(1) The legislature finds that public health data is critical to the department's ability to respond to emerging public health threats and chronic conditions affecting the public health and, therefore, intends that the department be fully informed about emerging public health threats and chronic conditions that may impact the health of Washington citizens.

(2) The department shall require hospitals with emergency departments to submit emergency department patient care information, which must be collected, maintained, analyzed, and disseminated by the department. The department shall also accept other data types submitted voluntarily as approved by the department. The data must be collected in a way that allows automated reporting by electronic transmission. Emergency departments submitting data must be able to obtain their data and aggregate regional and statewide data from the collection system within thirty minutes of submission of a query for the data once the data is available in the system. The department may, if deemed cost-effective and efficient, contract with a private entity for any or all parts of data collection, maintenance, analysis, and dissemination. The department or contractor shall include the following elements:

(a) A demonstrated ability to collect the data required by this section in a way that allows automated reporting by electronic transmission;

(b) An established data submission arrangement with the majority of emergency departments required to submit data pursuant to this section;

(c) The demonstrated ability to allow emergency departments submitting data to immediately obtain their own data and aggregate regional and statewide data and the department to immediately obtain any data within thirty minutes of submission of a query for data once the data is available in the system; and

(d) The capacity to work with existing emergency department data systems to minimize administrative reporting burden and costs.

(3) Data elements must be reported in conformance with a uniform reporting system established by the department in collaboration with representatives from emergency departments required to submit data pursuant to this section and in conformance with current or emerging national standards for reporting similar data. Data elements to be initially collected include, but are not limited to, data elements identifying facility information, limited patient identifiers, patient demographics, and encounter, clinical, and laboratory information. In order to ensure meaningful public health surveillance, after consulting with emergency departments required to submit data pursuant to this section, the department shall adopt rules including, but not limited to, data element and format requirements and time frames for reporting and addressing errors in submission. The rules adopted shall support alignment with current or emerging national standards for reporting similar data and minimization of administrative burden and costs.

(4) The department may require additional information from data providers only for the purposes of validating data received, verifying data accuracy, conducting surveillance of potential public health threats, and addressing potential public health threats.

(5) The data collected, maintained, and analyzed by the department must only be available for retrieval in original or processed form to public and private requestors pursuant to subsection (6) of this section and must be available within a reasonable period of time after the date of request, except that emergency departments submitting data pursuant to this section must have the ability to immediately obtain their own data and aggregate regional and statewide data within thirty minutes of submission of a query for data once the data is available in the system. The cost of retrieving their own data and aggregate regional and statewide data in standardized reports for state, local, tribal, federal officials and agencies, and health care facilities, and health care providers associated with the emergency departments submitting data pursuant to this section, must be funded through the agency's resources. The cost of retrieving data for individuals and organizations engaged in research or private use of data or reports must be funded by a fee schedule developed by the department that reflects the direct cost of retrieving the data or report in the requested form.

(6) The department must maintain the confidentiality of patient data it collects under subsection (2) of this section. Patient data collected by the department is health care information under chapter 70.02 RCW. Patient data that includes direct and indirect identifiers is not subject to public inspection and copying and the department may only release that data as allowed for in this section. Any agency that receives patient data under (a) or (b) of this subsection must also maintain the confidentiality of the data and may not release the data except as consistent with subsection (7)(b) of this section. The department may release the data as follows:

(a) Data that includes direct and indirect patient identifiers, as specifically defined in rule, may be released to:

(i)(A) Federal, Washington state, tribal, and local government agencies upon receipt of a signed data use agreement with the department;

(B) In the case of an emergent public health threat, the signed data use agreement requirement must be waived for public health authorities. The department may disclose only the minimum amount of information necessary, to the fewest number of people, for the least amount of time required to address the threat;

(ii) Researchers with approval of an institutional review board upon receipt of a signed confidentiality agreement with the department;

(b) Data that does not contain direct patient identifiers but may contain indirect patient identifiers may be released to agencies, institutional review board-approved researchers, and other persons upon receipt of a signed data use agreement with the department;

(c) Data that does not contain direct or indirect patient identifiers may be released on request.

(7) Recipients of data under subsection (6)(a) and (b) of this section must agree in a data use agreement, as applicable, at a minimum, to:

(a) Take steps to protect direct and indirect patient identifiers as described in the data use agreement; and

(b) Not redisclose the data except as authorized in their data use agreement consistent with the purpose of the agreement.

(8) Recipients of data under subsection (6)(b) and (c) of this section must not attempt to determine the identity of persons whose information is included in the data set or use the data in any manner that identifies individuals or their families.

(9) For the purposes of this section:

(a) "Direct patient identifier" means information that identifies a patient; and

(b) "Indirect patient identifier" means information that may identify a patient when combined with other information.

(10) The department may adopt rules necessary to carry out its responsibilities under this section. The department must consider national standards when adopting rules.