The following provisions apply to the use of AIDS and HIV notifiable conditions case reports, laboratory reports, and investigation reports, related information, and data and is in addition to the requirements established under WAC 246-101-610:

(1) Department personnel shall not disclose health care information related to a case of AIDS or HIV unless:

(a) Explicitly and specifically required to do so by state or federal law;

(b) Permitted under RCW 70.02.220; or

(c) Authorized by written patient consent.

(2) Department personnel may use HIV identifying information related to a case of AIDS or HIV only for the following purposes:

(a) Notification of persons identified as sex or injection equipment-sharing partners;

(b) Referral of the individual tested, diagnosed, or reported with HIV to social and medical services; and

(c) Linkage to other public health databases, provided that the identity or identifying information of the individual tested, diagnosed, or reported with HIV is not disclosed outside the department.

(3) The state health officer shall require and maintain signed confidentiality agreements with all department employees with access to HIV identifying information. The state health officer shall ensure these agreements are renewed at least annually and include reference to penalties for violation of chapter 70.24 RCW and administrative actions that may be taken by the department.

(4) The state health officer shall investigate potential breaches of the confidentiality of HIV identifying information by department employees. All breaches of confidentiality shall be reported to the state health officer or their authorized representative for review and appropriate action.

(5) The department shall maintain all HIV case reports, laboratory reports, and investigation reports and other data and supporting information in a name-based surveillance system solely for the purpose of complying with HIV reporting guidelines from the Centers for Disease Control and Prevention, and shall not disclose or otherwise use any information contained in that system for any other purpose, except as expressly permitted by this section.

(6) The department shall:

(a) Maintain HIV case reports, laboratory reports, and investigation reports and other data and supporting information in secure systems that meet the following standards and are consistent with the 2011 DataSecurity and Confidentiality Guidelinesfor HIV, Viral Hepatitis, Sexually Transmitted Disease, and Tuberculosis Programs: Standards to Facilitate Sharing and Use of Surveillance Data for Public Health Action published by the Centers for Disease Control and Prevention;

(b) Describe secure systems in written policies and review the policies annually;

(c) Limit access to case report, laboratory report, and investigation report and other data and supporting information to department staff who need it to perform their job duties;

(d) Maintain a current list of department staff with access to case report, laboratory report, and investigation report and other data and supporting information;

(e) Enclose all physical locations containing electronic or paper copies of surveillance data in a locked, secured area with limited access and not accessible by window;

(f) Store paper copies or electronic media containing surveillance information inside locked file cabinets that are in the locked, secured area;

(g) Destroy information by either shredding it with a crosscut shredder or appropriately sanitizing electronic media prior to disposal;

(h) Store files or databases containing confidential information on either stand-alone computers with restricted access or on networked drives with proper access controls, encryption software, and firewall protection;

(i) Protect electronic communication of confidential information by encryption standards and review the standards annually;

(j) Use locking briefcases for transporting confidential information.

(7) The state health officer shall conduct a biennial review of local health jurisdictions system security measures described in WAC 246-101-520 that are maintaining records by name.

(8) When providing technical assistance to a local health jurisdiction, authorized representatives of the department may temporarily, and subject to the time limitations in WAC 246-101-520, receive the names of reportable cases of HIV infection for the purpose of partner notification, or special studies. Upon completion of the activities by representatives of the department, named information will be provided to the local health jurisdiction subject to the provisions of WAC 246-101-520.

(9) The state health officer shall provide a report to the state board of health if federal policy no longer requires that HIV surveillance systems be name-based.