Seattle Children's Hospital v. King 5 ( 2020 )


Menu:
  •        IN THE COURT OF APPEALS OF THE STATE OF WASHINGTON
    SEATTLE CHILDREN’S HOSPITAL, a )                            No. 81175-4-I
    Washington nonprofit corporation,    )                      (Consolidated with No. 81295-5-I)
    )
    Appellant,   )                      DIVISION ONE
    )
    v.                  )
    )
    KING COUNTY, a Washington            )
    municipal corporation; WASHINGTON )
    STATE DEPARTMENT OF HEALTH; )                               UNPUBLISHED OPINION
    and KING BROADCASTING                )
    COMPANY and its affiliates, d/b/a    )
    KING 5, a Washington corporation,    )
    )
    Respondents. )
    BOWMAN, J. — Seattle Children’s Hospital (SCH) moved for a temporary
    restraining order against the Washington State Department of Health (DOH) and
    a preliminary injunction against King Broadcasting Company and its affiliates
    (KING 5) along with Seattle and King County Public Health (KCPH),1 seeking to
    prevent the release of documents related to aspergillus mold infections in
    surgical patients. The trial court ultimately denied the motions and ordered
    release of the records. SCH appeals, arguing the documents fall under the
    quality improvement and infection reporting exemptions to the Public Records
    1
    KCPH did not file briefing or participate in this appeal.
    Citations and pin cites are based on the Westlaw online version of the cited material.
    No. 81175-4-I (Consol. with No. 81295-5-I)/2
    Act (PRA), chapter 42.56 RCW. SCH and DOH also urge us to apply the federal
    Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-
    191, 
    110 Stat. 1936
    , deidentification guidelines to any released patient records to
    ensure medical confidentiality under Washington’s Uniform Health Care
    Information Act (HCIA), chapter 70.02 RCW. We conclude that neither the
    quality improvement nor the infection reporting exemption prevents release of the
    records in this case. And we decline to impose judicially the HIPAA guidelines
    for deidentification of patient information under the HCIA. We affirm denial of the
    temporary restraining order and preliminary injunction but remand to the trial
    court to ensure that all records comply with the required patient privacy
    protections before they are released.
    FACTS
    Since 2001, SCH has experienced recurring infections in surgical patients
    caused by aspergillus mold. In June 2018, SCH reported to KCPH that two more
    patients developed aspergillus surgical site infections related to procedures
    performed at the hospital. KCPH assisted SCH with its investigation into the
    outbreak through August 2018. In May 2019, KCPH learned that SCH closed
    their operating rooms because of new aspergillus cases. KCPH contacted the
    Centers for Disease Control and Prevention (CDC) to help SCH investigate the
    new outbreak. As part of the investigation, KCPH, DOH, and the CDC conducted
    a site visit to SCH in July 2019.
    2
    No. 81175-4-I (Consol. with No. 81295-5-I)/3
    In August 2019, a KING 5 news reporter made a PRA request to KCPH for
    records related to the SCH aspergillus infections.2 KCPH compiled the records,
    reviewed them, and determined no PRA exemptions protected the records from
    disclosure. The more than 4,700 pages of records generally consist of e-mail
    exchanges between SCH, KCPH, DOH, and the CDC discussing potential
    sources of aspergillus infection, sample testing for the presence of aspergillus
    mold, procedures to prevent future aspergillus infection of patients, and follow-up
    to monitor implementation of those procedures and any new aspergillus
    outbreaks. The records also include documents generated or shared in the
    course of discussions among the agencies, including during the SCH site visit.
    KCPH notified SCH of the KING 5 request and told SCH it intended to
    release the records “unredacted.” SCH agreed to the release of most of the
    records, objecting to only those it argued “contain information of the hospital and
    2
    DOH and KCPH received similar requests from several other media outlets, as well as
    the law firm Stritmatter, Kessler, Koehler, Moore (Stritmatter Firm). These entities are not named
    as parties on appeal, but several amici curiae briefs represent their interests. The Washington
    Coalition for Open Government and the Washington Newspaper Publishers Association filed an
    amici curiae brief in support of affirming the trial court’s orders. Their brief emphasizes the
    public’s compelling interest in access to information about the serious health risk associated with
    the recurring aspergillus infections at SCH. The brief also argues for limited redactions of health
    care records to only information that may lead to the identity of patients. The Washington State
    Hospital Association, the Association of Washington Public Hospital Districts, the Washington
    State Medical Association, and the American Medical Association (collectively Medical
    Associations) filed an amici curiae brief in support of SCH’s claimed quality improvement
    committee exemption to the PRA. The Medical Associations assert the critical importance of
    confidentiality in the quality improvement process and argue for broad protection of
    communications related to the process. Finally, the Stritmatter Firm moved to file an amicus
    curiae brief in support of KING 5’s arguments for broad public disclosure. A commissioner of this
    court referred the motion to the panel for consideration. We note that the parties have filed
    responses to the motion and grant the Stritmatter Firm’s motion to file the amicus brief. The
    Stritmatter Firm filed a class action lawsuit against SCH on behalf of multiple families of children
    who contracted aspergillus infections after medical procedures at SCH. All but one of the six
    named class representatives died after contracting aspergillus infections at SCH. The Stritmatter
    Firm argues disclosure of the records at issue is in the public’s interest, and public disclosure of
    the documents will prevent further harm to potential patients and doctors as well as the families
    and children already affected by the aspergillus outbreaks at SCH.
    3
    No. 81175-4-I (Consol. with No. 81295-5-I)/4
    its patients that is expressly protected from public disclosure under the PRA and
    patient privacy laws.” KCPH told SCH that it would release the unredacted
    documents unless SCH reached an agreement with KING 5 or obtained an order
    from the court enjoining release of the exempt information. SCH and KING 5
    could not reach an agreement on how to redact the records.
    In October 2019, SCH filed a complaint for declaratory judgment and
    injunctive relief to stop KCPH from releasing the remaining unredacted records.
    SCH also named defendant KING 5 as a “potentially interested party.” Soon
    after, SCH filed a motion for preliminary injunction to prevent disclosure pending
    final resolution of its lawsuit, arguing that the records contain protected
    information and documents exempt from public disclosure. The court granted the
    preliminary injunction, finding that the records were exempt from disclosure
    under the HCIA, HIPAA, and the quality improvement (QI) exemption in the PRA.
    On November 7, 2019, the court enjoined KCPH from disclosing the remaining
    records except in the redacted form proposed by SCH.3 KING 5 moved for
    reconsideration, which the trial court treated as a motion to rescind or withdraw
    the preliminary injunction. The court set a briefing schedule and hearing date for
    KING 5’s motion.
    Throughout the proceedings, KCPH continued to search its database for
    records related to SCH aspergillus infections. After the preliminary injunction
    issued, KCPH produced more responsive records and sent them to SCH for
    review. Among those records, SCH found documents it believed should be
    3
    The court also ordered SCH to remove several redactions of information that the court
    determined was not exempt from disclosure.
    4
    No. 81175-4-I (Consol. with No. 81295-5-I)/5
    exempt from disclosure. On February 14, 2020, SCH moved to amend the
    November 7, 2019 preliminary injunction to prevent disclosure of the new
    records.
    During this time, DOH also received PRA requests for records related to
    aspergillus mold infections at SCH. DOH notified SCH that in February 2020, it
    intended to release over 800 pages of records subject to redaction for only
    identifiable patient health care information. SCH argued that 117 pages of those
    records, many of them duplicative of the records held by KCPH, should be
    exempt from disclosure. On February 14, 2020, the same day SCH filed the
    preliminary injunction to prevent the release of KCPH’s records, it also filed an
    amended complaint to add DOH as a defendant. SCH sought declaratory
    judgment and injunctive relief enjoining DOH from releasing its records. SCH
    then filed a motion for a temporary restraining order (TRO), seeking to prevent
    DOH’s imminent release of their records.
    The court set a hearing date of February 28, 2020 on SCH’s motion for a
    TRO as to DOH, SCH’s motion to amend the November 2019 preliminary
    injunction as to KCPH, and KING 5’s motion to rescind or withdraw the
    preliminary injunction. After hearing oral argument, the court denied the motion
    for a TRO, finding that new evidence refuted SCH’s claim that the disputed
    records are exempt as part of the QI process. The court also denied SCH’s
    motion to amend the preliminary injunction. It then granted KING 5’s motion to
    rescind the previously issued preliminary injunction against KCPH. The court
    entered an order on March 23, 2020, releasing the 125 pages of records still held
    5
    No. 81175-4-I (Consol. with No. 81295-5-I)/6
    by KCPH under the injunction, another 595 pages produced by KCPH after the
    injunction issued, and the 117 pages of documents held by DOH. The court
    stayed enforcement of its March 23 order pending appeal.
    SCH filed a notice for discretionary review of the trial court’s order denying
    its motion for a TRO related to the DOH records. A commissioner of this court
    granted a temporary injunction to preserve the status quo. The commissioner
    accepted review on the issue of whether HIPAA deidentification guidelines apply
    when redacting records to protect patient information under the HCIA.4 SCH
    then filed an appeal of the court’s order denying its motion to amend their
    preliminary injunction against KCPH and granting KING 5’s motion to rescind the
    original preliminary injunction. The commissioner consolidated the appeal and
    discretionary review as a single appeal under RAP 2.2(a)(3) with an accelerated
    briefing schedule.
    ANALYSIS
    “The PRA is a ‘strongly worded mandate for broad disclosure of public
    records.’ ” Cornu-Labat v. Hosp. Dist. No. 2 Grant County, 
    177 Wn.2d 221
    , 229,
    
    298 P.3d 741
     (2013) (quoting Hearst Corp. v. Hoppe, 
    90 Wn.2d 123
    , 127, 
    580 P.2d 246
     (1978)). The act requires state and local agencies to disclose public
    records responsive to requests unless a specific exemption applies. Cornu-
    Labat, 
    177 Wn.2d at 229
    ; RCW 42.56.070(1). In keeping with its mandate, “the
    PRA explicitly declares its disclosure provisions ‘shall be liberally construed and
    4
    A few days after the commissioner granted discretionary review, the trial court entered
    an amended order requiring KCPH to redact health care information from its records. The
    superior court had no authority to enter the order after this court accepted review. RAP 6.1,
    7.2(a). The parties did not seek permission from this court under RAP 7.2(e) to enter the revised
    order, so we do not consider it on appeal.
    6
    No. 81175-4-I (Consol. with No. 81295-5-I)/7
    its exemptions narrowly construed.’ ” Cornu-Labat, 
    177 Wn.2d at 229
     (quoting
    RCW 42.56.030).
    Under the PRA, a party may seek to enjoin release of public records if
    “examination would clearly not be in the public interest and would substantially
    and irreparably damage any person, or would substantially and irreparably
    damage vital governmental functions.” RCW 42.56.540. However, “[c]ourts shall
    take into account the policy of [the PRA] that free and open examination of public
    records is in the public interest, even though such examination may cause
    inconvenience or embarrassment to public officials or others.” RCW
    42.56.550(3).
    In considering an injunction, a trial court must conduct two separate
    inquiries. Lyft, Inc. v. City of Seattle, 
    190 Wn.2d 769
    , 789, 
    418 P.3d 102
     (2018).
    First, the court must determine whether the records are exempt under a provision
    of the PRA. Lyft, 190 Wn.2d at 790. If a PRA exemption applies, the court
    examines whether disclosure is against public interest and would cause
    substantial and irreparable damage. Lyft, 190 Wn.2d at 791. The trial court must
    find both inquiries are satisfied before issuing an injunction. Lyft, 190 Wn.2d at
    791.
    The party seeking an injunction has the burden of proof. Lyft, 190 Wn.2d
    at 791. For a preliminary injunction or TRO, the trial court need not resolve the
    merits of the issues. Seiu Healthcare 775NW v. Dep’t of Soc. & Health Servs.,
    
    193 Wn. App. 377
    , 392, 
    377 P.3d 214
     (2016). Instead, it considers only the
    likelihood that the moving party will prevail at trial. Seiu Healthcare, 
    193 Wn.
                                7
    No. 81175-4-I (Consol. with No. 81295-5-I)/8
    App. at 392-93. We review de novo the issuance of an injunction under the PRA.
    Lyft, 190 Wn.2d at 791.
    QI Committee Exemption
    SCH argues the KCPH and DOH records should be exempt from
    disclosure under the QI committee exemption to the PRA.5 Respondents claim
    the exemption does not apply to the documents because they were not created
    specifically for a QI committee. We agree with the respondents.
    Every hospital must maintain a QI program, including a QI committee with
    “the responsibility to review the services rendered in the hospital, both
    retrospectively and prospectively, in order to improve the quality of medical care
    of patients and to prevent medical malpractice.” RCW 70.41.200(1)(a); Cornu-
    Labat, 
    177 Wn.2d at 235
    . The QI committee will
    oversee and coordinate the quality improvement and medical
    malpractice prevention program and shall ensure that information
    gathered pursuant to the program is used to review and to revise
    hospital policies and procedures.
    RCW 70.41.200(1)(a).
    Health care information and documents “created specifically for, and
    collected and maintained by a quality improvement committee” under RCW
    70.41.200, are exempt from disclosure under the PRA. RCW 42.56.360(1)(c);
    see RCW 70.41.200(3).6 The QI committee exemption applies to “work product
    5
    The parties do not dispute that the records at issue are “public records” under RCW
    42.56.010(3). The only issue on appeal is whether an exemption under the PRA prevents
    disclosure.
    6
    RCW 70.41.200(3) also provides, in pertinent part, “Information and documents . . .
    created specifically for, and collected and maintained by, a quality improvement committee are
    not subject to review or disclosure.”
    8
    No. 81175-4-I (Consol. with No. 81295-5-I)/9
    of [hospital] committees that ‘oversee and coordinate the quality improvement
    and medical malpractice prevention program.’ ” Cornu-Labat, 
    177 Wn.2d at 236
    (quoting RCW 70.41.200(1)(a)). This exception to the broad disclosure
    requirements of the PRA allows hospitals to conduct internal reviews to maintain
    quality health care. Cornu-Labat, 
    177 Wn.2d at 230
    . Otherwise, “external
    access to committee investigations stifles candor and inhibits constructive
    criticism thought necessary to effective quality review.” Anderson v. Breda, 
    103 Wn.2d 901
    , 905, 
    700 P.2d 737
     (1985).
    In construing the scope of RCW 70.41.200(3), our Supreme Court
    recognized that “the majority of records a hospital creates might be somehow
    related to the quality of care it provides,” and therefore, “[i]t is not necessarily the
    case that all records documenting a hospital’s efforts to comply with the
    statutorily mandated quality improvement program are privileged.” Fellows v.
    Moynihan, 
    175 Wn.2d 641
    , 655, 
    285 P.3d 864
     (2012). The requirement of RCW
    70.41.200(3) that records “created specifically for, and collected and maintained
    by, a quality improvement committee” are privileged serves as a legislative limit
    on the protection and prevents a hospital from “funneling records through its
    quality improvement committee” to prevent disclosure. Fellows, 
    175 Wn.2d at 655
    . To that end, the Supreme Court narrowly construed the phrase “created
    specifically for” QI committees to include only “documents created as part of the
    inner workings of the committee.” Lowy v. PeaceHealth, 
    174 Wn.2d 769
    , 787-88,
    
    280 P.3d 1078
     (2012) (citing RCW 70.41.200). The protection does not include
    information that “goes into or comes out of the quality improvement committees.”
    9
    No. 81175-4-I (Consol. with No. 81295-5-I)/10
    Lowy, 
    174 Wn.2d at 787
    . This narrow application ensures that the QI committee
    protection “ ‘may not be used as a shield to obstruct proper discovery of
    information generated outside review committee meetings.’ ” Fellows, 
    175 Wn.2d at 655
     (quoting Coburn v. Seda, 
    101 Wn.2d 270
    , 277, 
    677 P.2d 173
    (1984)).7
    Here, SCH claims that several KCPH and DOH records relating to the
    aspergillus infection investigations in 2018 and 2019 are exempt from disclosure
    as part of their QI committee process. It argues that records of its e-mail
    conversations with and among KCPH, DOH, and the CDC are exempt because
    the agencies were acting as “consultants” to the QI committee’s investigation. In
    support of its argument, SCH points to the declarations of SCH QI committee
    member Dr. Danielle Zerr, explaining that the committee “regularly consults” with
    experts from KCPH, CDC, and DOH as part of its investigations.
    Dr. Zerr describes the QI process as often involving “a back-and-forth
    exchange of ideas, information, suggestions, and recommendations” with
    external agencies. She claims that the records at issue fall under the QI
    committee exemption because they were generated as part of her conversations
    with those agencies seeking “assistance in evaluating the issues, laboratory
    testing, and to validate that [SCH]’s corrective actions were appropriate and
    comprehensive” during the aspergillus investigations. She asserts that the
    agencies knew that the conversations were protected under the QI exemption
    7
    Existing case law considers RCW 70.41.200 only in the context of protecting certain QI
    committee records from discovery. Because we narrowly construe both the discovery privilege
    and the PRA exemption in favor of disclosure, case law analysis of the statute’s scope is apt here
    as well. See Fellows, 
    175 Wn.2d at 649
    ; Lyft, 190 Wn.2d at 779.
    10
    No. 81175-4-I (Consol. with No. 81295-5-I)/11
    because she labelled all of her communications with KCPH, CDC, and DOH as
    “privileged and confidential.”
    But the QI committee exemption does not apply to a record just because it
    has Dr. Zerr’s label of “confidential and protected quality improvement
    information per RCW 4.24.250 and 70.41.200.” The exemption applies to only
    those records created specifically for and maintained by a QI committee. RCW
    42.56.360(1)(c). Construed narrowly, only “documents created as part of the
    inner workings of the committee” are exempt under the PRA. Lowy, 
    174 Wn.2d at 787
    .
    And SCH’s argument that the records are exempt because KCPH, DOH,
    and the CDC were acting as consultants to the SCH QI committee is not
    persuasive. KCPH, CDC, and DOH are not members of SCH’s QI committee.
    Nor were the agencies knowingly consulting with the committee for QI purposes.
    According to KCPH Health Officer Dr. Jeff Duchin, “[i]nformation shared at the
    two-day July [2019] CDC site visit meeting and in subsequent telephone calls
    were QI [related] in Children’s view but part of a public health investigation about
    a notifiable condition to us at Public Health.” And KCPH medical epidemiologist
    Dr. Meagan Kay stated that she did not recall being informed that
    communications with SCH were part of the QI process. Rather, Dr. Kay believed
    the discussions were part of KCPH’s investigation into the new cluster of
    aspergillus infections in May 2019. Finally, during oral argument at the February
    28, 2020 hearing, counsel for DOH told the trial court that DOH representatives
    did not “believe they were part of the [SCH] QI process.” DOH counsel said,
    11
    No. 81175-4-I (Consol. with No. 81295-5-I)/12
    “[T]he Department only has the authority to do those things outlined in the statute
    or implied by statute. I don’t know of any statute that authorizes the Department
    to serve . . . as a QI resource for hospitals.”
    The record shows that DOH and KCPH were acting in their independent
    investigatory and supervisory roles when communicating with SCH. They were
    not acting on behalf of, or as consultants for, the SCH QI committee. While SCH
    may have viewed the information as useful to its QI process, the communications
    exchanged between SCH and the external agencies is information that “goes into
    or comes out of” a QI committee rather than generated as “part of the inner
    workings of the committee.” See Lowy, 
    174 Wn.2d at 787
    . The trial court did not
    err in concluding that the QI committee exemption under RCW 42.56.360(1)(c)
    does not protect the KCPH and DOH records from disclosure.
    Infection Reporting Exemption
    SCH also contends the infection reporting exemption under the PRA
    applies to some of the KCPH and DOH records. It claims the exemption applies
    because aspergillus surgical site infections are “health care-associated
    infections,” triggering mandatory notification to the local health department under
    the Washington Administrative Code.8 But the plain language of the PRA
    exemption is limited in scope and does not apply to the KCPH or DOH
    documents.
    8
    WAC 246-101-305(1)(a)(iv). Dr. Duchin of KCPH acknowledged the aspergillus
    infections were a “notifiable condition” under WAC 246-101-305(1)(a)(iv).
    12
    No. 81175-4-I (Consol. with No. 81295-5-I)/13
    Under the PRA, information and documents created specifically by a
    hospital “for reporting of health care-associated infections under RCW 43.70.056”
    are exempt from disclosure. RCW 42.56.360(1)(c). RCW 43.70.056(2)(a)
    mandates that a hospital must collect data on health care-associated infections in
    cases of “[c]entral line-associated bloodstream infection in all hospital inpatient
    areas where patients normally reside at least twenty-four hours” and “[s]urgical
    site infection for colon and abdominal hysterectomy procedures.” The exemption
    does not apply to the aspergillus surgical site infections in this case.
    HCIA and HIPAA
    SCH asserts DOH and KCPH should redact their records to protect patient
    privacy consistent with both the state and federal health care information statutes
    because “Washington’s HCIA has adopted language directly mirroring HIPAA’s
    statutory language and regulations.”9 Generally, HIPAA applies to only “covered
    entit[ies].” See 
    45 C.F.R. §§ 160.103
    , .102(a), (b).10 KCPH agrees that it is a
    “covered entity” under HIPAA and that the guidelines apply to its records.11 DOH
    asserts that HIPAA does not apply to its disputed records but asks us to
    conclude that the HCIA and HIPAA “are coextensive for purposes of disclosing
    9
    Compare RCW 70.02.050 (disclosure without patient’s authorization), and RCW
    70.02.270 (prohibited use or disclosure of health care information), with 
    45 C.F.R. § 164.512
    (uses and disclosure for which authorization is not required), and 
    45 C.F.R. § 164.502
     (general
    rules for use and disclosure of protected health information).
    10
    Under HIPAA, a “covered entity” is a health care plan, health care clearinghouse, or
    certain health care providers. 
    45 C.F.R. §§ 160.103
    , .102(a), (b). As a health care provider, SCH
    must comply with HIPAA regulations. 
    45 C.F.R. § 106.102
    (a).
    11
    KCPH provides no briefing on this issue, but during oral argument, counsel for KCPH
    acknowledged that KCPH is a covered entity under HIPAA. KCPH is a hybrid entity but applies
    HIPAA to its public health function because of its significant health care services.
    13
    No. 81175-4-I (Consol. with No. 81295-5-I)/14
    health care information” to ensure that medical records are “deidentified in a
    consistent manner, no matter who possesse[s] the information.”12
    The PRA specifically calls for HCIA protections to “public inspection and
    copying of health care information of patients.” RCW 42.56.360(2). The HCIA
    recognizes that “[h]ealth care information is personal and sensitive information
    that if improperly used or released may do significant harm to a patient’s interests
    in privacy, health care, or other interests.” RCW 70.02.005(1). In keeping with
    these interests, the HCIA prohibits health care providers from disclosing health
    care information without written authorization from the patient. RCW
    70.02.020(1).
    The HCIA defines “health care information” as “any information, whether
    oral or recorded in any form or medium, that identifies or can readily be
    associated with the identity of a patient and directly relates to the patient’s health
    care.” RCW 70.02.010(17). The broad mandate favoring disclosure under the
    PRA requires an agency seeking exemption to “demonstrate that each patient’s
    health care information is ‘readily associated’ with that patient in order to withhold
    the health care information under RCW 70.02.010[(17)].” Prison Legal News,
    Inc. v. Dep't of Corr., 
    154 Wn.2d 628
    , 645, 
    115 P.3d 316
     (2005). Health care
    information that “does not identify an individual and with respect to which there is
    no reasonable basis to believe that the information can be used to identify an
    12
    DOH is a “hybrid entity” with both covered and noncovered functions. 
    45 C.F.R. § 164.103
    . Only a hybrid entity’s “designate[d] health care components” are subject to HIPAA
    regulations. 
    45 C.F.R. §§ 164.103
    , .105. DOH has only one designated health care component,
    and it is not involved with the SCH aspergillus investigations. As a result, HIPAA does not apply
    to records held by DOH in this case.
    14
    No. 81175-4-I (Consol. with No. 81295-5-I)/15
    individual” is “deidentified.” RCW 70.02.010(6). An agency can disclose
    deidentified patient information without authorization because the information is
    no longer a risk to patient privacy. See RCW 70.02.050(1)(b)(ii).
    DOH redacted its records to remove information protected by the HCIA.
    SCH argues, however, that DOH’s redactions do not adequately protect
    unauthorized disclosure of health care information. For example, SCH (quoting
    RCW 70.02.010(17)) points to documents that include detailed information about
    patient health care and asserts that
    due to the very small number of affected patients, the unique
    clinical nature of their procedures and diagnoses, and the
    significant media attention . . . , [SCH] has a reasonable basis to
    believe such information can . . . “readily [be] associated with the
    identity of” particular patients in violation of [patient health care
    information] privacy laws.
    To protect patient privacy, SCH advocates applying the more detailed
    deidentification guidelines under HIPAA to the DOH records.
    Like Washington’s law, HIPAA protects disclosure of patient health care
    information. HIPAA defines “individually identifiable health information” as any
    information “created or received by a health care provider, health plan, employer,
    or health care clearinghouse” that relates to past, present, or future health care
    and “identifies the individual” or where “there is a reasonable basis to believe that
    the information can be used to identify the individual.” 42 U.S.C. § 1320d(6).
    HIPAA also provides for deidentification of health information:
    Health information that does not identify an individual and with
    respect to which there is no reasonable basis to believe that the
    15
    No. 81175-4-I (Consol. with No. 81295-5-I)/16
    information can be used to identify an individual is not individually
    identifiable health information.
    
    45 C.F.R. § 164.514
    (a). But unlike the HCIA, HIPAA establishes specific
    standards for deidentification, including removal of “[a]ll elements of dates
    (except year) for dates directly related to an individual, including birth date,
    admission date, discharge date,” and “[a]ny other unique identifying number,
    characteristic, or code.” 
    45 C.F.R. § 164.514
    (b)(2)(i)(C), (R).13
    13
    45 C.F.R. section 164.514(b) provides:
    Implementation specifications: Requirements for deidentification of protected
    health information. A covered entity may determine that health information is not
    individually identifiable health information only if:
    (1) A person with appropriate knowledge of and experience with
    generally accepted statistical and scientific principles and methods for rendering
    information not individually identifiable:
    (i) Applying such principles and methods, determines that the risk is very
    small that the information could be used, alone or in combination with other
    reasonably available information, by an anticipated recipient to identify an
    individual who is a subject of the information; and
    (ii) Documents the methods and results of the analysis that justify such
    determination; or
    (2)(i) The following identifiers of the individual or of relatives, employers,
    or household members of the individual, are removed:
    (A) Names;
    (B) All geographic subdivisions smaller than a State, including street
    address, city, county, precinct, zip code, and their equivalent geocodes, except
    for the initial three digits of a zip code if, according to the current publicly
    available data from the Bureau of the Census:
    (1) The geographic unit formed by combining all zip codes with the
    same three initial digits contains more than 20,000 people; and
    (2) The initial three digits of a zip code for all such geographic units
    containing 20,000 or fewer people is changed to 000.
    (C) All elements of dates (except year) for dates directly related to an
    individual, including birth date, admission date, discharge date, date of death;
    and all ages over 89 and all elements of dates (including year) indicative of such
    age, except that such ages and elements may be aggregated into a single
    category of age 90 or older;
    (D) Telephone numbers;
    (E) Fax numbers;
    (F) Electronic mail addresses;
    (G) Social security numbers;
    (H) Medical record numbers;
    (I) Health plan beneficiary numbers;
    (J) Account numbers;
    (K) Certificate/license numbers;
    (L) Vehicle identifiers and serial numbers, including license plate
    numbers;
    16
    No. 81175-4-I (Consol. with No. 81295-5-I)/17
    SCH argues that the “state and federal prohibitions on disclosure should
    be construed in the same fashion” because the HCIA “adopted language directly
    mirroring HIPAA’s statutory language and regulations.” See Anfinson v. FedEx
    Ground Package Sys., Inc., 
    174 Wn.2d 851
    , 868, 
    281 P.3d 289
     (2012) (“At least
    where there is no contrary legislative intent, when a state statute is ‘taken
    substantially verbatim from [a] federal statute, it carries the same construction as
    the federal law and the same interpretation as federal case law.’ ”)14 (quoting
    State v. Bobic, 
    140 Wn.2d 250
    , 264, 
    996 P.2d 610
     (2000)). But HIPAA enacted
    its guidelines more than a decade before our legislature amended the HCIA to
    include “deidentification” and our legislature chose not to include them in our
    statute.15 “Where the legislature omits language from a statute, whether
    intentionally or inadvertently, this court will not read into the statute the language
    it believes was omitted.” Qwest Corp. v. City of Kent, 
    157 Wn.2d 545
    , 553, 
    139 P.3d 1091
     (2006).
    SCH and DOH also point to WAC 246-08-390 in support of their argument
    that we apply HIPAA deidentification guidelines to patient records released by
    (M) Device identifiers and serial numbers;
    (N) Web Universal Resource Locators (URLs);
    (O) Internet Protocol (IP) address numbers;
    (P) Biometric identifiers, including finger and voice prints;
    (Q) Full face photographic images and any comparable images; and
    (R) Any other unique identifying number, characteristic, or code, except
    as permitted by paragraph (c) of this section; and
    (ii) The covered entity does not have actual knowledge that the
    information could be used alone or in combination with other information to
    identify an individual who is a subject of the information.
    14
    Alteration in original; internal quotation marks omitted.
    15
    Federal regulations enacted the concept of deidentification and standards to protect
    privacy of individually identifiable health information as part of a HIPAA final rule in 2000. 
    65 Fed. Reg. 82802
     (Dec. 28, 2000). The Washington Legislature amended the HCIA to define
    “deidentification” in 2013. LAWS OF 2013, ch. 200, § 1 (effective July 1, 2014).
    17
    No. 81175-4-I (Consol. with No. 81295-5-I)/18
    DOH to ensure consistency under the HCIA. WAC 246-08-390 governs DOH’s
    handling of health care information under the HCIA, including applying the HCIA
    and PRA to public inspection and copying of health information. WAC 246-08-
    390(6)(a). It provides:
    Health information that identifies or can readily be associated with
    the identity of a patient and directly relates to the patient’s health
    care is not available for public inspection and copying. Health
    information that is not individually identifiable is described as
    “deidentified.”
    WAC 246-08-390(6)(a)(i). The same provision gives DOH the option of applying
    the HIPAA guidelines when deidentifying health care information:
    The department may consider analogous federal standards for
    deidentification of protected health information when determining if
    deidentification of health information is possible.
    WAC 246-08-390(6)(a)(iii). In other words, current rules and regulations give
    DOH the discretion to apply the specific and robust HIPAA protections when
    deidentifying health care information from records it intends to release for public
    inspection. We decline the invitation by SCH and DOH to fill the “implementation
    gap” between the HCIA and HIPAA by interpreting WAC 246-08-390(6)(a)(iii) as
    a mandate because we cannot add words to a regulation where the plain
    meaning is clear and unambiguous. Children’s Hosp. & Med. Ctr. v. Dep’t of
    Health, 
    95 Wn. App. 858
    , 868-69, 
    975 P.2d 567
     (1999).
    We conclude that the trial court did not err in determining that the QI
    committee and infection reporting exemptions under the PRA do not prevent
    18
    No. 81175-4-I (Consol. with No. 81295-5-I)/19
    release of the KCPH or DOH records. But we remand for the trial court to ensure
    that the records comply with the applicable patient privacy requirements.
    Affirmed.
    WE CONCUR:
    19