Seattle Children's Hospital v. King 5

IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON

SEATTLE CHILDREN’S HOSPITAL, a ) No. 81175-4-I
Washington nonprofit corporation, ) (Consolidated with No. 81295-5-I)
)
Appellant, ) DIVISION ONE
)
v. )
)
KING COUNTY, a Washington )
municipal corporation; WASHINGTON )
STATE DEPARTMENT OF HEALTH; ) UNPUBLISHED OPINION
and KING BROADCASTING )
COMPANY and its affiliates, d/b/a )
KING 5, a Washington corporation, )
)
Respondents. )

BOWMAN, J. — Seattle Children’s Hospital (SCH) moved for a temporary

restraining order against the Washington State Department of Health (DOH) and

a preliminary injunction against King Broadcasting Company and its affiliates

(KING 5) along with Seattle and King County Public Health (KCPH),1 seeking to

prevent the release of documents related to aspergillus mold infections in

surgical patients. The trial court ultimately denied the motions and ordered

release of the records. SCH appeals, arguing the documents fall under the

quality improvement and infection reporting exemptions to the Public Records

1
KCPH did not file briefing or participate in this appeal.

Citations and pin cites are based on the Westlaw online version of the cited material.
No. 81175-4-I (Consol. with No. 81295-5-I)/2

Act (PRA), chapter 42.56 RCW. SCH and DOH also urge us to apply the federal

Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-

191, 110 Stat. 1936, deidentification guidelines to any released patient records to

ensure medical confidentiality under Washington’s Uniform Health Care

Information Act (HCIA), chapter 70.02 RCW. We conclude that neither the

quality improvement nor the infection reporting exemption prevents release of the

records in this case. And we decline to impose judicially the HIPAA guidelines

for deidentification of patient information under the HCIA. We affirm denial of the

temporary restraining order and preliminary injunction but remand to the trial

court to ensure that all records comply with the required patient privacy

protections before they are released.

FACTS

Since 2001, SCH has experienced recurring infections in surgical patients

caused by aspergillus mold. In June 2018, SCH reported to KCPH that two more

patients developed aspergillus surgical site infections related to procedures

performed at the hospital. KCPH assisted SCH with its investigation into the

outbreak through August 2018. In May 2019, KCPH learned that SCH closed

their operating rooms because of new aspergillus cases. KCPH contacted the

Centers for Disease Control and Prevention (CDC) to help SCH investigate the

new outbreak. As part of the investigation, KCPH, DOH, and the CDC conducted

a site visit to SCH in July 2019.

2
No. 81175-4-I (Consol. with No. 81295-5-I)/3

In August 2019, a KING 5 news reporter made a PRA request to KCPH for

records related to the SCH aspergillus infections.2 KCPH compiled the records,

reviewed them, and determined no PRA exemptions protected the records from

disclosure. The more than 4,700 pages of records generally consist of e-mail

exchanges between SCH, KCPH, DOH, and the CDC discussing potential

sources of aspergillus infection, sample testing for the presence of aspergillus

mold, procedures to prevent future aspergillus infection of patients, and follow-up

to monitor implementation of those procedures and any new aspergillus

outbreaks. The records also include documents generated or shared in the

course of discussions among the agencies, including during the SCH site visit.

KCPH notified SCH of the KING 5 request and told SCH it intended to

release the records “unredacted.” SCH agreed to the release of most of the

records, objecting to only those it argued “contain information of the hospital and

2
DOH and KCPH received similar requests from several other media outlets, as well as
the law firm Stritmatter, Kessler, Koehler, Moore (Stritmatter Firm). These entities are not named
as parties on appeal, but several amici curiae briefs represent their interests. The Washington
Coalition for Open Government and the Washington Newspaper Publishers Association filed an
amici curiae brief in support of affirming the trial court’s orders. Their brief emphasizes the
public’s compelling interest in access to information about the serious health risk associated with
the recurring aspergillus infections at SCH. The brief also argues for limited redactions of health
care records to only information that may lead to the identity of patients. The Washington State
Hospital Association, the Association of Washington Public Hospital Districts, the Washington
State Medical Association, and the American Medical Association (collectively Medical
Associations) filed an amici curiae brief in support of SCH’s claimed quality improvement
committee exemption to the PRA. The Medical Associations assert the critical importance of
confidentiality in the quality improvement process and argue for broad protection of
communications related to the process. Finally, the Stritmatter Firm moved to file an amicus
curiae brief in support of KING 5’s arguments for broad public disclosure. A commissioner of this
court referred the motion to the panel for consideration. We note that the parties have filed
responses to the motion and grant the Stritmatter Firm’s motion to file the amicus brief. The
Stritmatter Firm filed a class action lawsuit against SCH on behalf of multiple families of children
who contracted aspergillus infections after medical procedures at SCH. All but one of the six
named class representatives died after contracting aspergillus infections at SCH. The Stritmatter
Firm argues disclosure of the records at issue is in the public’s interest, and public disclosure of
the documents will prevent further harm to potential patients and doctors as well as the families
and children already affected by the aspergillus outbreaks at SCH.

3
No. 81175-4-I (Consol. with No. 81295-5-I)/4

its patients that is expressly protected from public disclosure under the PRA and

patient privacy laws.” KCPH told SCH that it would release the unredacted

documents unless SCH reached an agreement with KING 5 or obtained an order

from the court enjoining release of the exempt information. SCH and KING 5

could not reach an agreement on how to redact the records.

In October 2019, SCH filed a complaint for declaratory judgment and

injunctive relief to stop KCPH from releasing the remaining unredacted records.

SCH also named defendant KING 5 as a “potentially interested party.” Soon

after, SCH filed a motion for preliminary injunction to prevent disclosure pending

final resolution of its lawsuit, arguing that the records contain protected

information and documents exempt from public disclosure. The court granted the

preliminary injunction, finding that the records were exempt from disclosure

under the HCIA, HIPAA, and the quality improvement (QI) exemption in the PRA.

On November 7, 2019, the court enjoined KCPH from disclosing the remaining

records except in the redacted form proposed by SCH.3 KING 5 moved for

reconsideration, which the trial court treated as a motion to rescind or withdraw

the preliminary injunction. The court set a briefing schedule and hearing date for

KING 5’s motion.

Throughout the proceedings, KCPH continued to search its database for

records related to SCH aspergillus infections. After the preliminary injunction

issued, KCPH produced more responsive records and sent them to SCH for

review. Among those records, SCH found documents it believed should be

3
The court also ordered SCH to remove several redactions of information that the court
determined was not exempt from disclosure.

4
No. 81175-4-I (Consol. with No. 81295-5-I)/5

exempt from disclosure. On February 14, 2020, SCH moved to amend the

November 7, 2019 preliminary injunction to prevent disclosure of the new

records.

During this time, DOH also received PRA requests for records related to

aspergillus mold infections at SCH. DOH notified SCH that in February 2020, it

intended to release over 800 pages of records subject to redaction for only

identifiable patient health care information. SCH argued that 117 pages of those

records, many of them duplicative of the records held by KCPH, should be

exempt from disclosure. On February 14, 2020, the same day SCH filed the

preliminary injunction to prevent the release of KCPH’s records, it also filed an

amended complaint to add DOH as a defendant. SCH sought declaratory

judgment and injunctive relief enjoining DOH from releasing its records. SCH

then filed a motion for a temporary restraining order (TRO), seeking to prevent

DOH’s imminent release of their records.

The court set a hearing date of February 28, 2020 on SCH’s motion for a

TRO as to DOH, SCH’s motion to amend the November 2019 preliminary

injunction as to KCPH, and KING 5’s motion to rescind or withdraw the

preliminary injunction. After hearing oral argument, the court denied the motion

for a TRO, finding that new evidence refuted SCH’s claim that the disputed

records are exempt as part of the QI process. The court also denied SCH’s

motion to amend the preliminary injunction. It then granted KING 5’s motion to

rescind the previously issued preliminary injunction against KCPH. The court

entered an order on March 23, 2020, releasing the 125 pages of records still held

5
No. 81175-4-I (Consol. with No. 81295-5-I)/6

by KCPH under the injunction, another 595 pages produced by KCPH after the

injunction issued, and the 117 pages of documents held by DOH. The court

stayed enforcement of its March 23 order pending appeal.

SCH filed a notice for discretionary review of the trial court’s order denying

its motion for a TRO related to the DOH records. A commissioner of this court

granted a temporary injunction to preserve the status quo. The commissioner

accepted review on the issue of whether HIPAA deidentification guidelines apply

when redacting records to protect patient information under the HCIA.4 SCH

then filed an appeal of the court’s order denying its motion to amend their

preliminary injunction against KCPH and granting KING 5’s motion to rescind the

original preliminary injunction. The commissioner consolidated the appeal and

discretionary review as a single appeal under RAP 2.2(a)(3) with an accelerated

briefing schedule.

ANALYSIS

“The PRA is a ‘strongly worded mandate for broad disclosure of public

records.’ ” Cornu-Labat v. Hosp. Dist. No. 2 Grant County, 177 Wn.2d 221, 229,

298 P.3d 741 (2013) (quoting Hearst Corp. v. Hoppe, 90 Wn.2d 123, 127, 580

P.2d 246 (1978)). The act requires state and local agencies to disclose public

records responsive to requests unless a specific exemption applies. Cornu-

Labat, 177 Wn.2d at 229; RCW 42.56.070(1). In keeping with its mandate, “the

PRA explicitly declares its disclosure provisions ‘shall be liberally construed and

4
A few days after the commissioner granted discretionary review, the trial court entered
an amended order requiring KCPH to redact health care information from its records. The
superior court had no authority to enter the order after this court accepted review. RAP 6.1,
7.2(a). The parties did not seek permission from this court under RAP 7.2(e) to enter the revised
order, so we do not consider it on appeal.

6
No. 81175-4-I (Consol. with No. 81295-5-I)/7

its exemptions narrowly construed.’ ” Cornu-Labat, 177 Wn.2d at 229 (quoting

RCW 42.56.030).

Under the PRA, a party may seek to enjoin release of public records if

“examination would clearly not be in the public interest and would substantially

and irreparably damage any person, or would substantially and irreparably

damage vital governmental functions.” RCW 42.56.540. However, “[c]ourts shall

take into account the policy of [the PRA] that free and open examination of public

records is in the public interest, even though such examination may cause

inconvenience or embarrassment to public officials or others.” RCW

42.56.550(3).

In considering an injunction, a trial court must conduct two separate

inquiries. Lyft, Inc. v. City of Seattle, 190 Wn.2d 769, 789, 418 P.3d 102 (2018).

First, the court must determine whether the records are exempt under a provision

of the PRA. Lyft, 190 Wn.2d at 790. If a PRA exemption applies, the court

examines whether disclosure is against public interest and would cause

substantial and irreparable damage. Lyft, 190 Wn.2d at 791. The trial court must

find both inquiries are satisfied before issuing an injunction. Lyft, 190 Wn.2d at

791.

The party seeking an injunction has the burden of proof. Lyft, 190 Wn.2d

at 791. For a preliminary injunction or TRO, the trial court need not resolve the

merits of the issues. Seiu Healthcare 775NW v. Dep’t of Soc. & Health Servs.,

193 Wn. App. 377, 392, 377 P.3d 214 (2016). Instead, it considers only the

likelihood that the moving party will prevail at trial. Seiu Healthcare, 193 Wn.

7
No. 81175-4-I (Consol. with No. 81295-5-I)/8

App. at 392-93. We review de novo the issuance of an injunction under the PRA.

Lyft, 190 Wn.2d at 791.

QI Committee Exemption

SCH argues the KCPH and DOH records should be exempt from

disclosure under the QI committee exemption to the PRA.5 Respondents claim

the exemption does not apply to the documents because they were not created

specifically for a QI committee. We agree with the respondents.

Every hospital must maintain a QI program, including a QI committee with

“the responsibility to review the services rendered in the hospital, both

retrospectively and prospectively, in order to improve the quality of medical care

of patients and to prevent medical malpractice.” RCW 70.41.200(1)(a); Cornu-

Labat, 177 Wn.2d at 235. The QI committee will

oversee and coordinate the quality improvement and medical
malpractice prevention program and shall ensure that information
gathered pursuant to the program is used to review and to revise
hospital policies and procedures.

RCW 70.41.200(1)(a).

Health care information and documents “created specifically for, and

collected and maintained by a quality improvement committee” under RCW

70.41.200, are exempt from disclosure under the PRA. RCW 42.56.360(1)(c);

see RCW 70.41.200(3).6 The QI committee exemption applies to “work product

5
The parties do not dispute that the records at issue are “public records” under RCW
42.56.010(3). The only issue on appeal is whether an exemption under the PRA prevents
disclosure.
6
RCW 70.41.200(3) also provides, in pertinent part, “Information and documents . . .
created specifically for, and collected and maintained by, a quality improvement committee are
not subject to review or disclosure.”

8
No. 81175-4-I (Consol. with No. 81295-5-I)/9

of [hospital] committees that ‘oversee and coordinate the quality improvement

and medical malpractice prevention program.’ ” Cornu-Labat, 177 Wn.2d at 236

(quoting RCW 70.41.200(1)(a)). This exception to the broad disclosure

requirements of the PRA allows hospitals to conduct internal reviews to maintain

quality health care. Cornu-Labat, 177 Wn.2d at 230. Otherwise, “external

access to committee investigations stifles candor and inhibits constructive

criticism thought necessary to effective quality review.” Anderson v. Breda, 103

Wn.2d 901, 905, 700 P.2d 737 (1985).

In construing the scope of RCW 70.41.200(3), our Supreme Court

recognized that “the majority of records a hospital creates might be somehow

related to the quality of care it provides,” and therefore, “[i]t is not necessarily the

case that all records documenting a hospital’s efforts to comply with the

statutorily mandated quality improvement program are privileged.” Fellows v.

Moynihan, 175 Wn.2d 641, 655, 285 P.3d 864 (2012). The requirement of RCW

70.41.200(3) that records “created specifically for, and collected and maintained

by, a quality improvement committee” are privileged serves as a legislative limit

on the protection and prevents a hospital from “funneling records through its

quality improvement committee” to prevent disclosure. Fellows, 175 Wn.2d at

655. To that end, the Supreme Court narrowly construed the phrase “created

specifically for” QI committees to include only “documents created as part of the

inner workings of the committee.” Lowy v. PeaceHealth, 174 Wn.2d 769, 787-88,

280 P.3d 1078 (2012) (citing RCW 70.41.200). The protection does not include

information that “goes into or comes out of the quality improvement committees.”

9
No. 81175-4-I (Consol. with No. 81295-5-I)/10

Lowy, 174 Wn.2d at 787. This narrow application ensures that the QI committee

protection “ ‘may not be used as a shield to obstruct proper discovery of

information generated outside review committee meetings.’ ” Fellows, 175

Wn.2d at 655 (quoting Coburn v. Seda, 101 Wn.2d 270, 277, 677 P.2d 173

(1984)).7

Here, SCH claims that several KCPH and DOH records relating to the

aspergillus infection investigations in 2018 and 2019 are exempt from disclosure

as part of their QI committee process. It argues that records of its e-mail

conversations with and among KCPH, DOH, and the CDC are exempt because

the agencies were acting as “consultants” to the QI committee’s investigation. In

support of its argument, SCH points to the declarations of SCH QI committee

member Dr. Danielle Zerr, explaining that the committee “regularly consults” with

experts from KCPH, CDC, and DOH as part of its investigations.

Dr. Zerr describes the QI process as often involving “a back-and-forth

exchange of ideas, information, suggestions, and recommendations” with

external agencies. She claims that the records at issue fall under the QI

committee exemption because they were generated as part of her conversations

with those agencies seeking “assistance in evaluating the issues, laboratory

testing, and to validate that [SCH]’s corrective actions were appropriate and

comprehensive” during the aspergillus investigations. She asserts that the

agencies knew that the conversations were protected under the QI exemption

7
Existing case law considers RCW 70.41.200 only in the context of protecting certain QI
committee records from discovery. Because we narrowly construe both the discovery privilege
and the PRA exemption in favor of disclosure, case law analysis of the statute’s scope is apt here
as well. See Fellows, 175 Wn.2d at 649; Lyft, 190 Wn.2d at 779.

10
No. 81175-4-I (Consol. with No. 81295-5-I)/11

because she labelled all of her communications with KCPH, CDC, and DOH as

“privileged and confidential.”

But the QI committee exemption does not apply to a record just because it

has Dr. Zerr’s label of “confidential and protected quality improvement

information per RCW 4.24.250 and 70.41.200.” The exemption applies to only

those records created specifically for and maintained by a QI committee. RCW

42.56.360(1)(c). Construed narrowly, only “documents created as part of the

inner workings of the committee” are exempt under the PRA. Lowy, 174 Wn.2d

at 787.

And SCH’s argument that the records are exempt because KCPH, DOH,

and the CDC were acting as consultants to the SCH QI committee is not

persuasive. KCPH, CDC, and DOH are not members of SCH’s QI committee.

Nor were the agencies knowingly consulting with the committee for QI purposes.

According to KCPH Health Officer Dr. Jeff Duchin, “[i]nformation shared at the

two-day July [2019] CDC site visit meeting and in subsequent telephone calls

were QI [related] in Children’s view but part of a public health investigation about

a notifiable condition to us at Public Health.” And KCPH medical epidemiologist

Dr. Meagan Kay stated that she did not recall being informed that

communications with SCH were part of the QI process. Rather, Dr. Kay believed

the discussions were part of KCPH’s investigation into the new cluster of

aspergillus infections in May 2019. Finally, during oral argument at the February

28, 2020 hearing, counsel for DOH told the trial court that DOH representatives

did not “believe they were part of the [SCH] QI process.” DOH counsel said,

11
No. 81175-4-I (Consol. with No. 81295-5-I)/12

“[T]he Department only has the authority to do those things outlined in the statute

or implied by statute. I don’t know of any statute that authorizes the Department

to serve . . . as a QI resource for hospitals.”

The record shows that DOH and KCPH were acting in their independent

investigatory and supervisory roles when communicating with SCH. They were

not acting on behalf of, or as consultants for, the SCH QI committee. While SCH

may have viewed the information as useful to its QI process, the communications

exchanged between SCH and the external agencies is information that “goes into

or comes out of” a QI committee rather than generated as “part of the inner

workings of the committee.” See Lowy, 174 Wn.2d at 787. The trial court did not

err in concluding that the QI committee exemption under RCW 42.56.360(1)(c)

does not protect the KCPH and DOH records from disclosure.

Infection Reporting Exemption

SCH also contends the infection reporting exemption under the PRA

applies to some of the KCPH and DOH records. It claims the exemption applies

because aspergillus surgical site infections are “health care-associated

infections,” triggering mandatory notification to the local health department under

the Washington Administrative Code.8 But the plain language of the PRA

exemption is limited in scope and does not apply to the KCPH or DOH

documents.

8
WAC 246-101-305(1)(a)(iv). Dr. Duchin of KCPH acknowledged the aspergillus
infections were a “notifiable condition” under WAC 246-101-305(1)(a)(iv).

12
No. 81175-4-I (Consol. with No. 81295-5-I)/13

Under the PRA, information and documents created specifically by a

hospital “for reporting of health care-associated infections under RCW 43.70.056”

are exempt from disclosure. RCW 42.56.360(1)(c). RCW 43.70.056(2)(a)

mandates that a hospital must collect data on health care-associated infections in

cases of “[c]entral line-associated bloodstream infection in all hospital inpatient

areas where patients normally reside at least twenty-four hours” and “[s]urgical

site infection for colon and abdominal hysterectomy procedures.” The exemption

does not apply to the aspergillus surgical site infections in this case.

HCIA and HIPAA

SCH asserts DOH and KCPH should redact their records to protect patient

privacy consistent with both the state and federal health care information statutes

because “Washington’s HCIA has adopted language directly mirroring HIPAA’s

statutory language and regulations.”9 Generally, HIPAA applies to only “covered

entit[ies].” See 45 C.F.R. §§ 160.103, .102(a), (b).10 KCPH agrees that it is a

“covered entity” under HIPAA and that the guidelines apply to its records.11 DOH

asserts that HIPAA does not apply to its disputed records but asks us to

conclude that the HCIA and HIPAA “are coextensive for purposes of disclosing

9
Compare RCW 70.02.050 (disclosure without patient’s authorization), and RCW
70.02.270 (prohibited use or disclosure of health care information), with 45 C.F.R. § 164.512
(uses and disclosure for which authorization is not required), and 45 C.F.R. § 164.502 (general
rules for use and disclosure of protected health information).
10
Under HIPAA, a “covered entity” is a health care plan, health care clearinghouse, or
certain health care providers. 45 C.F.R. §§ 160.103, .102(a), (b). As a health care provider, SCH
must comply with HIPAA regulations. 45 C.F.R. § 106.102(a).
11
KCPH provides no briefing on this issue, but during oral argument, counsel for KCPH
acknowledged that KCPH is a covered entity under HIPAA. KCPH is a hybrid entity but applies
HIPAA to its public health function because of its significant health care services.

13
No. 81175-4-I (Consol. with No. 81295-5-I)/14

health care information” to ensure that medical records are “deidentified in a

consistent manner, no matter who possesse[s] the information.”12

The PRA specifically calls for HCIA protections to “public inspection and

copying of health care information of patients.” RCW 42.56.360(2). The HCIA

recognizes that “[h]ealth care information is personal and sensitive information

that if improperly used or released may do significant harm to a patient’s interests

in privacy, health care, or other interests.” RCW 70.02.005(1). In keeping with

these interests, the HCIA prohibits health care providers from disclosing health

care information without written authorization from the patient. RCW

70.02.020(1).

The HCIA defines “health care information” as “any information, whether

oral or recorded in any form or medium, that identifies or can readily be

associated with the identity of a patient and directly relates to the patient’s health

care.” RCW 70.02.010(17). The broad mandate favoring disclosure under the

PRA requires an agency seeking exemption to “demonstrate that each patient’s

health care information is ‘readily associated’ with that patient in order to withhold

the health care information under RCW 70.02.010[(17)].” Prison Legal News,

Inc. v. Dep't of Corr., 154 Wn.2d 628, 645, 115 P.3d 316 (2005). Health care

information that “does not identify an individual and with respect to which there is

no reasonable basis to believe that the information can be used to identify an

12
DOH is a “hybrid entity” with both covered and noncovered functions. 45 C.F.R. §
164.103. Only a hybrid entity’s “designate[d] health care components” are subject to HIPAA
regulations. 45 C.F.R. §§ 164.103, .105. DOH has only one designated health care component,
and it is not involved with the SCH aspergillus investigations. As a result, HIPAA does not apply
to records held by DOH in this case.

14
No. 81175-4-I (Consol. with No. 81295-5-I)/15

individual” is “deidentified.” RCW 70.02.010(6). An agency can disclose

deidentified patient information without authorization because the information is

no longer a risk to patient privacy. See RCW 70.02.050(1)(b)(ii).

DOH redacted its records to remove information protected by the HCIA.

SCH argues, however, that DOH’s redactions do not adequately protect

unauthorized disclosure of health care information. For example, SCH (quoting

RCW 70.02.010(17)) points to documents that include detailed information about

patient health care and asserts that

due to the very small number of affected patients, the unique
clinical nature of their procedures and diagnoses, and the
significant media attention . . . , [SCH] has a reasonable basis to
believe such information can . . . “readily [be] associated with the
identity of” particular patients in violation of [patient health care
information] privacy laws.

To protect patient privacy, SCH advocates applying the more detailed

deidentification guidelines under HIPAA to the DOH records.

Like Washington’s law, HIPAA protects disclosure of patient health care

information. HIPAA defines “individually identifiable health information” as any

information “created or received by a health care provider, health plan, employer,

or health care clearinghouse” that relates to past, present, or future health care

and “identifies the individual” or where “there is a reasonable basis to believe that

the information can be used to identify the individual.” 42 U.S.C. § 1320d(6).

HIPAA also provides for deidentification of health information:

Health information that does not identify an individual and with
respect to which there is no reasonable basis to believe that the

15
No. 81175-4-I (Consol. with No. 81295-5-I)/16

information can be used to identify an individual is not individually
identifiable health information.

45 C.F.R. § 164.514(a). But unlike the HCIA, HIPAA establishes specific

standards for deidentification, including removal of “[a]ll elements of dates

(except year) for dates directly related to an individual, including birth date,

admission date, discharge date,” and “[a]ny other unique identifying number,

characteristic, or code.” 45 C.F.R. § 164.514(b)(2)(i)(C), (R).13

13
45 C.F.R. section 164.514(b) provides:
Implementation specifications: Requirements for deidentification of protected
health information. A covered entity may determine that health information is not
individually identifiable health information only if:
(1) A person with appropriate knowledge of and experience with
generally accepted statistical and scientific principles and methods for rendering
information not individually identifiable:
(i) Applying such principles and methods, determines that the risk is very
small that the information could be used, alone or in combination with other
reasonably available information, by an anticipated recipient to identify an
individual who is a subject of the information; and
(ii) Documents the methods and results of the analysis that justify such
determination; or
(2)(i) The following identifiers of the individual or of relatives, employers,
or household members of the individual, are removed:
(A) Names;
(B) All geographic subdivisions smaller than a State, including street
address, city, county, precinct, zip code, and their equivalent geocodes, except
for the initial three digits of a zip code if, according to the current publicly
available data from the Bureau of the Census:
(1) The geographic unit formed by combining all zip codes with the
same three initial digits contains more than 20,000 people; and
(2) The initial three digits of a zip code for all such geographic units
containing 20,000 or fewer people is changed to 000.
(C) All elements of dates (except year) for dates directly related to an
individual, including birth date, admission date, discharge date, date of death;
and all ages over 89 and all elements of dates (including year) indicative of such
age, except that such ages and elements may be aggregated into a single
category of age 90 or older;
(D) Telephone numbers;
(E) Fax numbers;
(F) Electronic mail addresses;
(G) Social security numbers;
(H) Medical record numbers;
(I) Health plan beneficiary numbers;
(J) Account numbers;
(K) Certificate/license numbers;
(L) Vehicle identifiers and serial numbers, including license plate
numbers;

16
No. 81175-4-I (Consol. with No. 81295-5-I)/17

SCH argues that the “state and federal prohibitions on disclosure should

be construed in the same fashion” because the HCIA “adopted language directly

mirroring HIPAA’s statutory language and regulations.” See Anfinson v. FedEx

Ground Package Sys., Inc., 174 Wn.2d 851, 868, 281 P.3d 289 (2012) (“At least

where there is no contrary legislative intent, when a state statute is ‘taken

substantially verbatim from [a] federal statute, it carries the same construction as

the federal law and the same interpretation as federal case law.’ ”)14 (quoting

State v. Bobic, 140 Wn.2d 250, 264, 996 P.2d 610 (2000)). But HIPAA enacted

its guidelines more than a decade before our legislature amended the HCIA to

include “deidentification” and our legislature chose not to include them in our

statute.15 “Where the legislature omits language from a statute, whether

intentionally or inadvertently, this court will not read into the statute the language

it believes was omitted.” Qwest Corp. v. City of Kent, 157 Wn.2d 545, 553, 139

P.3d 1091 (2006).

SCH and DOH also point to WAC 246-08-390 in support of their argument

that we apply HIPAA deidentification guidelines to patient records released by

(M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs);
(O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and
(R) Any other unique identifying number, characteristic, or code, except
as permitted by paragraph (c) of this section; and
(ii) The covered entity does not have actual knowledge that the
information could be used alone or in combination with other information to
identify an individual who is a subject of the information.
14
Alteration in original; internal quotation marks omitted.
15
Federal regulations enacted the concept of deidentification and standards to protect
privacy of individually identifiable health information as part of a HIPAA final rule in 2000. 65 Fed.
Reg. 82802 (Dec. 28, 2000). The Washington Legislature amended the HCIA to define
“deidentification” in 2013. LAWS OF 2013, ch. 200, § 1 (effective July 1, 2014).

17
No. 81175-4-I (Consol. with No. 81295-5-I)/18

DOH to ensure consistency under the HCIA. WAC 246-08-390 governs DOH’s

handling of health care information under the HCIA, including applying the HCIA

and PRA to public inspection and copying of health information. WAC 246-08-

390(6)(a). It provides:

Health information that identifies or can readily be associated with
the identity of a patient and directly relates to the patient’s health
care is not available for public inspection and copying. Health
information that is not individually identifiable is described as
“deidentified.”

WAC 246-08-390(6)(a)(i). The same provision gives DOH the option of applying

the HIPAA guidelines when deidentifying health care information:

The department may consider analogous federal standards for
deidentification of protected health information when determining if
deidentification of health information is possible.

WAC 246-08-390(6)(a)(iii). In other words, current rules and regulations give

DOH the discretion to apply the specific and robust HIPAA protections when

deidentifying health care information from records it intends to release for public

inspection. We decline the invitation by SCH and DOH to fill the “implementation

gap” between the HCIA and HIPAA by interpreting WAC 246-08-390(6)(a)(iii) as

a mandate because we cannot add words to a regulation where the plain

meaning is clear and unambiguous. Children’s Hosp. & Med. Ctr. v. Dep’t of

Health, 95 Wn. App. 858, 868-69, 975 P.2d 567 (1999).

We conclude that the trial court did not err in determining that the QI

committee and infection reporting exemptions under the PRA do not prevent

18
No. 81175-4-I (Consol. with No. 81295-5-I)/19

release of the KCPH or DOH records. But we remand for the trial court to ensure

that the records comply with the applicable patient privacy requirements.

Affirmed.

WE CONCUR:

19