For the purposes of this chapter, the following definitions apply:

(1) "Individually identifiable" means that a record contains information which reveals or can likely be associated with the identity of the person or persons to whom the record pertains.

(2) "Legally authorized representative" means a person legally authorized to give consent for the disclosure of personal records on behalf of a minor or a legally incompetent adult.

(3) "Personal record" means any information obtained or maintained by a state agency which refers to a person and which is declared exempt from public disclosure, confidential, or privileged under state or federal law.

(4) "Research" means a planned and systematic sociological, psychological, epidemiological, biomedical, or other scientific investigation carried out by a state agency, by a scientific research professional associated with a bona fide scientific research organization, or by a graduate student currently enrolled in an advanced academic degree curriculum, with an objective to contribute to scientific knowledge, the solution of social and health problems, or the evaluation of public benefit and service programs. This definition excludes methods of record analysis and data collection that are subjective, do not permit replication, and are not designed to yield reliable and valid results.

(5) "Research record" means an item or grouping of information obtained for the purpose of research from or about a person or extracted for the purpose of research from a personal record.

(6) "State agency" means: (a) The department of social and health services; (b) the department of corrections; (c) the department of health; or (d) the department of children, youth, and families.

Effective date—2018 c 58: See note following RCW 28A.655.080.

Effective date—Severability—1989 1st ex.s. c 9: See RCW 43.70.910 and 43.70.920.

(1) A state agency may authorize or provide access to or provide copies of an individually identifiable personal record for research purposes if informed written consent for the disclosure has been given to the appropriate department secretary, or the president of the institution, as applicable, or his or her designee, by the person to whom the record pertains or, in the case of minors and legally incompetent adults, the person's legally authorized representative.

(2) A state agency may authorize or provide access to or provide copies of an individually identifiable personal record for research purposes without the informed consent of the person to whom the record pertains or the person's legally authorized representative, only if:

(a) The state agency adopts research review and approval rules including, but not limited to, the requirement that the appropriate department secretary, or the president of the institution, as applicable, appoint a standing human research review board competent to review research proposals as to ethical and scientific soundness; and the review board determines that the disclosure request has scientific merit and is of importance in terms of the agency's program concerns, that the research purposes cannot be reasonably accomplished without disclosure of the information in individually identifiable form and without waiver of the informed consent of the person to whom the record pertains or the person's legally authorized representative, that disclosure risks have been minimized, and that remaining risks are outweighed by anticipated health, safety, or scientific benefits; and

(b) The disclosure does not violate federal law or regulations; and

(c) The state agency negotiates with the research professional receiving the records or record information a written and legally binding confidentiality agreement prior to disclosure. The agreement shall:

(i) Establish specific safeguards to assure the continued confidentiality and security of individually identifiable records or record information;

(ii) Ensure that the research professional will report or publish research findings and conclusions in a manner that does not permit identification of the person whose record was used for the research. Final research reports or publications shall not include photographs or other visual representations contained in personal records;

(iii) Establish that the research professional will destroy the individual identifiers associated with the records or record information as soon as the purposes of the research project have been accomplished and notify the agency to this effect in writing;

(iv) Prohibit any subsequent disclosure of the records or record information in individually identifiable form except as provided in RCW 42.48.040; and

(v) Provide for the signature of the research professional, of any of the research professional's team members who require access to the information in identified form, and of the agency official authorized to approve disclosure of identifiable records or record information for research purposes.

In addition to the copying charges provided in RCW 42.56.120, a state agency may impose a reasonable charge for costs incurred in providing assistance in the following research activities involving personal records:

(1) Manual or computer screening of personal records for scientific sampling purposes according to specifications provided by the research professional;

(2) Manual or computer extraction of information from a universe or sample of personal records according to specifications provided by the research professional;

(3) Statistical manipulation or analysis of personal record information, whether manually or by computer, according to specifications provided by the research professional.

The charges imposed by the agency may not exceed the amount necessary to reimburse the agency for its actual costs in providing requested research assistance.

No research professional who has established an individually identifiable research record from personal record information pursuant to RCW 42.48.020(2), or who has established a research record from data or information voluntarily provided by an agency client or employee under a written confidentiality assurance for the explicit purpose of research, may disclose such a record in individually identifiable form unless:

(1) The person to whom the research record pertains or the person's legally authorized representative has given prior informed written consent for the disclosure; or

(2) The research professional reasonably believes that disclosure will prevent or minimize injury to a person and the disclosure is limited to information necessary to protect the person who has been or may be injured, and the research professional reports the disclosure only to the person involved or the person's guardian, the person's physician, and the agency; or

(3)(a) The research record is disclosed in individually identifiable form for the purposes of auditing or evaluating a research program; and

(b) The audit or evaluation is authorized or required by federal or state law or regulation or is based upon an explicit provision in a research contract, grant, or other written research agreement; and

(c) No subsequent disclosure of the research record in individually identifiable form will be made by the auditor or evaluator except as provided in this section; or

(4) The research record is furnished in compliance with a search warrant or court order: PROVIDED, That:

(a) The court issues the search warrant or judicial subpoena concerning the research record solely for the purpose of facilitating inquiry into an alleged violation of law by the research professional using the record for a research purpose or by the agency; and

(b) Any research record obtained pursuant to (a) of this subsection and any information directly or indirectly derived from the research record shall remain confidential to the extent possible and shall not be used as evidence in an administrative, judicial, or legislative proceeding except against the research professional using the record for a research purpose or against the state agency.

Unauthorized disclosure, whether wilful or negligent, by a research professional who has obtained an individually identifiable personal record or record information from a state agency pursuant to RCW 42.48.020(2) is a gross misdemeanor. In addition, violation of any provision of this chapter by the research professional or the state agency may subject the research professional or the agency to a civil penalty of not more than ten thousand dollars for each such violation.

Nothing in this chapter is applicable to, or in any way affects, the powers and duties of the state auditor or the joint legislative audit and review committee.