Source: https://apps.leg.wa.gov/wac/default.aspx?cite=82-75&full=true
Timestamp: 2019-08-19 20:45:52
Document Index: 511284888

Matched Legal Cases: ['§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82', '§ 82']

Chapter 82-75 WAC:
WACs > Title 82 > Chapter 82-75
Last Update:2/15/19
82-75-010 Purpose.
82-75-020 Definitions required by chapter 43.371 RCW.
82-75-030 Additional definitions authorized by chapter 43.371 RCW.
82-75-040 Registration requirements.
82-75-050 Data submission schedule.
82-75-060 Historical data submission.
82-75-070 Data submission guide.
82-75-080 Waivers and extensions.
82-75-090 Penalties for failure to comply with reporting requirements.
82-75-100 Administrative review.
82-75-110 Appeals.
82-75-200 General data request and release procedures.
82-75-210 Procedures for data requests.
82-75-220 Data management plan.
82-75-230 Review of data requests.
82-75-240 Data release.
82-75-250 Data use agreement.
82-75-260 Confidentiality agreement.
82-75-270 Data procedures at the end of the project.
82-75-280 Reasons to decline a request for data.
82-75-290 Process to review a declined data request.
82-75-300 Process to appeal of final denial of data request.
PRIVACY AND SECURITY PROCEDURES
82-75-400 Privacy and security.
82-75-410 Requirements for data vendor.
82-75-420 Data submission.
82-75-430 WA-APCD infrastructure.
82-75-440 Accountability.
82-75-450 Data vendor and lead organization compliance with privacy and security requirements.
82-75-460 Additional requirements.
82-75-470 State oversight of compliance with privacy and security requirements.
FORMAT FOR THE CALCULATION AND DISPLAY OF DATA
82-75-500 Additional definitions related to the format for the calculation and display of data.
82-75-510 Data formatting rules apply to proprietary financial information.
82-75-520 Elements to safeguard the use of proprietary financial information.
82-75-550 Requirement for fee schedules and processes.
82-75-560 Process to establish fee schedules.
82-75-570 Process to modify fee schedules.
PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES
82-75-600 Causes for penalties.
82-75-605 Alleging a violation.
82-75-610 Complaints.
82-75-615 Investigation.
82-75-620 Notice of violation and recommended penalty.
82-75-625 Monetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses.
82-75-630 Nonmonetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses.
82-75-635 Penalty ranges based on culpability.
82-75-640 Other factors that may be considered in determining the penalty for a violation of this chapter.
82-75-645 Process to appeal determination of a violation and assessed penalties.
82-75-650 Informal dispute resolution prior to a hearing.
82-75-655 Hearing.
82-75-660 Final decision.
82-75-665 Posting of information related to inappropriate disclosure or use of protected information.
82-75-700 Purpose of audits.
82-75-705 When an audit may be commenced.
82-75-710 Audit process.
82-75-715 Audit guide.
82-75-720 Audit findings of a violation.
82-75-010
(1) Chapter 43.371 RCW establishes the framework for the creation and administration of a statewide all-payer health care claims database.
(2) RCW 43.371.020 directs the office of financial management to establish a statewide all-payer health care claims database to support transparent public reporting of health care information. The office shall select a lead organization to coordinate and manage the database. The lead organization shall also contract with a data vendor to perform data collection, processing, aggregation, extracts, and analytics.
(4) The purpose of this chapter is to implement chapter 43.371 RCW, to facilitate the creation and administration of the Washington statewide all-payer health care claims database.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-010, filed 1/29/16, effective 2/29/16.]
82-75-020
Definitions required by chapter 43.371 RCW.
"Paid amount" means the dollar amount paid for a health care service rendered under the terms of an insurance policy, health benefits plan or state labor and industries program for covered services, excluding member copayments, coinsurance, deductibles and other sources of third-party payment. This dollar amount includes incentive payments that are captured in the claims financial fields in the WA-APCD Data Submission Guide; such incentive payments include, but are not limited to, withholds, shared savings payments, case or episode payments, and pay-for-performance amounts. For capitated services the fee-for-service equivalent is to be reported as the paid amount.
[Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-020, filed 10/31/17, effective 12/1/17. Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-020, filed 1/29/16, effective 2/29/16.]
82-75-030
Additional definitions authorized by chapter 43.371 RCW.
"Capitation payment" means a payment model where providers receive a payment on a per "covered person" basis, for specified calendar periods, for the coverage of specified health care services regardless of whether the patient obtains care. Capitation payments include, but are not limited to, global capitation arrangements that cover a comprehensive set of health care services, partial capitation arrangements for subsets of services, and care management payments.
"Claimant" means a person who files a workers compensation claim with the Washington state department of labor and industries.
"Data policy committee" or "DPC" is the advisory committee required by RCW 43.371.020 (5)(h) to provide advice related to data policy development.
"Data release committee" or "DRC" is the advisory committee required by RCW 43.371.020 (5)(h) to establish a data release process and to provide advice regarding formal data release requests.
"Data use agreement" or "DUA" means the legally binding document signed by either the lead organization and the data requestor, or the office and the data requestor, or the office and a Washington state agency, that defines the terms and conditions under which access to and use of the WA-APCD data is authorized, how the data will be secured and protected, and how the data will be destroyed at the end of the agreement term.
"Fee-for-service equivalent" means the amount that would have been paid by the payer for a specified service if the service had not been capitated or paid under an alternative payment formula like treatment episodes, or the fee amount reflected in the payer's internal fee schedule(s) for services that are not paid on a fee-for-service basis.
"Fee-for-service payment" means a payment model where providers receive a negotiated or payer-specified rate for a specific health care service provided to a patient.
"Lead organization" means the entity selected by the office of financial management to coordinate and manage the database as provided in chapter 43.371 RCW.
"Malicious intent" means the person acted willfully or intentionally to cause harm, without legal justification.
"Person" means an individual; group of individuals however organized; public or private corporation, including profit and nonprofit corporations; a partnership; joint venture; public and private institution of higher education; a state, local, and federal agency; and a local or tribal government.
"PFI" means the proprietary financial information as defined in RCW 43.371.010(12).
"WA-APCD" means the statewide all payer health care claims database authorized in chapter 43.371 RCW.
"WA-APCD program director" means the individual designated by the office as responsible for the oversight and management of the operations of the statewide all payer health care claims database authorized in chapter 43.371 RCW.
"Washington covered person" means any eligible member and all covered dependents where the covered person is a Washington state resident, or the state of Washington has primary jurisdiction, and whose laws, rules and regulations govern the members' and dependents' insurance policy or health benefit plan.
[Statutory Authority: RCW 43.371.010(3) and 43.371.070. WSR 19-05-054, § 82-75-030, filed 2/15/19, effective 3/18/19; WSR 18-19-056, § 82-75-030, filed 9/15/18, effective 10/16/18. Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-030, filed 7/5/18, effective 8/5/18. Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-030, filed 10/31/17, effective 12/1/17. Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-030, filed 4/4/17, effective 5/5/17; WSR 16-22-062, § 82-75-030, filed 11/1/16, effective 12/2/16; WSR 16-04-068, § 82-75-030, filed 1/29/16, effective 2/29/16.]
82-75-040
[Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-040, filed 1/29/16, effective 2/29/16.]
82-75-050
82-75-060
Historical data submission.
(3) "Historical data" means covered medical services claim files, pharmacy claim files, dental claim files, member eligibility and enrollment data files, and provider data files with necessary identifiers for the period January 1, 2013, through December 31, 2016, or through the end of the quarter immediately prior to the first regular quarterly submission due in accordance with the data submission schedule.
(4) The office may grant an exception to this section and approve the filing of historical data for a period less than the period specified in subsection (3) of this section. Requests for an exception under this subsection shall be made to the lead organization within fifteen calendar days of being notified in accordance with subsection (2) of this section. The lead organization shall make a recommendation to the office as to whether to approve or deny the request. The office may approve the request for good cause.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-05-024, § 82-75-060, filed 2/7/17, effective 3/10/17; WSR 16-04-068, § 82-75-060, filed 1/29/16, effective 2/29/16.]
82-75-070
82-75-080
[Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-080, filed 1/29/16, effective 2/29/16.]
82-75-090
82-75-100
(a) Data supplier's name, address, telephone number, email address and contact person.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-100, filed 1/29/16, effective 2/29/16.]
82-75-110
[Statutory Authority: Chapter 43.371 RCW. WSR 16-04-068, § 82-75-110, filed 1/29/16, effective 2/29/16.]
82-75-200
General data request and release procedures.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-200, filed 11/1/16, effective 12/2/16.]
82-75-210
Procedures for data requests.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-210, filed 11/1/16, effective 12/2/16.]
82-75-220
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-220, filed 11/1/16, effective 12/2/16.]
82-75-230
Review of data requests.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-230, filed 11/1/16, effective 12/2/16.]
82-75-240
(c) Requestors must comply with the requirements for data release in WAC 82-75-500 through 82-75-520.
[Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-240, filed 10/31/17, effective 12/1/17. Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-240, filed 11/1/16, effective 12/2/16.]
82-75-250
Data use agreement.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-250, filed 11/1/16, effective 12/2/16.]
82-75-260
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-260, filed 11/1/16, effective 12/2/16.]
82-75-270
Data procedures at the end of the project.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-270, filed 11/1/16, effective 12/2/16.]
82-75-280
Reasons to decline a request for data.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-280, filed 11/1/16, effective 12/2/16.]
82-75-290
Process to review a declined data request.
(a) Data requestor's name, address, telephone number, email address and contact person.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-290, filed 11/1/16, effective 12/2/16.]
82-75-300
Process to appeal of final denial of data request.
[Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062, § 82-75-300, filed 11/1/16, effective 12/2/16.]
82-75-400
(1) RCW 43.371.070 (1)(d) authorizes the director of the office of financial management to adopt rules providing procedures for ensuring that all data received from data suppliers are securely collected and stored in compliance with applicable state and federal law.
(2) RCW 43.371.070 (1)(e) authorizes the director of the office of financial management to adopt rules providing procedures for ensuring compliance with state and federal privacy laws.
(3) WAC 82-75-410 through 82-75-470 provide the procedures required in subsections (1) and (2) of this section.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-400, filed 4/4/17, effective 5/5/17.]
82-75-410
Requirements for data vendor.
(1) The data vendor must enter into an agreement with the lead organization that contains the following requirements:
(a) A provision that the data vendor is responsible for ensuring compliance of all aspects of WA-APCD operations with all applicable federal and state laws, and the state's security standards established by the office of the chief information officer;
(b) Provisions that the data vendor is required to keep logs and documentation on activities conducted pursuant to the security plan consistent with the state records retention requirements, which the office can request to verify that the security protocols are being followed;
(c) A provision that requires a detailed security process, which should include, but is not limited to, details regarding security risk assessments and corrective actions plans when deficiencies are discovered;
(d) Provisions that require secure file transfer for all receipt and transmission of health care claims data; and
(e) Provisions for encryption of data both in motion and at rest using latest industry standard methods and tools for encryption, consistent with the standards of the office of the chief information officer.
(2) The data vendor must enter into a legally binding data use and confidentiality agreement with the lead organization. The agreement must include provisions that restrict the access and use of data in the WA-APCD to that necessary for the operation and administration of the database as authorized by chapter 43.371 RCW.
(3)(a) The data vendor must annually engage the services of an independent third-party security auditor to conduct a security audit to verify that the infrastructure, environment and operations of the WA-APCD are in compliance with federal and state laws, Washington state information technology security standards, and the contract with the lead organization. The data vendor must prepare a plan to correct any deficiency found in the annual security audit.
(b) The data vendor must submit its latest HITRUST common security framework (CSF) report and the latest statement on standards for attestation engagements (SSAE) No. 16 service organization control 2 (SOC 2) Type II audit report covering the data vendor's third-party data center, to the office within thirty calendar days of receiving the final report. The data vendor must develop and implement an appropriate corrective action plan, including remediation timelines, when necessary, and provide the corrective action plan to the office or the office of the state chief information security officer upon request.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-410, filed 4/4/17, effective 5/5/17.]
82-75-420
(1) All data suppliers must submit data to the WA-APCD using a secure transfer protocol and transmission approach approved by the office of the state chief information security officer.
(2) All data suppliers must encrypt data using the latest industry standard methods and tools for encryption consistent with the data vendor's requirements for data encryption as required in WAC 82-75-410.
(3) The data vendor must provide a unique set of login credentials for each individual acting on behalf of or at the direction of an active data supplier.
(4) The data vendor must ensure that the data supplier can only use strong passwords consistent with the state standards when securely submitting data or accessing the secure site.
(5) The data vendor must automatically reject and properly dispose of any files from data suppliers that are not properly encrypted.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-420, filed 4/4/17, effective 5/5/17.]
82-75-430
WA-APCD infrastructure.
(1) The data vendor must limit access to the secure site. Personnel allowed access must be based on the principle of least privilege and have an articulable need to know or access the site.
(2) The data vendor must conduct annual penetration testing and have specific requirements around the timing of penetration and security testing of infrastructure used to host the WA-APCD by the outside firm. The results of penetration and security testing must be documented and the data vendor must provide the summary results, along with a corrective action plan and remediation timelines, to the office and the office of the state chief information security officer within thirty calendar days of receipt of the results.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-430, filed 4/4/17, effective 5/5/17.]
82-75-440
(1) The data vendor must submit an annual report to the lead organization, the office, and the office of the state chief information security officer that includes the following information:
(a) Summary results of its independent security assessment; and
(b) Summary of its penetration testing and vulnerability assessment results.
(2) The data vendor, upon reasonable notice, must allow access and inspections by staff of the office of the state chief information security officer to ensure compliance with state standards.
(3) The data vendor, upon reasonable notice, must allow on-site inspections by the office to ensure compliance with laws, rules and contract terms and conditions.
(4) The data vendor must have data retention and destruction policies that are no less stringent than that required by federal standards, including the most current version of NIST Special Publication 800-88, Guidelines for Media Sanitization.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-440, filed 4/4/17, effective 5/5/17.]
82-75-450
Data vendor and lead organization compliance with privacy and security requirements.
(1) To ensure compliance with privacy and security requirements, the data vendor must immediately report to the office and the office of the state chief information security officer any data breach of the WA-APCD or knowledge that a data recipient is not complying with confidentiality requirements in accordance with OFM-approved data breach notification procedures. The data vendor may not unilaterally disclose any information related to a breach of the WA-APCD without written permission from the office and the state chief information security officer.
(2) Upon receiving approval from the office and the state chief information security officer, the data vendor must notify the data supplier if the data it supplied has been the subject of a data breach for which the reporting requirements in subsection (1) of this section apply. The data vendor is responsible for complying with the applicable notification provisions in state and federal law.
(3) To ensure compliance with privacy and security requirements, the lead organization must:
(a) Conduct follow-up with data recipients of PHI or PFI on a schedule developed by the lead organization;
(b) Request data recipients share any manuscripts, reports, or products with lead organization and office;
(c)(i) Require data recipients to complete a project completion form, attesting that the project has terminated and data have been destroyed in accordance with the data use agreement;
(ii) Require the data recipient to provide the written verification that the data has been destroyed in a manner no less stringent than is required in WAC 82-75-440(4).
(d) Track all requests and research projects and follow up with the data recipient when the research or project is expected to be completed; and
(e) Follow up and require written verification that data is destroyed.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-450, filed 4/4/17, effective 5/5/17.]
82-75-460
(1) The data vendor will ensure access to the WA-APCD data is strictly controlled and limited to authorized staff with appropriate training, clearance, background checks, and confidentiality agreements.
(2) All data vendor employees who are provided access to data submitted to the WA-APCD must attend security and privacy training before actual access to data is allowed. The training will cover the relevant privacy and security requirements in state and federal law.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-460, filed 4/4/17, effective 5/5/17.]
82-75-470
State oversight of compliance with privacy and security requirements.
In order to ensure compliance with privacy and security requirements and procedures, the office or the office of chief information officer or both may request from the lead organization any or all of the following:
(1) Audit logs pertaining to accessing the WA-APCD data;
(2) Completion of a security design review as required by Washington state IT security standards;
(3) Documentation of compliance with OCIO security policy (OCIO policy 141.10 Securing information technology assets standards);
(4) All data use agreements.
[Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079, § 82-75-470, filed 4/4/17, effective 5/5/17.]
82-75-500
Additional definitions related to the format for the calculation and display of data.
The following additional definitions apply throughout this chapter unless the context clearly indicates another meaning. These definitions are related to the rules regarding the format for the calculation and display of cost data.
(1) "Aggregate cost data" means data collected from individual-level records that are maintained in a form that does not permit the identification of individual records.
(2) "Arithmetic mean" means the sum of a set of values, divided by the number of values in the set.
(3) "Average" means the arithmetic mean.
(4) "Cell size suppression" means a method used to report data that restricts or suppresses disclosure of subsets of data to protect the identity and privacy of data subjects and to avoid the risk of identification of individuals or providers in small population groups.
(5) "Median" means the middle value of a list of values where the values have been sorted in size order. If the list has an even number of values, the median is the arithmetic mean of the two middle values.
(6) "Outlier" means an observation that is well outside of the expected range of values in a study or experiment, and which is often discarded from the data set.
(7) "Proportion" means a comparative relation between things or magnitudes as to size, quantity, number, or ratio.
(8) "Range" is the largest value in the set of numbers minus the smallest value in the set. Often, a range is expressed to denote a particular span, e.g., 25th to 75th percentile range. Note that as a statistical term, the range is a single number, not a range of numbers.
[Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-500, filed 10/31/17, effective 12/1/17.]
82-75-510
Data formatting rules apply to proprietary financial information.
(1) The format rules apply to all proposed uses of proprietary financial information submitted to the WA-APCD. The format rules apply to three categories of users for which proprietary financial information may be disclosed in accordance with chapter 43.375 RCW:
(a) Lead organization;
(b) Federal agencies, Washington state agencies, and units of Washington local government; and
(c) Researchers with IRB approval.
(2) The lead organization shall assess a data requestor's proposed methods submitted in compliance with RCW 43.371.050 (1)(c) and WAC 82-75-210(2), which require the data requestor to submit a description of the proposed methodology for data analysis. The lead organization's assessment shall include evaluating the data requestor's methodology as it pertains to the calculation and presentation of cost information that rely upon proprietary financial information.
(3) To evaluate data requestor methodology, the lead organization shall adopt criteria to prevent the disclosure or determination of proprietary financial information to any third party.
(4) The data release advisory committee shall advise the lead organization on the criteria to be adopted.
(5) Nothing in this rule shall contravene the authorized uses of proprietary financial information as provided in RCW 43.371.050.
[Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-510, filed 10/31/17, effective 12/1/17.]
82-75-520
Elements to safeguard the use of proprietary financial information.
All reports, analytics or other information drawn from the WA-APCD that an approved WA-APCD data user as defined in WAC 82-75-510(1) shares with any third party shall comply with the following restrictions.
(1) Allowed amount data may be made available for public use.
(2) Allowed amount data shall be provider or payer deidentified.
(3) Provider-specific allowed amount data shall be suppressed if that payer accounts for more than fifty percent of that provider's patient market share that payer deidentified data could readily be payer reidentified.
(4) Absolute or relative allowed cost information shall be communicated in ways that mitigate the potential to mislead data users including, but not limited to:
(a) Median cost mitigates the impact of outlier cases;
(b) Cost variation statistics (ranges, confidence intervals) illustrate the typical distribution of costs around a point estimate;
(c) Categorization, stratification or risk-adjustment techniques make like-comparisons of patient populations;
(d) Minimum case volume rules and/or reporting of volume alerts users to the universe or sample underlying the cost result; and
(e) Cell size suppression rules are followed whereby cells containing cost data based on a number of patients or providers that is below a minimum threshold count is suppressed.
[Statutory Authority: RCW 43.371.050(6) and chapter 43.371 RCW. WSR 17-22-121, § 82-75-520, filed 10/31/17, effective 12/1/17.]
82-75-550
Requirement for fee schedules and processes.
(1) RCW 43.371.020 (5)(g) requires the lead organization to develop a plan for the financial sustainability of the database, and charge fees for reports and data files to fund the database.
(2) The office must approve any fee established by the lead organization.
(3) RCW 43.371.070 requires the office to establish by rule, procedures for the lead organization to establish these statutorily required fees.
(4) The process to develop, review and approve fee schedules will be open and transparent, and allow for stakeholder feedback.
[Statutory Authority: RCW 43.371.070 (1)(f). WSR 18-10-074, § 82-75-550, filed 5/1/18, effective 6/1/18.]
82-75-560
82-75-570
Process to modify fee schedules.
(1) Fee schedules shall be reissued no less frequently than on an annual basis. The reissuance of the fee schedule can include maintaining the fee schedule without modification, modifying the fee schedule, or a combination of these two actions.
(2) The lead organization shall review fee schedules at least once every year. Annual period shall be from the date upon which the fee schedule is adopted. The review shall include whether any fee should be changed, removed from the schedule, or new fees added. The lead organization must maintain documentation that supports the recommended changes from the review of the fee schedule.
(3) The lead organization must present the changes, supporting documentation, and proposed modifications to the fee schedule to the data policy committee for review and feedback. The lead organization must provide any other available data requested by the DPC that supports the proposed modifications to the fee schedule.
(4) The DPC must review the changes, supporting documentation, and proposed modifications to the fee schedule and adopt recommendations, including the basis for each recommendation, as to whether the changes should be accepted and the modified fee schedule approved by the office. The DPC must provide the recommendations to the lead organization for its consideration.
(5) The lead organization must review the DPC recommendations and make any changes to the recommendations and proposed modifications to the fee schedule based on the recommendations. The lead organization must document which recommendations it implemented into the fee schedule. For those recommendations that the lead organization did not act upon, the lead organization must document the reasons why each recommendation was not accepted.
(6) The lead organization must provide the office the proposed modifications to the fee schedule, as modified, with supporting documentation, the DPC recommendations, and the reasoning for why the lead organization did not make changes for any recommendation not accepted. The lead organization must provide any other available data requested by the office that supports the changes and proposed modified fee schedule provided to the office.
(7) The office shall post on the agency web site the recommendations and proposed modifications to the fee schedule, and solicit public comment for thirty days. The office may also convene a stakeholder meeting to provide an opportunity for interested parties another avenue to give feedback on the draft fee schedule. If the office decides to hold a stakeholder meeting, the meeting may be in person, by telephone or other electronic means, as determined by the office.
(8) After the comment period, the office will review all the stakeholder feedback, recommendations of the DPC, and any data received from the lead organization and make a final determination regarding the fee schedule. The office shall provide the final determination to the lead organization, publish the final determination on the agency web site, and send notification through the office listserv or other electronic means.
[Statutory Authority: RCW 43.371.070 (1)(f). WSR 18-10-074, § 82-75-570, filed 5/1/18, effective 6/1/18.]
82-75-600
Causes for penalties.
(1) The office may impose penalties for the inappropriate disclosure or use of direct patient identifiers, indirect patient identifiers, and proprietary financial information received from, provided to, or contained in the WA-APCD.
(2) Any penalty imposed pursuant to this subchapter and in accordance with RCW 43.371.050 shall be in addition to and does not prevent the assessment of penalties authorized by state or federal law, contract, or court order.
(3) The following definitions apply to WAC 82-75-600 through 82-75-665.
(a) "Inappropriate disclosures" or "uses" are those that are inconsistent or in violation of the requirements in RCW 43.371.050. In addition, inappropriate disclosure or uses also include defamatory or malicious use and disclosure or use and disclosure with the intent to cause harm.
(b) "Protected information" is direct patient identifiers, indirect patient identifiers and proprietary financial information.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-600, filed 7/5/18, effective 8/5/18.]
82-75-605
Alleging a violation.
(1) Any person, as defined in WAC 82-75-030, may bring to the attention of the lead organization or the office information concerning the inappropriate disclosure or use of protected information as set forth in RCW 43.371.050 and WAC 82-75-600.
(2) The office must conduct an investigation unless it determines that the complaint is without merit or is frivolous, regardless of how the office has received the information that led to that belief, including information derived from any audit conducted by or at the direction of the office.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-605, filed 7/5/18, effective 8/5/18.]
82-75-610
(1) Any complaint filed pursuant to WAC 82-75-605 must be in writing and include the following information, if known:
(b) The specific facts supporting the violation alleged, including the dates, and locations for all events upon which the complaint is made;
(c) The facts upon which the complaint is based; and
(d) The name of the individual(s) and organization the complainant believes has committed an inappropriate disclosure or use of protected information and should be subject to penalties.
(2) If sufficient information is provided as required in subsection (1)(b) through (d) of this section, the office will accept the complaint without the complainant's name and contact information. In cases when the name and contact information is not provided, the complainant waives any future contact or notification from the office regarding the complaint.
(3) The complainant must provide additional information if requested by the lead organization or the office.
(4) Complaints alleging the lead organization made inappropriate disclosure or use of protected information must be filed directly with the office. The complaint must contain the information required in subsection (1) of this section. If a complaint of this nature is filed with the lead organization, the lead organization must forward to the office within one business day of receipt, without further review or action.
(5) Regardless of whether the complaint was filed with the office or the lead organization, except as provided by subsection (4) of this section, the lead organization will review the complaint and compile any information it may have related to the complaint. The lead may review the complaint as to whether the facts as presented support the finding of an inappropriate disclosure or use of protected information. The lead organization must forward the complaint, and all supporting documents to the office, including the result of any initial review the lead may have undertaken.
(6) The office must review the information provided by the lead organization pursuant to subsection (5) of this section.
(a) If the office determines that the facts as presented, if true, support the finding of an inappropriate disclosure or use of protected information, the office will conduct an investigation to substantiate the allegations.
(b) If the office determines that the facts as presented, if true, do not support the finding of an inappropriate disclosure or use of protected information, the office will close the complaint without further action. If closed without further action, the notice will include the basis for that determination.
(c) The office may conduct the investigation, or contract with a third party, other than the lead organization or a subcontractor to the lead organization, to conduct the investigation.
(7) The office will notify the complainant in writing and state whether the complaint will be investigated or closed without action.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-610, filed 7/5/18, effective 8/5/18.]
82-75-615
82-75-620
Notice of violation and recommended penalty.
(1) If, based on the investigation, the WA-APCD program director determines that the facts support finding an inappropriate disclosure or use of protected information and imposition of a penalty as set forth in the investigation report, the WA-APCD program director shall notify the alleged violator. The WA-APCD program director shall cause service of the notice of violation and recommended penalty on each alleged violator. The notice shall include the following information:
(a) Date when the recommended penalty and other actions imposed will take effect, if not appealed;
(b) Each inappropriate disclosure or use of protected information found and the facts supporting each inappropriate disclosure or use of protected information;
(c) The recommended penalty, other monetary amounts to be assessed, including the cost of the investigation, and any other action authorized by WAC 82-75-625 and 82-75-630;
(d) If the person will be prohibited from receiving data from the WA-APCD in the future, the period of the recommended prohibition;
(e) Notice that each alleged violator may request a hearing in accordance with WAC 82-75-645 to dispute the finding of a violation, the recommended penalty, or both. The notice shall state that if no hearing is requested within thirty days of the date of issuance of the notice, the office shall issue a final, unappealable order.
(2) In the event the alleged violator or violators do not timely request a hearing, the WA-APCD program director will provide the report and recommendation to the director, who shall issue a final order, which will include the date upon which the order becomes effective.
(3) The WA-APCD program director shall provide a copy of the investigation report and the notice prepared pursuant to subsection (1) of this section to all data suppliers with protected information identified in the report as having been inappropriately disclosed or used. This notice is separate and in addition to any other notice required by law.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-620, filed 7/5/18, effective 8/5/18.]
82-75-625
Monetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses.
(1) If a person has been found to have made inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, and proprietary financial information received from the WA-APCD, the director may impose one or more of the following monetary penalties:
(a) A civil penalty determined pursuant to the criteria and requirements in this chapter;
(b) Cost, including reasonable investigative costs, that do not exceed the amount of any civil penalty;
(c) The cost of any audit performed that uncovered the violation, or was conducted as a result of investigating an alleged violation; and
(d) Up to three times the amount of financial gain received by the alleged violator or financial loss of any person whose protected information was inappropriately disclosed or used.
(2) The director shall include with the decision regarding the monetary penalty assessment, the director's reasoning for the specific penalty, or lack thereof, that is being assessed.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-625, filed 7/5/18, effective 8/5/18.]
82-75-630
Nonmonetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses.
In addition to the monetary penalties set forth in WAC 82-75-625, if a person has been found to have made inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, and proprietary financial information received from the WA-APCD, the director may order the following nonmonetary penalties:
(1)(a) Direct WA-APCD program director to review the contract between the person and lead organization to determine whether the finding is a breach of that contract, and take appropriate action including requiring all WA-APCD data provided to be destroyed, termination of the contract, and seeking damages if the contract has been breached; or
(b) In lieu of (a) of this subsection, direct the lead organization to review whether the finding is also a breach of any contract between the person and the lead organization, and take appropriate action including requiring all WA-APCD data provided to be destroyed, termination of the contract, and seeking damages if the contract has been breached, unless the lead organization is the violator, in which case (a) of this subsection shall apply.
(2) Demand the destruction of all WA-APCD data provided, whether stand alone or combined with other data, all data products, and derivatives produced from WA-APCD data, and in the person's custody or contract, including proof of the destruction in the form and manner as prescribed by the office;
(3) Bar the person from receiving any data from the WA-APCD for a designated period of time; and
(4) Notify the funding entity of the violation, when the violation involves research funded by another entity, and any other regulatory agency that has oversight over the person or the data that the person requested.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-630, filed 7/5/18, effective 8/5/18.]
82-75-635
Penalty ranges based on culpability.
(1) In determining the appropriate sanction, including the amount of any civil penalty, the director will consider the level of culpability associated with the violation. The levels of culpability, in the order of less severe to severe, are as follows:
(a) Did not know. The person did not know and by exercising reasonable diligence, would not have known the violation had occurred.
(b) Reasonable cause. The person knew, or by exercising diligence should have known, that the violation had taken place, but the person did not act with willful negligence.
(c) Willful neglect - Corrected. The violation was due to the person's conscious, intentional failure or reckless indifference, and the violation was corrected within thirty days from the date the person knew or with reasonable diligence should have known of the inappropriate disclosure or use.
(d) Willful neglect - Uncorrected. The violation was due to the person's conscious, intentional failure or reckless indifference, and the violation was not corrected within thirty days from the date the person knew or with reasonable diligence should have known of the inappropriate disclosure or use.
(2) The penalty ranges for each level of culpability and the yearly cap for violations of a similar nature are as follows:
Culpability Category
Yearly Cap for Similar Violations
(3) Violations that involve malicious intent, as that term is defined in WAC 82-75-030, are not subject to the yearly caps set forth in subsection (2) of this section.
(4) The director may assess a penalty outside the penalty ranges set forth in subsection (2) of this section if the person has previously committed the same violation in the same culpability category.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-635, filed 7/5/18, effective 8/5/18.]
82-75-640
Other factors that may be considered in determining the penalty for a violation of this chapter.
In addition to the culpability category set forth in WAC 82-75-635, to determine the penalty amount, the director may consider the following factors:
(1) The nature and extent of the violation including, but not limited to, the number of persons affected, the duration of the violation, and whether the violation was done with malicious intent.
(2) The nature and extent of the harm resulting from the violation including, but not limited to:
(a) Whether the violation resulted in physical harm;
(b) Whether the violation resulted in financial harm;
(c) Whether the violation resulted in harm to a person's reputation;
(d) Whether the violation hindered an individual's ability to obtain health care;
(e) Whether the violation resulted in any other actual or potential harm.
(3) The history of compliance with the statutory, regulatory, and contractual provisions related to prior data release from the WA-APCD including, but not limited to:
(a) Whether the current violation is the same or similar to previous noncompliance;
(b) Whether and to what extent the person has attempted to correct previous noncompliance;
(c) How the person has responded to the complaint, investigation and any assistance provided to correct and mitigate any effect from the violation;
(d) How the person has responded to prior complaints for the same or similar violations including, but not limited to, changes in process or procedures for securing the confidentiality of the protected information, changes in recruitment, retention, or training requirements for employees or contractor with access to protected information.
(4) Any other factor relevant to the violation or the impact of the violation including, but not limited to:
(a) The frequency of incidents and/or duration of the wrongdoing;
(b) Whether there is a pattern or prior history of wrongdoing;
(c) Whether the person has accepted responsibility for the wrongdoing and recognizes the seriousness of violation;
(d) Whether the person paid or agreed to pay any criminal, civil, and administrative liabilities for the improper activity, including any investigative or administrative costs incurred by the government, and has made or agreed to make full restitution;
(e) Whether the person has cooperated fully during the investigation and any administrative action. In determining the extent of cooperation, the director may consider when the cooperation began and whether the person disclosed all known pertinent information;
(f) The kind of positions held by the individuals involved in the wrongdoing;
(g) Whether the person fully investigated the circumstances surrounding the violation and, if so, made the result of the investigation available to the reviewing official, and took appropriate corrective action or remedial measures;
(h) Whether effective standards of conduct and internal control systems were in place at the time the violation occurred;
(i) Whether appropriate disciplinary action was taken against the individuals responsible for the activity that constitutes the violation.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-640, filed 7/5/18, effective 8/5/18.]
82-75-645
Process to appeal determination of a violation and assessed penalties.
(1) Each person to whom a notice of a violation and recommended penalty is issued may request a hearing to be conducted in accordance with WAC 82-75-655.
(2) The request for a hearing must be submitted to the director in writing within thirty days after receipt of written notification of the notice provided pursuant to WAC 82-75-620. The person requesting a hearing must also provide a copy of the request to the WA-APCD program director.
(3) The request for hearing must be in writing and specify:
(a) The name of the person requesting the hearing and the person's or representative's contact information;
(b) The items, facts, or conclusions in the notice of violation being contested; and
(c) The basis for contesting the penalty, if applicable, including any mitigating factors upon which the person relies and the outcome the requestor is seeking.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-645, filed 7/5/18, effective 8/5/18.]
82-75-650
82-75-655
(1) The director may conduct the hearing or delegate to an individual within the office or to an administrative law judge pursuant to chapter 34.12 RCW the authority to conduct the hearing and prepare a proposed decision. The WA-APCD program director, on behalf of the office, shall be the petitioner in the hearing, and the requestor shall be the respondent.
(2) The WA-APCD program director shall have the burden of proving the basis for the finding of a violation and the penalty as set forth in the notice of violation and recommended penalty.
(3) The hearing shall be conducted in accordance with the Administrative Procedure Act, chapter 34.05 RCW and to the extent not covered in this chapter, by the uniform procedural rules in chapter 10-08 WAC.
(4) If the director presides over the hearing, the director shall issue a final written decision that includes findings of fact, conclusions of law, and if appropriate, the penalty. The director shall cause service of the final decision on all parties.
(5) If the director's designee or an administrative law judge presides over the hearing, she or he shall issue a proposed decision that includes findings of fact, conclusions of law and if appropriate the penalty. The proposed decision shall also include instructions on how to file objections and written arguments or briefs with the director. Objections and written arguments and briefs must be filed within twenty days from the date of receipt of the proposed decision.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-655, filed 7/5/18, effective 8/5/18.]
82-75-660
(1) The director shall review the proposed decision in accordance with the Administrative Procedure Act, chapter 34.05 RCW and any objections, written arguments and briefs timely filed by the parties. The director may:
(a) Allow the parties to present oral arguments;
(b) Allow the parties to submit additional information if circumstances so warrant; or
(c) Remand the matter to the designee or administrative law judge for further proceedings.
(2) The director shall issue a final decision that adopts in whole or in part, modifies, or rejects the proposed decision. If the decision finds a violation and assesses monetary penalties, the decision shall include notice that payment must be made no later than forty-five days after service of the decision or the period to appeal has expired, whichever is later.
(3) The director shall cause service of the final decision on all parties. Any party to whom a violation is found, may file a petition for review of the final decision to superior court. If an appeal is not filed within the period set by RCW 34.05.542, the director's decision is conclusive and binding on all parties.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-660, filed 7/5/18, effective 8/5/18.]
82-75-665
Posting of information related to inappropriate disclosure or use of protected information.
(1) Except as provided in subsection (2) of this section, the office will maintain a web site to provide public access to information related to the inappropriate disclosure or use of protected information. For each complaint for which an investigation is conducted, the office will post the complaint, the information that the lead organization provided to the office pursuant to WAC 82-75-610(5), investigation report and final disposition of the complaint. In addition, if the complaint finds a violation, the office will post the notice of violation and the final hearing order, if a hearing is requested.
(2) If any of the records specified for posting in subsection (1) of this section contains confidential or protected information, that information is privileged and not subject to disclosure under the Public Records Act, chapter 42.56 RCW, and will be redacted from any documents posted on the office web site.
[Statutory Authority: RCW 43.371.070 (1)(h). WSR 18-15-002, § 82-75-665, filed 7/5/18, effective 8/5/18.]
82-75-700
Purpose of audits.
[Statutory Authority: RCW 43.371.070. WSR 18-22-095, § 82-75-700, filed 11/5/18, effective 12/6/18.]
82-75-705
When an audit may be commenced.
[Statutory Authority: RCW 43.371.070. WSR 18-22-095, § 82-75-705, filed 11/5/18, effective 12/6/18.]
82-75-710
[Statutory Authority: RCW 43.371.070. WSR 18-22-095, § 82-75-710, filed 11/5/18, effective 12/6/18.]
82-75-715
[Statutory Authority: RCW 43.371.070. WSR 18-22-095, § 82-75-715, filed 11/5/18, effective 12/6/18.]
82-75-720
Audit findings of a violation.
[Statutory Authority: RCW 43.371.070. WSR 18-22-095, § 82-75-720, filed 11/5/18, effective 12/6/18.]