reglab/statecodes huggingface dataset:
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-220 - Data management plan

Current through Register Vol. 24-14, July 15, 2024
(1)
(a) The lead organization must require data
				  requestors to submit data management plans with the data request application.
				  Data management plans must comply with the Washington state office of chief
				  security officer standards.
(b)
				  Additional organizations that are involved in using the data in the data
				  requestors' projects must also provide the information required in the data
				  management plan for their organizations.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-240 - Data release

Current through Register Vol. 24-14, July 15, 2024
(1) Upon approval
				  of a request for data, the lead organization must provide notice to the
				  requestor. The notice must include the following:
(a) The data use agreement (DUA). The DUA
				  will include a confidentiality statement to which the requesting organization
				  or individual must adhere.
(b) The
				  confidentiality agreement that requestors and all other individuals who will
				  have access to the released data, whether an employee of the requestor,
				  subcontractor or other contractor or third-party vendor including data storage
				  or other information technology vendor, who will have access to or
				  responsibility for the data must sign. At a minimum, the confidentiality
				  agreement developed for recipients must meet the requirements of
				  RCW
				  43.371.050(4)(a).
(c) Requestors must comply with the
				  requirements for data release in WAC 182-70-500 through 182-70-520.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-250 - Data use agreement

Current through Register Vol. 24-14, July 15, 2024
(1) The lead
				  organization must develop a standard data use agreement. The authority must
				  approve the final form of the DUA, and all substantial changes to the
				  form.
(2) At a minimum, the DUA
				  shall include the following provisions:
(a) A
				  start date and end date. The end date must be no longer than the length of the
				  project for which the data is requested. The DUA may provide for the ability to
				  extend the end date of the agreement upon good cause shown.
(b) The application for data should be
				  incorporated into the DUA and attached as an exhibit to the agreement. There
				  should be an affirmative provision that data provided for one project cannot be
				  used for any other project or purpose.
(c) Data can be used only for the purposes
				  described in the request. The data recipient agrees not to use, disclose,
				  market, release, show, sell, rent, lease, loan or otherwise grant access to the
				  data files specified except as expressly permitted by the DUA, confidentiality
				  agreement if any and the approval letter.
(d) With respect to analysis and displays of
				  data, the data recipient must agree to abide by Washington state law and rules,
				  and standards and guidelines provided by the lead organization.
(e) A requirement for completion of an
				  attestation by an officer or otherwise authorized individual of the data
				  requestor that the data requestor will adhere to the WA-APCD's rules and lead
				  organization policies regarding the publication or presentation to anyone who
				  is not an authorized user of the data.
(f) A requirement that all requestor
				  employees and all other individuals who access the data will sign a
				  confidentiality agreement prior to data release. The confidentiality
				  requirements should be set out in the DUA and include the consequences for
				  failure to comply with the agreement.
(g) A requirement that any new employee who
				  joins the organization or project after the data requestor has received the
				  data and who will have access to the data must sign a confidentiality agreement
				  prior and passed required privacy and security training prior to accessing the
				  data.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-260 - Confidentiality agreement

Current through Register Vol. 24-14, July 15, 2024
(1) The lead
				  organization must develop a standard confidentiality agreement, as required,
				  before data may be released. The authority must approve the final form for
				  confidentiality agreement, and all substantial changes to the form.
(2) The confidentiality agreement must be
				  signed by all requestor employees and other third parties who may have access
				  to the data.
(3) In addition to
				  other penalties or regulatory actions that may be taken, including denial of
				  future data requests, breach of a confidentiality agreement may result in
				  immediate termination of the agreement. If an individual breaches the
				  confidentiality agreement, the lead organization must review the circumstances
				  and determine if the requestor's agreement should be terminated or only the
				  agreement with the individual who caused the breach should be terminated. When
				  an agreement is terminated for breach of the confidentiality agreement, the
				  data requestor or individual whose agreement is terminated must immediately
				  destroy all WA-APCD data in his or her possession and provide an attestation of
				  the destruction to the lead organization within seven business days.
				  Attestation of destruction should be in the form as prescribed by the lead
				  organization. Failure to destroy data or provide attestation of the destruction
				  may result in other penalties or regulatory actions.
Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062,
						§
												82-75-260,
						filed 11/1/16, effective 12/2/16.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-270 - Data procedures at the end of the project

Current through Register Vol. 24-14, July 15, 2024
(1) Upon the end of the project or the
				  termination of the data use agreement, the data recipient shall destroy all
				  WA-APCD data. The data recipient must provide to the lead organization an
				  attestation that the data has been destroyed according to the required
				  standards set forth in the DUA. The attestation shall account for all copies of
				  the data being used by the requestor, its employees, subcontractors, and any
				  other person provided access to the data. Attestation of destruction should be
				  in the form as prescribed by the lead organization.
(2) The attestation of data destruction must
				  be provided within ten business days from the end of the project or termination
				  of the DUA or confidentiality agreement, whichever is sooner.
(3) Failure to destroy data or provide
				  attestation of the destruction may result in other penalties or regulatory
				  actions.
Statutory Authority: Chapter 43.371 RCW. WSR 16-22-062,
						§
												82-75-270,
						filed 11/1/16, effective 12/2/16.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-280 - Reasons to decline a request for data

Current through Register Vol. 24-14, July 15, 2024
The lead organization may decline a request for data for
					 any of the following reasons:
(1) The
				  requestor has violated a data use agreement, nondisclosure agreement or
				  confidentiality agreement within three years of the date of request.
(2) Any person, other than the requestor, who
				  will have access to the data has violated a data use agreement, nondisclosure
				  agreement or confidentiality agreement within three years of the date of
				  request.
(3) The requestor or any
				  person other than the requestor, who will have access to the data, within the
				  five years prior to the data request date, been subject to a state or federal
				  regulatory action related to a data breach and has been found in violation and
				  assessed a penalty, been a party to a criminal or civil action relating to a
				  data breach and found guilty or liable for that breach, or had to take action
				  to notify individuals due to a data breach for data maintained by the data
				  requestor or for which the data requestor was responsible for maintaining in a
				  secure environment.
(4) The
				  proposed privacy and security protections in the data management plan on the
				  date the data is requested are not sufficient to meet Washington state
				  standards. The protections must be in place on the date the data is requested.
				  For out-of-state requestors, meeting the standards in the state where the
				  requestor or data recipient is located is not acceptable if those standards do
				  not meet those required in Washington state.
(5) The information provided is incomplete or
				  not sufficient to approve the data request.
(6) The proposed purpose for accessing the
				  data is not allowable under WA-APCD statutes, rules or policies, or other state
				  or federal statutes, rules, regulations or federal agency policy or standards
				  for example the Department of Justice Statements of Antitrust Enforcement
				  Policy in Health Care.
(7) The
				  proposed use of the requested data is for an unacceptable commercial use or
				  purpose. An unacceptable commercial use or purpose includes, but is not limited
				  to:
(a) A requestor using data to identify
				  patients using a particular product or drug to develop a marketing campaign to
				  directly contact those patients; or
(b) A requestor using data to directly
				  contact patients for fund-raising purposes; or
(c) A requestor intends to contact an
				  individual whose data is released; or
(d) Sells, gives, shares or intends to sell,
				  give or share released data with another entity or individual not included in
				  the original application for the data and for which approval was
				  given.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-290 - Process to review a declined data request

Current through Register Vol. 24-14, July 15, 2024
(1) A data requestor may request an
				  administrative review of the lead organization's decision to deny a request for
				  data.
(2) A request for an
				  administrative review may be initiated by a written petition filed with the
				  authority and also provided to the lead organization within thirty calendar
				  days after notice of the denial. The petition shall include the following
				  information:
(a) Data requestor's name,
				  address, telephone number, email address and contact person.
(b) Information about the subject of the
				  review including remedy requested.
(c) A detailed explanation as to the issue or
				  area of dispute, and why the dispute should be decided in the data requestor's
				  favor.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › DATA REQUESTS AND RELEASE PROCEDURES › Section 182-70-300 - Process to appeal of final denial of data request

Current through Register Vol. 24-14, July 15, 2024
(1) A data requestor may appeal the denial of
				  its administrative review conducted in accordance with WAC
				  182-70-290.
(2) Request for an
				  appeal must be submitted in writing to the authority within fifteen calendar
				  days after receipt of written notification of denial of its administrative
				  review, with a copy provided to the lead organization.
(3) The lead organization must provide notice
				  and a copy of the appeal request to affected data suppliers within five days of
				  being served. Data suppliers may seek to intervene in an appeal by submitting a
				  petition to intervene to the office of administrative hearings, and serving the
				  petition to intervene on the authority, lead organization and requestor within
				  five days of being notified of the appeal.
(4) Within ten business days of receipt of a
				  written notice of appeal, the authority will transmit the request to the office
				  of administrative hearings (OAH).
(a)
Scheduling.
OAH will assign an administrative law judge (ALJ) to
				  handle the appeal. The ALJ will notify parties of the time when any additional
				  documents or arguments must be submitted. If a party fails to comply with a
				  scheduling letter or established timelines, the ALJ may decline to consider
				  arguments or documents submitted after the scheduled timelines. A status
				  conference in complex cases may be scheduled to provide for the orderly
				  resolution of the case and to narrow issues and arguments for
				  hearing.
(b)
Hearings.
Hearings may be by telephone or in-per-son. The ALJ may decide the case without
				  a hearing if legal or factual issues are not in dispute, the appellant does not
				  request a hearing, or the appellant fails to appear at a scheduled hearing or
				  otherwise fails to respond to inquiries. The ALJ will notify the appellant by
				  mail whether a hearing will be held, whether the hearing will be in-person or
				  by telephone, the location of any in-person hearing, and the date and time for
				  any hearing in the case. The date and time for a hearing may be continued at
				  the ALJ's discretion. Other authority employees may attend a hearing, and the
				  ALJ will notify the appellant when other authority employees are attending. The
				  appellant may appear in person or may be represented by an attorney.
(c)
Decisions.
The decision of
				  the ALJ shall be considered a final decision. A petition for review of the
				  final decision may be filed in the superior court. If no appeal is filed within
				  the time period set by
				  RCW
				  34.05.542, the decision is conclusive and
				  binding on all parties. The appeal must be filed within thirty days from
				  service of the final decision.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-400 - Privacy and security

Current through Register Vol. 24-14, July 15, 2024
(1)
										RCW
				  43.371.070(1)(d) authorizes
				  the director of the health care authority to adopt rules providing procedures
				  for ensuring that all data received from data suppliers are securely collected
				  and stored in compliance with applicable state and federal law.
(2)
										RCW
				  43.371.070(1)(e) authorizes
				  the director of the health care authority to adopt rules providing procedures
				  for ensuring compliance with state and federal privacy laws.
(3) WAC 182-70-410 through 182-70-470 provide
				  the procedures required in subsections (1) and (2) of this section.
Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079,
						§
												82-75-400,
						filed 4/4/17, effective 5/5/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-410 - Requirements for data vendor

Current through Register Vol. 24-14, July 15, 2024
(1) The
				  data vendor must enter into an agreement with the lead organization that
				  contains the following requirements:
(a) A
				  provision that the data vendor is responsible for ensuring compliance of all
				  aspects of WA-APCD operations with all applicable federal and state laws, and
				  the state's security standards established by the office of the chief
				  information officer;
(b) Provisions
				  that the data vendor is required to keep logs and documentation on activities
				  conducted pursuant to the security plan consistent with the state records
				  retention requirements, which the authority can request to verify that the
				  security protocols are being followed;
(c) A provision that requires a detailed
				  security process, which should include, but is not limited to, details
				  regarding security risk assessments and corrective actions plans when
				  deficiencies are discovered;
(d)
				  Provisions that require secure file transfer for all receipt and transmission
				  of health care claims data; and
(e)
				  Provisions for encryption of data both in motion and at rest using latest
				  industry standard methods and tools for encryption, consistent with the
				  standards of the office of the chief information officer.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-420 - Data submission

Current through Register Vol. 24-14, July 15, 2024
(1) All data
				  suppliers must submit data to the WA-APCD using a secure transfer protocol and
				  transmission approach approved by the office of the state chief information
				  security officer.
(2) All data
				  suppliers must encrypt data using the latest industry standard methods and
				  tools for encryption consistent with the data vendor's requirements for data
				  encryption as required in WAC 182-70-410.
(3) The data vendor must provide a unique set
				  of login credentials for each individual acting on behalf of or at the
				  direction of an active data supplier.
(4) The data vendor must ensure that the data
				  supplier can only use strong passwords consistent with the state standards when
				  securely submitting data or accessing the secure site.
(5) The data vendor must automatically reject
				  and properly dispose of any files from data suppliers that are not properly
				  encrypted.
Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079,
						§
												82-75-420, filed
						4/4/17, effective 5/5/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-430 - WA-APCD infrastructure

Current through Register Vol. 24-14, July 15, 2024
(1) The
				  data vendor must limit access to the secure site. Personnel allowed access must
				  be based on the principle of least privilege and have an articulable need to
				  know or access the site.
(2) The
				  data vendor must conduct annual penetration testing and have specific
				  requirements around the timing of penetration and security testing of
				  infrastructure used to host the WA-APCD by the outside firm. The results of
				  penetration and security testing must be documented and the data vendor must
				  provide the summary results, along with a corrective action plan and
				  remediation timelines, to the authority and the office of the state chief
				  information security officer within thirty calendar days of receipt of the
				  results.
Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079,
						§
												82-75-430,
						filed 4/4/17, effective 5/5/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-440 - Accountability

Current through Register Vol. 24-14, July 15, 2024
(1) The data vendor
				  must submit an annual report to the lead organization, the authority, and the
				  office of the state chief information security office that includes the
				  following information:
(a) Summary results of
				  its independent security assessment; and
(b) Summary of its penetration testing and
				  vulnerability assessment results.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-450 - Data vendor and lead organization compliance with privacy and security requirements

Current through Register Vol. 24-14, July 15, 2024
(1) To
				  ensure compliance with privacy and security requirements, the data vendor must
				  immediately report to the authority and the office of the state chief
				  information security officer any data breach of the WA-APCD or knowledge that a
				  data recipient is not complying with confidentiality requirements in accordance
				  with health care authority-approved data breach notification procedures. The
				  data vendor may not unilaterally disclose any information related to a breach
				  of the WA-APCD without written permission from the authority and the state
				  chief information security officer.
(2) Upon receiving approval from the
				  authority and the state chief information security officer, the data vendor
				  must notify the data supplier if the data it supplied has been the subject of a
				  data breach for which the reporting requirements in subsection (1) of this
				  section apply. The data vendor is responsible for complying with the applicable
				  notification provisions in state and federal law.
(3) To ensure compliance with privacy and
				  security requirements, the lead organization must:
(a) Conduct follow-up with data recipients of
				  PHI or PFI on a schedule developed by the lead organization;
(b) Request data recipients share any
				  manuscripts, reports, or products with lead organization and the
				  authority;
(c)
(i) Require data recipients to complete a
				  project completion form, attesting that the project has terminated and data
				  have been destroyed in accordance with the data use agreement;
(ii) Require the data recipient to provide
				  the written verification that the data has been destroyed in a manner no less
				  stringent than is required in WAC 182-70-440(4).
(d) Track all requests and research projects
				  and follow up with the data recipient when the research or project is expected
				  to be completed; and
(e) Follow up
				  and require written verification that data is destroyed.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-460 - Additional requirements

Current through Register Vol. 24-14, July 15, 2024
(1) The
				  data vendor will ensure access to the WA-APCD data is strictly controlled and
				  limited to authorized staff with appropriate training, clearance, background
				  checks, and confidentiality agreements.
(2) All data vendor employees who are
				  provided access to data submitted to the WA-APCD must attend security and
				  privacy training before actual access to data is allowed. The training will
				  cover the relevant privacy and security requirements in state and federal
				  law.
Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079,
						§
												82-75-460,
						filed 4/4/17, effective 5/5/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PRIVACY AND SECURITY PROCEDURES › Section 182-70-470 - State oversight of compliance with privacy and security requirements

Current through Register Vol. 24-14, July 15, 2024
In order to ensure compliance with privacy and security
					 requirements and procedures, the authority or the office of chief information
					 officer or both may request from the lead organization any or all of the
					 following:
(1) Audit logs pertaining
				  to accessing the WA-APCD data;
(2)
				  Completion of a security design review as required by Washington state IT
				  security standards;
(3)
				  Documentation of compliance with OCIO security policy (OCIO policy 141.10
				  Securing information technology assets standards);
(4) All data use agreements.
Statutory Authority: Chapter 43.371 RCW. WSR 17-08-079,
						§
												82-75-470,
						filed 4/4/17, effective 5/5/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › FORMAT FOR THE CALCULATION AND DISPLAY OF DATA › Section 182-70-500 - Additional definitions related to the format for the calculation and display of data

Current through Register Vol. 24-14, July 15, 2024
The following additional definitions apply throughout this
					 chapter unless the context clearly indicates another meaning. These definitions
					 are related to the rules regarding the format for the calculation and display
					 of cost data.
(1) "Aggregate cost
				  data" means data collected from individual-level records that are maintained in
				  a form that does not permit the identification of individual records.
(2) "Arithmetic mean" means the sum of a set
				  of values, divided by the number of values in the set.
(3) "Average" means the arithmetic
				  mean.
(4) "Cell size suppression"
				  means a method used to report data that restricts or suppresses disclosure of
				  subsets of data to protect the identity and privacy of data subjects and to
				  avoid the risk of identification of individuals or providers in small
				  population groups.
(5) "Median"
				  means the middle value of a list of values where the values have been sorted in
				  size order. If the list has an even number of values, the median is the
				  arithmetic mean of the two middle values.
(6) "Outlier" means an observation that is
				  well outside of the expected range of values in a study or experiment, and
				  which is often discarded from the data set.
(7) "Proportion" means a comparative relation
				  between things or magnitudes as to size, quantity, number, or ratio.
(8) "Range" is the largest value in the set
				  of numbers minus the smallest value in the set. Often, a range is expressed to
				  denote a particular span, e.g., 25th to 75th percentile range. Note that as a
				  statistical term, the range is a single number, not a range of
				  numbers.
Statutory Authority:
						RCW
						43.371.050(6) and chapter
						43.371 RCW. WSR 17-22-121, §
												82-75-500,
						filed 10/31/17, effective 12/1/17.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › FORMAT FOR THE CALCULATION AND DISPLAY OF DATA › Section 182-70-510 - Data formatting rules apply to proprietary financial information

Current through Register Vol. 24-14, July 15, 2024
(1) The format
				  rules apply to all proposed uses of proprietary financial information submitted
				  to the WA-APCD. The format rules apply to three categories of users for which
				  proprietary financial information may be disclosed in accordance with chapter
				  43.375 RCW:
(a) Lead organization;
(b) Federal agencies, Washington state
				  agencies, and units of Washington local government; and
(c) Researchers with IRB approval.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › FORMAT FOR THE CALCULATION AND DISPLAY OF DATA › Section 182-70-520 - Elements to safeguard the use of proprietary financial information

Current through Register Vol. 24-14, July 15, 2024
All reports, analytics or other information drawn from the
					 WA-APCD that an approved WA-APCD data user as defined in WAC 182-70-510(1)
					 shares with any third party shall comply with the following
					 restrictions.
(1) Allowed amount data
				  may be made available for public use.
(2) Allowed amount data shall be provider or
				  payer deidentified.
(3)
				  Provider-specific allowed amount data shall be suppressed if that payer
				  accounts for more than fifty percent of that provider's patient market share
				  that payer deidentified data could readily be payer reidentified.
(4) Absolute or relative allowed cost
				  information shall be communicated in ways that mitigate the potential to
				  mislead data users including, but not limited to:
(a) Median cost mitigates the impact of
				  outlier cases;
(b) Cost variation
				  statistics (ranges, confidence intervals) illustrate the typical distribution
				  of costs around a point estimate;
(c) Categorization, stratification or
				  risk-adjustment techniques make like-comparisons of patient
				  populations;
(d) Minimum case
				  volume rules and/or reporting of volume alerts users to the universe or sample
				  underlying the cost result; and
(e)
				  Cell size suppression rules are followed whereby cells containing cost data
				  based on a number of patients or providers that is below a minimum threshold
				  count is suppressed.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › FEE SCHEDULES › Section 182-70-550 - Requirement for fee schedules and processes

Current through Register Vol. 24-14, July 15, 2024
(1)
										RCW
				  43.371.020(5)(g) requires
				  the lead organization to develop a plan for the financial sustainability of the
				  database, and charge fees for reports and data files to fund the
				  database.
(2) The authority must
				  approve any fee established by the lead organization.
(3)
										RCW 43.371.070
				  requires the authority to establish by rule, procedures for the lead
				  organization to establish these statutorily required fees.
(4) The process to develop, review and
				  approve fee schedules will be open and transparent, and allow for stakeholder
				  feedback.
Statutory Authority:
						RCW
						43.371.070(1)(f). WSR
						18-10-074, §
												82-75-550,
						filed 5/1/18, effective 6/1/18.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › FEE SCHEDULES › Section 182-70-560 - Process to establish fee schedules

Current through Register Vol. 24-14, July 15, 2024
(1)
				  The lead organization must develop a draft fee schedule consistent with the
				  requirements in
				  RCW
				  43.371.020(5)(g). The lead
				  organization must maintain documentation that supports the development of and
				  final decisions regarding the fee schedule.
(2) The lead organization must present the
				  draft fee schedule and supporting documentation to the data policy committee
				  for review and feedback. The lead organization must provide any other available
				  data requested by the DPC that supports the development and draft fee schedule
				  presented.
(3) The DPC must review
				  the draft fee schedule, supporting documentation, and adopt recommendations,
				  including the basis for each recommendation, as to whether the fee schedule
				  should be approved by the authority. The DPC must provide the recommendations
				  to the lead organization for its consideration.
(4) The lead organization must review the DPC
				  recommendations and make any changes to the draft fee schedule based on the
				  recommendations. The lead organization must document which recommendations it
				  implemented into the fee schedule. For those recommendations that the lead
				  organization did not act upon, the lead organization must document the reasons
				  why each recommendation was not accepted.
(5) The lead organization must provide the
				  authority the draft fee schedule, as modified, supporting documentation, the
				  DPC recommendations, and the reasoning for why the lead organization did not
				  make changes for any recommendation not accepted. The lead organization must
				  also provide any other available data requested by the authority that supports
				  the development and draft fee schedule provided to the authority.
(6) The authority shall post on the agency
				  website the draft fee schedule, and solicit public comment for thirty days. The
				  authority may also convene a stakeholder meeting to provide an opportunity for
				  interested parties another avenue to give feedback on the draft fee schedule.
				  If the authority decides to hold a stakeholder meeting, the meeting may be in
				  person, by telephone or other electronic means, as determined by the authority.
After the comment period, the authority will review all the
					 stakeholder feedback, recommendations of the DPC, and any data received from
					 the lead organization and make a final determination regarding the fee
					 schedule. The authority shall provide the final determination to the lead
					 organization, publish the final determination on the agency website, and send
					 notification through the authority listserv or other electronic
					 means.
Statutory Authority:
						RCW
						43.371.070(1)(f). WSR
						18-10-074, §
												82-75-560,
						filed 5/1/18, effective 6/1/18.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-600 - Causes for penalties

Current through Register Vol. 24-14, July 15, 2024
(1) The
				  authority may impose penalties for the inappropriate disclosure or use of
				  direct patient identifiers, indirect patient identifiers, and proprietary
				  financial information received from, provided to, or contained in the
				  WA-APCD.
(2) Any penalty imposed
				  pursuant to this subchapter and in accordance with
				  RCW
				  43.371.050 shall be in addition to and does
				  not prevent the assessment of penalties authorized by state or federal law,
				  contract, or court order.
(3) The
				  following definitions apply to WAC 182-70-600 through 182-70-665.
(a) "Inappropriate disclosures" or "uses" are
				  those that are inconsistent or in violation of the requirements in
				  RCW
				  43.371.050. In addition, inappropriate
				  disclosure or uses also include defamatory or malicious use and disclosure or
				  use and disclosure with the intent to cause harm.
(b) "Protected information" is direct patient
				  identifiers, indirect patient identifiers and proprietary financial
				  information.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-605 - Alleging a violation

Current through Register Vol. 24-14, July 15, 2024
(1) Any person,
				  as defined in WAC 182-70-030, may bring to the attention of the lead
				  organization or the authority information concerning the inappropriate
				  disclosure or use of protected information as set forth in
				  RCW
				  43.371.050 and WAC 182-70-600.
(2) The authority must conduct an
				  investigation unless it determines that the complaint is without merit or is
				  frivolous, regardless of how the authority has received the information that
				  led to that belief, including information derived from any audit conducted by
				  or at the direction of the authority.
Statutory Authority:
						RCW
						43.371.070(1)(h). WSR
						18-15-002, §
												82-75-605,
						filed 7/5/18, effective 8/5/18.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-610 - Complaints

Current through Register Vol. 24-14, July 15, 2024
(1) Any complaint
				  filed pursuant to WAC 182-70-605 must be in writing and include the following
				  information, if known:
(a) The name and
				  contact information of the complainant;
(b) The specific facts supporting the
				  violation alleged, including the dates, and locations for all events upon which
				  the complaint is made;
(c) The
				  facts upon which the complaint is based; and
(d) The name of the individual(s) and
				  organization the complainant believes has committed an inappropriate disclosure
				  or use of protected information and should be subject to penalties.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-615 - Investigation

Current through Register Vol. 24-14, July 15, 2024
(1) If the
				  authority accepts a complaint and conducts an investigation, the authority will
				  notify the person(s) that is the subject of the complaint in writing.
(2) The notice will include the following
				  information:
(a) The factual allegations
				  supporting each alleged inappropriate disclosure or use of protected
				  information violation in terms sufficient to put the persons on notice of the
				  specific reasons for the investigation;
(b) The statutory and administrative code
				  provisions addressing the allegations, if applicable;
(c) A request that the person provide a
				  written response to the allegations including any documents that support the
				  response, and notice that failure to respond will result in the authority
				  making a decision without the person's input; and
(d) A directive to cease using or destroy the
				  data received from the WA-APCD until the investigation has been completed and
				  the person is notified that he/she may again use the data provided. The person
				  shall complete an attestation that the person has complied with this directive.
				  A violation of this directive shall be grounds for finding a separate violation
				  of the inappropriate disclosure or use of protected information.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-620 - Notice of violation and recommended penalty

Current through Register Vol. 24-14, July 15, 2024
(1) If, based on the investigation, the
				  WA-APCD program director determines that the facts support finding an
				  inappropriate disclosure or use of protected information and imposition of a
				  penalty as set forth in the investigation report, the WA-APCD program director
				  shall notify the alleged violator. The WA-APCD program director shall cause
				  service of the notice of violation and recommended penalty on each alleged
				  violator. The notice shall include the following information:
(a) Date when the recommended penalty and
				  other actions imposed will take effect, if not appealed;
(b) Each inappropriate disclosure or use of
				  protected information found and the facts supporting each inappropriate
				  disclosure or use of protected information;
(c) The recommended penalty, other monetary
				  amounts to be assessed, including the cost of the investigation, and any other
				  action authorized by WAC 182-70-625 and 182-70-630;
(d) If the person will be prohibited from
				  receiving data from the WA-APCD in the future, the period of the recommended
				  prohibition;
(e) Notice that each
				  alleged violator may request a hearing in accordance with WAC 182-70-645 to
				  dispute the finding of a violation, the recommended penalty, or both. The
				  notice shall state that if no hearing is requested within thirty days of the
				  date of issuance of the notice, the authority shall issue a final, unappealable
				  order.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-625 - Monetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses

Current through Register Vol. 24-14, July 15, 2024
(1)
				  If a person has been found to have made inappropriate disclosures or uses of
				  direct patient identifiers, indirect patient identifiers, and proprietary
				  financial information received from the WA-APCD, the director may impose one or
				  more of the following monetary penalties:
(a)
				  A civil penalty determined pursuant to the criteria and requirements in this
				  chapter;
(b) Cost, including
				  reasonable investigative costs, that do not exceed the amount of any civil
				  penalty;
(c) The cost of any audit
				  performed that uncovered the violation, or was conducted as a result of
				  investigating an alleged violation; and
(d) Up to three times the amount of financial
				  gain received by the alleged violator or financial loss of any person whose
				  protected information was inappropriately disclosed or used.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-630 - Nonmonetary penalties that may be imposed upon finding a violation of inappropriate disclosures or uses

Current through Register Vol. 24-14, July 15, 2024
In addition to the monetary penalties set forth in WAC
					 182-70-625, if a person has been found to have made inappropriate disclosures
					 or uses of direct patient identifiers, indirect patient identifiers, and
					 proprietary financial information received from the WA-APCD, the director may
					 order the following nonmonetary penalties:
(1)
(a)
				  Direct WA-APCD program director to review the contract between the person and
				  lead organization to determine whether the finding is a breach of that
				  contract, and take appropriate action including requiring all WA-APCD data
				  provided to be destroyed, termination of the contract, and seeking damages if
				  the contract has been breached; or
(b) In lieu of (a) of this subsection, direct
				  the lead organization to review whether the finding is also a breach of any
				  contract between the person and the lead organization, and take appropriate
				  action including requiring all WA-APCD data provided to be destroyed,
				  termination of the contract, and seeking damages if the contract has been
				  breached, unless the lead organization is the violator, in which case (a) of
				  this subsection shall apply.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-635 - Penalty ranges based on culpability

Current through Register Vol. 24-14, July 15, 2024
(1) In determining the appropriate sanction,
				  including the amount of any civil penalty, the director will consider the level
				  of culpability associated with the violation. The levels of culpability, in the
				  order of less severe to severe, are as follows:
(a) Did not know. The person did not know and
				  by exercising reasonable diligence, would not have known the violation had
				  occurred.
(b) Reasonable cause. The
				  person knew, or by exercising diligence should have known, that the violation
				  had taken place, but the person did not act with willful negligence.
(c) Willful neglect - Corrected. The
				  violation was due to the person's conscious, intentional failure or reckless
				  indifference, and the violation was corrected within thirty days from the date
				  the person knew or with reasonable diligence should have known of the
				  inappropriate disclosure or use.
(d) Willful neglect - Uncorrected. The
				  violation was due to the person's conscious, intentional failure or reckless
				  indifference, and the violation was not corrected within thirty days from the
				  date the person knew or with reasonable diligence should have known of the
				  inappropriate disclosure or use.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-640 - Other factors that may be considered in determining the penalty for a violation of this chapter

Current through Register Vol. 24-14, July 15, 2024
In addition to the culpability category set forth in WAC
					 182-70-635, to determine the penalty amount, the director may consider the
					 following factors:
(1) The nature and
				  extent of the violation including, but not limited to, the number of persons
				  affected, the duration of the violation, and whether the violation was done
				  with malicious intent.
(2) The
				  nature and extent of the harm resulting from the violation including, but not
				  limited to:
(a) Whether the violation
				  resulted in physical harm;
(b)
				  Whether the violation resulted in financial harm;
(c) Whether the violation resulted in harm to
				  a person's reputation;
(d) Whether
				  the violation hindered an individual's ability to obtain health care;
(e) Whether the violation resulted in any
				  other actual or potential harm.
Washington Administrative Code › Title 182 - Health Care Authority › ALL PAYER HEALTH CARE CLAIMS DATABASE › Chapter 182-70 - All payer health care claims database › PENALTIES FOR INAPPROPRIATE DISCLOSURES OR USES › Section 182-70-645 - Process to appeal determination of a violation and assessed penalties

Current through Register Vol. 24-14, July 15, 2024
(1) Each person to
				  whom a notice of a violation and recommended penalty is issued may request a
				  hearing to be conducted in accordance with WAC 182-70-655.
(2) The request for a hearing must be
				  submitted to the director in writing within thirty days after receipt of
				  written notification of the notice provided pursuant to WAC 182-70-620. The
				  person requesting a hearing must also provide a copy of the request to the
				  WA-APCD program director.
(3) The
				  request for hearing must be in writing and specify:
(a) The name of the person requesting the
				  hearing and the person's or representative's contact information;
(b) The items, facts, or conclusions in the
				  notice of violation being contested; and
(c) The basis for contesting the penalty, if
				  applicable, including any mitigating factors upon which the person relies and
				  the outcome the requestor is seeking.