App. 377, 392, 377 P.3d 214 (2016). Instead, it considers only the likelihood that the moving party will prevail at trial. Seiu Healthcare, 193 Wn.
8
App. at 392-93. We review de novo the issuance of an injunction under the PRA. Lyft, 190 Wn.2d at 791. QI Committee Exemption SCH argues the KCPH and DOH records should be exempt from disclosure under the QI committee exemption to the PRA.5 Respondents claim the exemption does not apply to the documents because they were not created specifically for a QI committee. We agree with the respondents.
Every hospital must maintain a QI program, including a QI committee with “the responsibility to review the services rendered in the hospital, both retrospectively and prospectively, in order to improve the quality of medical care of patients and to prevent medical malpractice.” RCW 70.41.200(1)(a); Cornu- Labat, 177 Wn.2d at 235. The QI committee will
oversee and coordinate the quality improvement and medical malpractice prevention program and shall ensure that information gathered pursuant to the program is used to review and to revise hospital policies and procedures.
RCW 70.41.200(1)(a).
Health care information and documents “created specifically for, and collected and maintained by a quality improvement committee” under RCW 70.41.200, are exempt from disclosure under the PRA. RCW 42.56.360(1)(c); see RCW 70.41.200(3).6 The QI committee exemption applies to “work product
5 The parties do not dispute that the records at issue are “public records” under RCW 42.56.010(3). The only issue on appeal is whether an exemption under the PRA prevents disclosure.
6 RCW 70.41.200(3) also provides, in pertinent part, “Information and documents . . .
created specifically for, and collected and maintained by, a quality improvement committee are not subject to review or disclosure.”
9
of [hospital] committees that ‘oversee and coordinate the quality improvement and medical malpractice prevention program.’ ” Cornu-Labat, 177 Wn.2d at 236 (quoting RCW 70.41.200(1)(a)). This exception to the broad disclosure requirements of the PRA allows hospitals to conduct internal reviews to maintain quality health care. Cornu-Labat, 177 Wn.2d at 230. Otherwise, “external access to committee investigations stifles candor and inhibits constructive criticism thought necessary to effective quality review.” Anderson v. Breda, 103 Wn.2d 901, 905, 700 P.2d 737 (1985).
In construing the scope of RCW 70.41.200(3), our Supreme Court recognized that “the majority of records a hospital creates might be somehow related to the quality of care it provides,” and therefore, “[i]t is not necessarily the case that all records documenting a hospital’s efforts to comply with the statutorily mandated quality improvement program are privileged.” Fellows v. Moynihan, 175 Wn.2d 641, 655, 285 P.3d 864 (2012). The requirement of RCW 70.41.200(3) that records “created specifically for, and collected and maintained by, a quality improvement committee” are privileged serves as a legislative limit on the protection and prevents a hospital from “funneling records through its quality improvement committee” to prevent disclosure. Fellows, 175 Wn.2d at 655. To that end, the Supreme Court narrowly construed the phrase “created specifically for” QI committees to include only “documents created as part of the inner workings of the committee.” Lowy v. PeaceHealth, 174 Wn.2d 769, 787-88, 280 P.3d 1078 (2012) (citing RCW 70.41.200). The protection does not include information that “goes into or comes out of the quality improvement committees.”
10
Lowy, 174 Wn.2d at 787. This narrow application ensures that the QI committee protection “ ‘may not be used as a shield to obstruct proper discovery of information generated outside review committee meetings.’ ” Fellows, 175 Wn.2d at 655 (quoting Coburn v. Seda, 101 Wn.2d 270, 277, 677 P.2d 173 (1984)).7 Here, SCH claims that several KCPH and DOH records relating to the aspergillus infection investigations in 2018 and 2019 are exempt from disclosure as part of their QI committee process. It argues that records of its e-mail conversations with and among KCPH, DOH, and the CDC are exempt because the agencies were acting as “consultants” to the QI committee’s investigation. In support of its argument, SCH points to the declarations of SCH QI committee member Dr. Danielle Zerr, explaining that the committee “regularly consults” with experts from KCPH, CDC, and DOH as part of its investigations.
Dr. Zerr describes the QI process as often involving “a back-and-forth exchange of ideas, information, suggestions, and recommendations” with external agencies. She claims that the records at issue fall under the QI committee exemption because they were generated as part of her conversations with those agencies seeking “assistance in evaluating the issues, laboratory testing, and to validate that [SCH]’s corrective actions were appropriate and comprehensive” during the aspergillus investigations. She asserts that the agencies knew that the conversations were protected under the QI exemption
7 Existing case law considers RCW 70.41.200 only in the context of protecting certain QI committee records from discovery. Because we narrowly construe both the discovery privilege and the PRA exemption in favor of disclosure, case law analysis of the statute’s scope is apt here as well. See Fellows, 175 Wn.2d at 649; Lyft, 190 Wn.2d at 779.
11
because she labelled all of her communications with KCPH, CDC, and DOH as “privileged and confidential.”
But the QI committee exemption does not apply to a record just because it has Dr. Zerr’s label of “confidential and protected quality improvement information per RCW 4.24.250 and 70.41.200.” The exemption applies to only those records created specifically for and maintained by a QI committee. RCW 42.56.360(1)(c). Construed narrowly, only “documents created as part of the inner workings of the committee” are exempt under the PRA. Lowy, 174 Wn.2d at 787.
And SCH’s argument that the records are exempt because KCPH, DOH, and the CDC were acting as consultants to the SCH QI committee is not persuasive. KCPH, CDC, and DOH are not members of SCH’s QI committee. Nor were the agencies knowingly consulting with the committee for QI purposes. According to KCPH Health Officer Dr. Jeff Duchin, “[i]nformation shared at the two-day July [2019] CDC site visit meeting and in subsequent telephone calls were QI [related] in Children’s view but part of a public health investigation about a notifiable condition to us at Public Health.” And KCPH medical epidemiologist Dr. Meagan Kay stated that she did not recall being informed that communications with SCH were part of the QI process. Rather, Dr. Kay believed the discussions were part of KCPH’s investigation into the new cluster of aspergillus infections in May 2019. Finally, during oral argument at the February 28, 2020 hearing, counsel for DOH told the trial court that DOH representatives did not “believe they were part of the [SCH] QI process.” DOH counsel said,
12
“[T]he Department only has the authority to do those things outlined in the statute or implied by statute. I don’t know of any statute that authorizes the Department to serve . . . as a QI resource for hospitals.”
The record shows that DOH and KCPH were acting in their independent investigatory and supervisory roles when communicating with SCH. They were not acting on behalf of, or as consultants for, the SCH QI committee. While SCH may have viewed the information as useful to its QI process, the communications exchanged between SCH and the external agencies is information that “goes into or comes out of” a QI committee rather than generated as “part of the inner workings of the committee.” See Lowy, 174 Wn.2d at 787. The trial court did not err in concluding that the QI committee exemption under RCW 42.56.360(1)(c) does not protect the KCPH and DOH records from disclosure. Infection Reporting Exemption SCH also contends the infection reporting exemption under the PRA applies to some of the KCPH and DOH records. It claims the exemption applies because aspergillus surgical site infections are “health care-associated infections,” triggering mandatory notification to the local health department under the Washington Administrative Code.8 But the plain language of the PRA exemption is limited in scope and does not apply to the KCPH or DOH documents.
8 WAC 246-101-305(1)(a)(iv). Dr. Duchin of KCPH acknowledged the aspergillus infections were a “notifiable condition” under WAC 246-101-305(1)(a)(iv).
13
Under the PRA, information and documents created specifically by a hospital “for reporting of health care-associated infections under RCW 43.70.056” are exempt from disclosure. RCW 42.56.360(1)(c). RCW 43.70.056(2)(a) mandates that a hospital must collect data on health care-associated infections in cases of “[c]entral line-associated bloodstream infection in all hospital inpatient areas where patients normally reside at least twenty-four hours” and “[s]urgical site infection for colon and abdominal hysterectomy procedures.” The exemption does not apply to the aspergillus surgical site infections in this case. HCIA and HIPAA SCH asserts DOH and KCPH should redact their records to protect patient privacy consistent with both the state and federal health care information statutes because “Washington’s HCIA has adopted language directly mirroring HIPAA’s statutory language and regulations.”9 Generally, HIPAA applies to only “covered entit[ies].” See 45 C.F.R. §§ 160.103, .102(a), (b).10 KCPH agrees that it is a “covered entity” under HIPAA and that the guidelines apply to its records.11 DOH asserts that HIPAA does not apply to its disputed records but asks us to conclude that the HCIA and HIPAA “are coextensive for purposes of disclosing
9 Compare RCW 70.02.050 (disclosure without patient’s authorization), and RCW 70.02.270 (prohibited use or disclosure of health care information), with 45 C.F.R. § 164.512 (uses and disclosure for which authorization is not required), and 45 C.F.R. § 164.502 (general rules for use and disclosure of protected health information).
10 Under HIPAA, a “covered entity” is a health care plan, health care clearinghouse, or certain health care providers. 45 C.F.R. §§ 160.103, .102(a), (b). As a health care provider, SCH must comply with HIPAA regulations. 45 C.F.R. § 106.102(a).
11 KCPH provides no briefing on this issue, but during oral argument, counsel for KCPH acknowledged that KCPH is a covered entity under HIPAA. KCPH is a hybrid entity but applies HIPAA to its public health function because of its significant health care services.
14
health care information” to ensure that medical records are “deidentified in a consistent manner, no matter who possesse[s] the information.”12 The PRA specifically calls for HCIA protections to “public inspection and copying of health care information of patients.” RCW 42.56.360(2). The HCIA recognizes that “[h]ealth care information is personal and sensitive information that if improperly used or released may do significant harm to a patient’s interests in privacy, health care, or other interests.” RCW 70.02.005(1). In keeping with these interests, the HCIA prohibits health care providers from disclosing health care information without written authorization from the patient. RCW 70.02.020(1).
The HCIA defines “health care information” as “any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient’s health care.” RCW 70.02.010(17). The broad mandate favoring disclosure under the PRA requires an agency seeking exemption to “demonstrate that each patient’s health care information is ‘readily associated’ with that patient in order to withhold the health care information under RCW 70.02.010[(17)].” Prison Legal News, Inc. v. Dep't of Corr., 154 Wn.2d 628, 645, 115 P.3d 316 (2005). Health care information that “does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an
12
DOH is a “hybrid entity” with both covered and noncovered functions. 45 C.F.R. § 164.103. Only a hybrid entity’s “designate[d] health care components” are subject to HIPAA regulations. 45 C.F.R. §§ 164.103, .105. DOH has only one designated health care component, and it is not involved with the SCH aspergillus investigations. As a result, HIPAA does not apply to records held by DOH in this case.
15
individual” is “deidentified.” RCW 70.02.010(6). An agency can disclose deidentified patient information without authorization because the information is no longer a risk to patient privacy. See RCW 70.02.050(1)(b)(ii).
DOH redacted its records to remove information protected by the HCIA.
SCH argues, however, that DOH’s redactions do not adequately protect unauthorized disclosure of health care information. For example, SCH (quoting RCW 70.02.010(17)) points to documents that include detailed information about patient health care and asserts that
due to the very small number of affected patients, the unique clinical nature of their procedures and diagnoses, and the significant media attention . . . , [SCH] has a reasonable basis to believe such information can . . . “readily [be] associated with the identity of” particular patients in violation of [patient health care information] privacy laws.
To protect patient privacy, SCH advocates applying the more detailed deidentification guidelines under HIPAA to the DOH records.
Like Washington’s law, HIPAA protects disclosure of patient health care information. HIPAA defines “individually identifiable health information” as any information “created or received by a health care provider, health plan, employer, or health care clearinghouse” that relates to past, present, or future health care and “identifies the individual” or where “there is a reasonable basis to believe that the information can be used to identify the individual.” 42 U.S.C. § 1320d(6). HIPAA also provides for deidentification of health information:
Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the
16
information can be used to identify an individual is not individually identifiable health information.
45 C.F.R. § 164.514(a). But unlike the HCIA, HIPAA establishes specific standards for deidentification, including removal of “[a]ll elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date,” and “[a]ny other unique identifying number, characteristic, or code.” 45 C.F.R. § 164.514(b)(2)(i)(C), (R).13
13 45 C.F.R. section 164.514(b) provides:
Implementation specifications: Requirements for deidentification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if:
(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:
(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and (ii) Documents the methods and results of the analysis that justify such determination; or (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:
(A) Names;
(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:
(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death;
and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
(D) Telephone numbers;
(E) Fax numbers;
(F) Electronic mail addresses;
(G) Social security numbers;
(H) Medical record numbers;
(I) Health plan beneficiary numbers;
(J) Account numbers;
(K) Certificate/license numbers;
(L) Vehicle identifiers and serial numbers, including license plate numbers;
17
SCH argues that the “state and federal prohibitions on disclosure should be construed in the same fashion” because the HCIA “adopted language directly mirroring HIPAA’s statutory language and regulations.” See Anfinson v. FedEx Ground Package Sys., Inc., 174 Wn.2d 851, 868, 281 P.3d 289 (2012) (“At least where there is no contrary legislative intent, when a state statute is ‘taken substantially verbatim from [a] federal statute, it carries the same construction as the federal law and the same interpretation as federal case law.’ ”)14 (quoting State v. Bobic, 140 Wn.2d 250, 264, 996 P.2d 610 (2000)). But HIPAA enacted its guidelines more than a decade before our legislature amended the HCIA to include “deidentification” and our legislature chose not to include them in our statute.15 “Where the legislature omits language from a statute, whether intentionally or inadvertently, this court will not read into the statute the language it believes was omitted.” Qwest Corp. v. City of Kent, 157 Wn.2d 545, 553, 139 P.3d 1091 (2006).
SCH and DOH also point to WAC 246-08-390 in support of their argument that we apply HIPAA deidentification guidelines to patient records released by
(M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs);
(O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and (ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.
14 Alteration in original; internal quotation marks omitted.
15 Federal regulations enacted the concept of deidentification and standards to protect privacy of individually identifiable health information as part of a HIPAA final rule in 2000. 65 Fed. Reg. 82802 (Dec. 28, 2000). The Washington Legislature amended the HCIA to define “deidentification” in 2013. LAWS OF 2013, ch. 200, § 1 (effective July 1, 2014).
18
DOH to ensure consistency under the HCIA. WAC 246-08-390 governs DOH’s handling of health care information under the HCIA, including applying the HCIA and PRA to public inspection and copying of health information. WAC 246-08- 390(6)(a). It provides:
Health information that identifies or can readily be associated with the identity of a patient and directly relates to the patient’s health care is not available for public inspection and copying. Health information that is not individually identifiable is described as “deidentified.”
WAC 246-08-390(6)(a)(i). The same provision gives DOH the option of applying the HIPAA guidelines when deidentifying health care information:
The department may consider analogous federal standards for deidentification of protected health information when determining if deidentification of health information is possible.
WAC 246-08-390(6)(a)(iii). In other words, current rules and regulations give DOH the discretion to apply the specific and robust HIPAA protections when deidentifying health care information from records it intends to release for public inspection. We decline the invitation by SCH and DOH to fill the “implementation gap” between the HCIA and HIPAA by interpreting WAC 246-08-390(6)(a)(iii) as a mandate because we cannot add words to a regulation where the plain meaning is clear and unambiguous. Children’s Hosp. & Med. Ctr. v. Dep’t of Health, 95 Wn. App. 858, 868-69, 975 P.2d 567 (1999).
We conclude that the trial court did not err in determining that the QI committee and infection reporting exemptions under the PRA do not prevent
19
release of the KCPH or DOH records. But we remand for the trial court to ensure that the records comply with the applicable patient privacy requirements.
Affirmed.
WE CONCUR: