STATEWIDE HEALTH CARE CLAIMS DATA

RCW 43.371
in effect

RCW 43.371.005 Findings.

The legislature finds that: (1) The activities authorized by this chapter will require collaboration among state agencies and local governments that are involved in health care, private health carriers, third-party purchasers, health care providers, and hospitals. These activities will identify strategies to increase the quality and effectiveness of health care delivered in Washington state and are therefore in the best interest of the public. (2) The benefits of collaboration, together with active state supervision, outweigh potential adverse impacts. Therefore, the legislature intends to exempt from state antitrust laws, and provide immunity through the state action doctrine from federal antitrust laws, activities that are undertaken, reviewed, and approved by the authority pursuant to this chapter that might otherwise be constrained by such laws. The legislature does not intend and does not authorize any person or entity to engage in activities not provided for by this chapter, and the legislature neither exempts nor provides immunity for such activities including, but not limited to, agreements among competing providers or carriers to set prices or specific levels of reimbursement for health care services. The legislature finds that: (1) The activities authorized by this chapter will require collaboration among state agencies and local governments that are involved in health care, private health carriers, third-party purchasers, health care providers, and hospitals. These activities will identify strategies to increase the quality and effectiveness of health care delivered in Washington state and are therefore in the best interest of the public. (2) The benefits of collaboration, together with active state supervision, outweigh potential adverse impacts. Therefore, the legislature intends to exempt from state antitrust laws, and provide immunity through the state action doctrine from federal antitrust laws, activities that are undertaken, reviewed, and approved by the authority pursuant to this chapter that might otherwise be constrained by such laws. The legislature does not intend and does not authorize any person or entity to engage in activities not provided for by this chapter, and the legislature neither exempts nor provides immunity for such activities including, but not limited to, agreements among competing providers or carriers to set prices or specific levels of reimbursement for health care services.

RCW 43.371.010 Definitions. (Effective until July 1, 2026.)

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise. (1) "Authority" means the health care authority. (2) "Carrier" and "health carrier" have the same meaning as in RCW 48.43.005 . (3) "Claims data" means the data required by RCW 43.371.030 to be submitted to the database, including billed, allowed and paid amounts, and such additional information as defined by the director in rule. (4) "Data supplier" means: (a) A carrier, third-party administrator, or a public program identified in RCW 43.371.030 that provides claims data; and (b) a carrier or any other entity that provides claims data to the database at the request of an employer-sponsored self-funded health plan or Taft-Hartley trust health plan pursuant to RCW 43.371.030 (1). (5) "Data vendor" means an entity contracted to perform data collection, processing, aggregation, extracts, analytics, and reporting. (6) "Database" means the statewide all-payer health care claims database established in RCW 43.371.020 . (7) "Direct patient identifier" means a data variable that directly identifies an individual, including: Names; telephone numbers; fax numbers; social security number; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images. (8) "Director" means the director of the authority. (9) "Indirect patient identifier" means a data variable that may identify an individual when combined with other information. (10) "Lead organization" means the organization selected under RCW 43.371.020 . (11) "Office" means the office of financial management. (12) "Proprietary financial information" means claims data or reports that disclose or would allow the determination of specific terms of contracts, discounts, or fixed reimbursement arrangements or other specific reimbursement arrangements between an individual health care facility or health care provider, as those terms are defined in RCW 48.43.005 , and a specific payer, or internal fee schedule or other internal pricing mechanism of integrated delivery systems owned by a carrier. (13) "Unique identifier" means an obfuscated identifier assigned to an individual represented in the database to establish a basis for following the individual longitudinally throughout different payers and encounters in the data without revealing the individual's identity. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise. (1) "Authority" means the health care authority. (2) "Carrier" and "health carrier" have the same meaning as in RCW 48.43.005 . (3) "Claims data" means the data required by RCW 43.371.030 to be submitted to the database, including billed, allowed and paid amounts, and such additional information as defined by the director in rule. (4) "Data supplier" means: (a) A carrier, third-party administrator, or a public program identified in RCW 43.371.030 that provides claims data; and (b) a carrier or any other entity that provides claims data to the database at the request of an employer-sponsored self-funded health plan or Taft-Hartley trust health plan pursuant to RCW 43.371.030 (1). (5) "Data vendor" means an entity contracted to perform data collection, processing, aggregation, extracts, analytics, and reporting. (6) "Database" means the statewide all-payer health care claims database established in RCW 43.371.020 . (7) "Direct patient identifier" means a data variable that directly identifies an individual, including: Names; telephone numbers; fax numbers; social security number; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images. (8) "Director" means the director of the authority. (9) "Indirect patient identifier" means a data variable that may identify an individual when combined with other information. (10) "Lead organization" means the organization selected under RCW 43.371.020 . (11) "Office" means the office of financial management. (12) "Proprietary financial information" means claims data or reports that disclose or would allow the determination of specific terms of contracts, discounts, or fixed reimbursement arrangements or other specific reimbursement arrangements between an individual health care facility or health care provider, as those terms are defined in RCW 48.43.005 , and a specific payer, or internal fee schedule or other internal pricing mechanism of integrated delivery systems owned by a carrier. (13) "Unique identifier" means an obfuscated identifier assigned to an individual represented in the database to establish a basis for following the individual longitudinally throughout different payers and encounters in the data without revealing the individual's identity.

RCW 43.371.010 Definitions. (Effective July 1, 2026.)

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise. (1) "Authority" means the health care authority. (2) "Carrier" and "health carrier" have the same meaning as in RCW 48.43.005 . (3) "Claims data" means the data required by RCW 43.371.030 to be submitted to the database, including billed, allowed and paid amounts, and such additional information as defined by the director in rule. (4) "Data supplier" means: (a) A carrier, third-party administrator, or a public program identified in RCW 43.371.030 that provides claims data; and (b) a carrier or any other entity that provides claims data to the database at the request of an employer-sponsored self-funded health plan or Taft-Hartley trust health plan pursuant to RCW 43.371.030 (1). (5) "Data vendor" means an entity contracted to perform data collection, processing, aggregation, extracts, analytics, and reporting. (6) "Database" means the statewide all-payer health care claims database established in RCW 43.371.020 . (7) "Direct patient identifier" means a data variable that directly identifies an individual, including: Names; telephone numbers; fax numbers; social security number; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images. (8) "Director" means the director of the authority. (9) "Indirect patient identifier" means a data variable that may identify an individual when combined with other information. (10) "Lead organization" means the organization selected under RCW 43.371.020 . (11) "Office" means the office of financial management. (12) "Unique identifier" means an obfuscated identifier assigned to an individual represented in the database to establish a basis for following the individual longitudinally throughout different payers and encounters in the data without revealing the individual's identity. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise. (1) "Authority" means the health care authority. (2) "Carrier" and "health carrier" have the same meaning as in RCW 48.43.005 . (3) "Claims data" means the data required by RCW 43.371.030 to be submitted to the database, including billed, allowed and paid amounts, and such additional information as defined by the director in rule. (4) "Data supplier" means: (a) A carrier, third-party administrator, or a public program identified in RCW 43.371.030 that provides claims data; and (b) a carrier or any other entity that provides claims data to the database at the request of an employer-sponsored self-funded health plan or Taft-Hartley trust health plan pursuant to RCW 43.371.030 (1). (5) "Data vendor" means an entity contracted to perform data collection, processing, aggregation, extracts, analytics, and reporting. (6) "Database" means the statewide all-payer health care claims database established in RCW 43.371.020 . (7) "Direct patient identifier" means a data variable that directly identifies an individual, including: Names; telephone numbers; fax numbers; social security number; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators; internet protocol address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images. (8) "Director" means the director of the authority. (9) "Indirect patient identifier" means a data variable that may identify an individual when combined with other information. (10) "Lead organization" means the organization selected under RCW 43.371.020 . (11) "Office" means the office of financial management. (12) "Unique identifier" means an obfuscated identifier assigned to an individual represented in the database to establish a basis for following the individual longitudinally throughout different payers and encounters in the data without revealing the individual's identity.

RCW 43.371.020 Statewide all-payer health care claims database — Selection and duties of lead organization — Certification as qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) — Contract with data vendor. (Expires July 1, 2026.)

(1) The office shall establish a statewide all-payer health care claims database. On January 1, 2020, the office must transfer authority and oversight for the database to the authority. The office and authority must develop a transition plan that sustains operations by July 1, 2019. The database shall support transparent public reporting of health care information. The database must improve transparency to: Assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to improve by benchmarking their performance against that of others by focusing on best practices; enable purchasers to identify value, build expectations into their purchasing strategy, and reward improvements over time; and promote competition based on quality and cost. The database must systematically collect all medical claims and pharmacy claims from private and public payers, with data from all settings of care that permit the systematic analysis of health care delivery. (2) The authority may act as the lead organization, or select a lead organization from among the best potential bidders using a competitive procurement process, in accordance with chapter 39.26 RCW, to coordinate and manage the database. (a)(i) In conducting the competitive procurement, the authority must ensure that no state officer or state employee participating in the procurement process: (A) Has a current relationship or had a relationship within the last three years with any organization that bids on the procurement that would constitute a conflict with the proper discharge of official duties under chapter 42.52 RCW; or (B) Is a compensated or uncompensated member of a bidding organization's board of directors, advisory committee, or has held such a position in the past three years. (ii) If any relationship or interest described in (a)(i) of this subsection is discovered during the procurement process, the officer or employee with the prohibited relationship must withdraw from involvement in the procurement process. (b) Due to the complexities of the all-payer claims database and the unique privacy, quality, and financial objectives, the authority must give strong consideration to the following elements in determining the appropriate lead organization contractor: (i) The organization's degree of experience in health care data collection, analysis, analytics, and security; (ii) whether the organization has a long-term self-sustainable financial model; (iii) the organization's experience in convening and effectively engaging stakeholders to develop reports, especially among groups of health providers, carriers, and self-insured purchasers; (iv) the organization's experience in meeting budget and timelines for report generations; and (v) the organization's ability to combine cost and quality data to assess total cost of care. (c) The successful lead organization must apply to be certified as a qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) by the centers for medicare and medicaid services. (d) The authority may not select a lead organization that: (i) Is a health plan as defined by and consistent with the definitions in RCW 48.43.005 ; (ii) Is a hospital as defined in RCW 70.41.020 ; (iii) Is a provider regulated under Title 18 RCW; (iv) Is a third-party administrator as defined in RCW 70.290.010 ; or (v) Is an entity with a controlling interest in any entity covered in (d)(i) through (iv) of this subsection. (3) As part of the competitive procurement process referenced in subsection (2) of this section, the lead organization shall enter into a contract with a data vendor or multiple data vendors to perform data collection, processing, aggregation, extracts, and analytics. A data vendor must: (a) Establish a secure data submission process with data suppliers; (b) Review data submitters' files according to standards established by the authority; (c) Assess each record's alignment with established format, frequency, and consistency criteria; (d) Maintain responsibility for quality assurance, including, but not limited to: (i) The accuracy and validity of data suppliers' data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records; (e) Assign unique identifiers, as defined in RCW 43.371.010 , to individuals represented in the database; (f) Ensure that direct patient identifiers, indirect patient identifiers, and proprietary financial information are released only in compliance with the terms of this chapter; (g) Demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for accuracy and quality assurance; (h) Store data on secure servers that are compliant with the federal health insurance portability and accountability act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) Maintain state of the art security standards for transferring data to approved data requestors. (4) The lead organization and data vendor must submit detailed descriptions to Washington technology solutions to ensure robust security methods are in place. Washington technology solutions must report its findings to the authority and the appropriate committees of the legislature. (5) The lead organization is responsible for internal governance, management, funding, and operations of the database. At the direction of the authority, the lead organization shall work with the data vendor to: (a) Collect claims data from data suppliers as provided in RCW 43.371.030 ; (b) Design data collection mechanisms with consideration for the time and cost incurred by data suppliers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance; (c) Ensure protection of collected data and store and use any data in a manner that protects patient privacy and complies with this section. All patient-specific information must be deidentified with an up-to-date industry standard encryption algorithm; (d) Consistent with the requirements of this chapter, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care; (e) Report performance on cost and quality pursuant to RCW 43.371.060 using, but not limited to, the performance measures developed under RCW 41.05.690 ; (f) Develop protocols and policies, including prerelease peer review by data suppliers, to ensure the quality of data releases and reports; (g) Develop a plan for the financial sustainability of the database as may be reasonable and customary as compared to other states' databases and charge fees for reports and data files as needed to fund the database. Any fees must be approved by the authority and should be comparable, accounting for relevant differences across data requests and uses. The lead organization may not charge providers or data suppliers fees other than fees directly related to requested reports and data files; and (h) Convene advisory committees with the approval and participation of the authority, including: (i) A committee on data policy development; and (ii) a committee to establish a data release process consistent with the requirements of this chapter and to provide advice regarding formal data release requests. The advisory committees must include in-state representation from key provider, hospital, public health, health maintenance organization, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database. (6) The lead organization governance structure and advisory committees for this database must include representation of the third-party administrator of the uniform medical plan. A payer, health maintenance organization, or third-party administrator must be a data supplier to the all-payer health care claims database to be represented on the lead organization governance structure or advisory committees. (7) This section expires July 1, 2026. (1) The office shall establish a statewide all-payer health care claims database. On January 1, 2020, the office must transfer authority and oversight for the database to the authority. The office and authority must develop a transition plan that sustains operations by July 1, 2019. The database shall support transparent public reporting of health care information. The database must improve transparency to: Assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to improve by benchmarking their performance against that of others by focusing on best practices; enable purchasers to identify value, build expectations into their purchasing strategy, and reward improvements over time; and promote competition based on quality and cost. The database must systematically collect all medical claims and pharmacy claims from private and public payers, with data from all settings of care that permit the systematic analysis of health care delivery. (2) The authority may act as the lead organization, or select a lead organization from among the best potential bidders using a competitive procurement process, in accordance with chapter 39.26 RCW, to coordinate and manage the database. (a)(i) In conducting the competitive procurement, the authority must ensure that no state officer or state employee participating in the procurement process: (A) Has a current relationship or had a relationship within the last three years with any organization that bids on the procurement that would constitute a conflict with the proper discharge of official duties under chapter 42.52 RCW; or (B) Is a compensated or uncompensated member of a bidding organization's board of directors, advisory committee, or has held such a position in the past three years. (ii) If any relationship or interest described in (a)(i) of this subsection is discovered during the procurement process, the officer or employee with the prohibited relationship must withdraw from involvement in the procurement process. (b) Due to the complexities of the all-payer claims database and the unique privacy, quality, and financial objectives, the authority must give strong consideration to the following elements in determining the appropriate lead organization contractor: (i) The organization's degree of experience in health care data collection, analysis, analytics, and security; (ii) whether the organization has a long-term self-sustainable financial model; (iii) the organization's experience in convening and effectively engaging stakeholders to develop reports, especially among groups of health providers, carriers, and self-insured purchasers; (iv) the organization's experience in meeting budget and timelines for report generations; and (v) the organization's ability to combine cost and quality data to assess total cost of care. (c) The successful lead organization must apply to be certified as a qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) by the centers for medicare and medicaid services. (d) The authority may not select a lead organization that: (i) Is a health plan as defined by and consistent with the definitions in RCW 48.43.005 ; (ii) Is a hospital as defined in RCW 70.41.020 ; (iii) Is a provider regulated under Title 18 RCW; (iv) Is a third-party administrator as defined in RCW 70.290.010 ; or (v) Is an entity with a controlling interest in any entity covered in (d)(i) through (iv) of this subsection. (3) As part of the competitive procurement process referenced in subsection (2) of this section, the lead organization shall enter into a contract with a data vendor or multiple data vendors to perform data collection, processing, aggregation, extracts, and analytics. A data vendor must: (a) Establish a secure data submission process with data suppliers; (b) Review data submitters' files according to standards established by the authority; (c) Assess each record's alignment with established format, frequency, and consistency criteria; (d) Maintain responsibility for quality assurance, including, but not limited to: (i) The accuracy and validity of data suppliers' data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records; (e) Assign unique identifiers, as defined in RCW 43.371.010 , to individuals represented in the database; (f) Ensure that direct patient identifiers, indirect patient identifiers, and proprietary financial information are released only in compliance with the terms of this chapter; (g) Demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for accuracy and quality assurance; (h) Store data on secure servers that are compliant with the federal health insurance portability and accountability act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) Maintain state of the art security standards for transferring data to approved data requestors. (4) The lead organization and data vendor must submit detailed descriptions to Washington technology solutions to ensure robust security methods are in place. Washington technology solutions must report its findings to the authority and the appropriate committees of the legislature. (5) The lead organization is responsible for internal governance, management, funding, and operations of the database. At the direction of the authority, the lead organization shall work with the data vendor to: (a) Collect claims data from data suppliers as provided in RCW 43.371.030 ; (b) Design data collection mechanisms with consideration for the time and cost incurred by data suppliers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance; (c) Ensure protection of collected data and store and use any data in a manner that protects patient privacy and complies with this section. All patient-specific information must be deidentified with an up-to-date industry standard encryption algorithm; (d) Consistent with the requirements of this chapter, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care; (e) Report performance on cost and quality pursuant to RCW 43.371.060 using, but not limited to, the performance measures developed under RCW 41.05.690 ; (f) Develop protocols and policies, including prerelease peer review by data suppliers, to ensure the quality of data releases and reports; (g) Develop a plan for the financial sustainability of the database as may be reasonable and customary as compared to other states' databases and charge fees for reports and data files as needed to fund the database. Any fees must be approved by the authority and should be comparable, accounting for relevant differences across data requests and uses. The lead organization may not charge providers or data suppliers fees other than fees directly related to requested reports and data files; and (h) Convene advisory committees with the approval and participation of the authority, including: (i) A committee on data policy development; and (ii) a committee to establish a data release process consistent with the requirements of this chapter and to provide advice regarding formal data release requests. The advisory committees must include in-state representation from key provider, hospital, public health, health maintenance organization, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database. (6) The lead organization governance structure and advisory committees for this database must include representation of the third-party administrator of the uniform medical plan. A payer, health maintenance organization, or third-party administrator must be a data supplier to the all-payer health care claims database to be represented on the lead organization governance structure or advisory committees. (7) This section expires July 1, 2026.

RCW 43.371.020 Statewide all-payer health care claims database — Selection and duties of lead organization — Certification as qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) — Contract with data vendor. (Effective July 1, 2026.)

(1) The office shall establish a statewide all-payer health care claims database. On January 1, 2020, the office must transfer authority and oversight for the database to the authority. The office and authority must develop a transition plan that sustains operations by July 1, 2019. The database shall support transparent public reporting of health care information. The database must improve transparency to: Assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to improve by benchmarking their performance against that of others by focusing on best practices; enable purchasers, providers, hospitals, carriers, and statewide associations representing providers, hospitals, or carriers to identify value, build expectations into their purchasing strategy, and reward improvements over time; and promote competition based on quality and cost. The database must systematically collect all medical claims and pharmacy claims from private and public payers, with data from all settings of care that permit the systematic analysis of health care delivery. (2) The authority may act as the lead organization, or select a lead organization from among the best potential bidders using a competitive procurement process, in accordance with chapter 39.26 RCW, to coordinate and manage the database. (a)(i) In conducting the competitive procurement, the authority must ensure that no state officer or state employee participating in the procurement process: (A) Has a current relationship or had a relationship within the last three years with any organization that bids on the procurement that would constitute a conflict with the proper discharge of official duties under chapter 42.52 RCW; or (B) Is a compensated or uncompensated member of a bidding organization's board of directors, advisory committee, or has held such a position in the past three years. (ii) If any relationship or interest described in (a)(i) of this subsection is discovered during the procurement process, the officer or employee with the prohibited relationship must withdraw from involvement in the procurement process. (b) Due to the complexities of the all-payer claims database and the unique privacy, quality, and financial objectives, the authority must give strong consideration to the following elements in determining the appropriate lead organization contractor: (i) The organization's degree of experience in health care data collection, analysis, analytics, and security; (ii) whether the organization has a long-term self-sustainable financial model; (iii) the organization's experience in convening and effectively engaging stakeholders to develop reports, especially among groups of health providers, carriers, and self-insured purchasers; (iv) the organization's experience in meeting budget and timelines for report generations; and (v) the organization's ability to combine cost and quality data to assess total cost of care. (c) The successful lead organization must apply to be certified as a qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) by the centers for medicare and medicaid services. (d) The authority may not select a lead organization that: (i) Is a health plan as defined by and consistent with the definitions in RCW 48.43.005 ; (ii) Is a hospital as defined in RCW 70.41.020 ; (iii) Is a provider regulated under Title 18 RCW; (iv) Is a third-party administrator as defined in RCW 70.290.010 ; or (v) Is an entity with a controlling interest in any entity covered in (d)(i) through (iv) of this subsection. (3) As part of the competitive procurement process referenced in subsection (2) of this section, the lead organization shall enter into a contract with a data vendor or multiple data vendors to perform data collection, processing, aggregation, extracts, and analytics. A data vendor must: (a) Establish a secure data submission process with data suppliers; (b) Review data submitters' files according to standards established by the authority; (c) Assess each record's alignment with established format, frequency, and consistency criteria; (d) Maintain responsibility for quality assurance, including, but not limited to: (i) The accuracy and validity of data suppliers' data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records; (e) Assign unique identifiers, as defined in RCW 43.371.010 , to individuals represented in the database; (f) Ensure that direct patient identifiers and indirect patient identifiers are released only in compliance with the terms of this chapter; (g) Demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for accuracy and quality assurance; (h) Store data on secure servers that are compliant with the federal health insurance portability and accountability act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) Maintain state of the art security standards for transferring data to approved data requestors. (4) The lead organization and data vendor must submit detailed descriptions to Washington technology solutions to ensure robust security methods are in place. Washington technology solutions must report its findings to the authority and the appropriate committees of the legislature. (5) The lead organization is responsible for internal governance, management, funding, and operations of the database. At the direction of the authority, the lead organization shall work with the data vendor to: (a) Collect claims data from data suppliers as provided in RCW 43.371.030 ; (b) Design data collection mechanisms with consideration for the time and cost incurred by data suppliers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance; (c) Ensure protection of collected data and store and use any data in a manner that protects patient privacy and complies with this section. All patient-specific information must be deidentified with an up-to-date industry standard encryption algorithm; (d) Consistent with the requirements of this chapter, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care; (e) Report performance on cost and quality pursuant to RCW 43.371.060 using, but not limited to, the performance measures developed under RCW 41.05.690 ; (f) Develop protocols and policies, including prerelease peer review by data suppliers, to ensure the quality of data releases and reports; (g) Develop a plan for the financial sustainability of the database as may be reasonable and customary as compared to other states' databases and charge fees for reports and data files as needed to fund the database. Any fees must be approved by the authority and should be comparable, accounting for relevant differences across data requests and uses. The lead organization may not charge providers or data suppliers fees other than fees directly related to requested reports and data files; and (h) Convene advisory committees with the approval and participation of the authority, including: (i) A committee on data policy development; and (ii) a committee to establish a data release process consistent with the requirements of this chapter and to provide advice regarding formal data release requests. The advisory committees must include in-state representation from key provider, hospital, public health, health maintenance organization, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database. (6) The lead organization governance structure and advisory committees for this database must include representation of the third-party administrator of the uniform medical plan. A payer, health maintenance organization, or third-party administrator must be a data supplier to the all-payer health care claims database to be represented on the lead organization governance structure or advisory committees. (1) The office shall establish a statewide all-payer health care claims database. On January 1, 2020, the office must transfer authority and oversight for the database to the authority. The office and authority must develop a transition plan that sustains operations by July 1, 2019. The database shall support transparent public reporting of health care information. The database must improve transparency to: Assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to improve by benchmarking their performance against that of others by focusing on best practices; enable purchasers, providers, hospitals, carriers, and statewide associations representing providers, hospitals, or carriers to identify value, build expectations into their purchasing strategy, and reward improvements over time; and promote competition based on quality and cost. The database must systematically collect all medical claims and pharmacy claims from private and public payers, with data from all settings of care that permit the systematic analysis of health care delivery. (2) The authority may act as the lead organization, or select a lead organization from among the best potential bidders using a competitive procurement process, in accordance with chapter 39.26 RCW, to coordinate and manage the database. (a)(i) In conducting the competitive procurement, the authority must ensure that no state officer or state employee participating in the procurement process: (A) Has a current relationship or had a relationship within the last three years with any organization that bids on the procurement that would constitute a conflict with the proper discharge of official duties under chapter 42.52 RCW; or (B) Is a compensated or uncompensated member of a bidding organization's board of directors, advisory committee, or has held such a position in the past three years. (ii) If any relationship or interest described in (a)(i) of this subsection is discovered during the procurement process, the officer or employee with the prohibited relationship must withdraw from involvement in the procurement process. (b) Due to the complexities of the all-payer claims database and the unique privacy, quality, and financial objectives, the authority must give strong consideration to the following elements in determining the appropriate lead organization contractor: (i) The organization's degree of experience in health care data collection, analysis, analytics, and security; (ii) whether the organization has a long-term self-sustainable financial model; (iii) the organization's experience in convening and effectively engaging stakeholders to develop reports, especially among groups of health providers, carriers, and self-insured purchasers; (iv) the organization's experience in meeting budget and timelines for report generations; and (v) the organization's ability to combine cost and quality data to assess total cost of care. (c) The successful lead organization must apply to be certified as a qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) by the centers for medicare and medicaid services. (d) The authority may not select a lead organization that: (i) Is a health plan as defined by and consistent with the definitions in RCW 48.43.005 ; (ii) Is a hospital as defined in RCW 70.41.020 ; (iii) Is a provider regulated under Title 18 RCW; (iv) Is a third-party administrator as defined in RCW 70.290.010 ; or (v) Is an entity with a controlling interest in any entity covered in (d)(i) through (iv) of this subsection. (3) As part of the competitive procurement process referenced in subsection (2) of this section, the lead organization shall enter into a contract with a data vendor or multiple data vendors to perform data collection, processing, aggregation, extracts, and analytics. A data vendor must: (a) Establish a secure data submission process with data suppliers; (b) Review data submitters' files according to standards established by the authority; (c) Assess each record's alignment with established format, frequency, and consistency criteria; (d) Maintain responsibility for quality assurance, including, but not limited to: (i) The accuracy and validity of data suppliers' data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records; (e) Assign unique identifiers, as defined in RCW 43.371.010 , to individuals represented in the database; (f) Ensure that direct patient identifiers and indirect patient identifiers are released only in compliance with the terms of this chapter; (g) Demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for accuracy and quality assurance; (h) Store data on secure servers that are compliant with the federal health insurance portability and accountability act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and (i) Maintain state of the art security standards for transferring data to approved data requestors. (4) The lead organization and data vendor must submit detailed descriptions to Washington technology solutions to ensure robust security methods are in place. Washington technology solutions must report its findings to the authority and the appropriate committees of the legislature. (5) The lead organization is responsible for internal governance, management, funding, and operations of the database. At the direction of the authority, the lead organization shall work with the data vendor to: (a) Collect claims data from data suppliers as provided in RCW 43.371.030 ; (b) Design data collection mechanisms with consideration for the time and cost incurred by data suppliers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance; (c) Ensure protection of collected data and store and use any data in a manner that protects patient privacy and complies with this section. All patient-specific information must be deidentified with an up-to-date industry standard encryption algorithm; (d) Consistent with the requirements of this chapter, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care; (e) Report performance on cost and quality pursuant to RCW 43.371.060 using, but not limited to, the performance measures developed under RCW 41.05.690 ; (f) Develop protocols and policies, including prerelease peer review by data suppliers, to ensure the quality of data releases and reports; (g) Develop a plan for the financial sustainability of the database as may be reasonable and customary as compared to other states' databases and charge fees for reports and data files as needed to fund the database. Any fees must be approved by the authority and should be comparable, accounting for relevant differences across data requests and uses. The lead organization may not charge providers or data suppliers fees other than fees directly related to requested reports and data files; and (h) Convene advisory committees with the approval and participation of the authority, including: (i) A committee on data policy development; and (ii) a committee to establish a data release process consistent with the requirements of this chapter and to provide advice regarding formal data release requests. The advisory committees must include in-state representation from key provider, hospital, public health, health maintenance organization, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database. (6) The lead organization governance structure and advisory committees for this database must include representation of the third-party administrator of the uniform medical plan. A payer, health maintenance organization, or third-party administrator must be a data supplier to the all-payer health care claims database to be represented on the lead organization governance structure or advisory committees.

RCW 43.371.030 Submission of claims data to database — Annual status report.

(1) The state medicaid program, public employees' benefits board programs, school employees' benefits board programs beginning July 1, 2020, all health carriers operating in this state, all third-party administrators paying claims on behalf of health plans in this state, and the state labor and industries program must submit claims data to the database within the time frames established by the director in rule and in accordance with procedures established by the lead organization. The director may expand this requirement by rule to include any health plans or health benefit plans defined in *RCW 48.43.005 (26) (a) through (i) to accomplish the goals of this chapter set forth in RCW 43.371.020 (1). Employer-sponsored self-funded health plans and Taft-Hartley trust health plans may voluntarily provide claims data to the database within the time frames and in accordance with procedures established by the lead organization. (2) Any data supplier used by an entity that voluntarily participates in the database must provide claims data to the data vendor upon request of the entity. (3) The lead organization shall submit an annual status report to the authority regarding compliance with this section. (1) The state medicaid program, public employees' benefits board programs, school employees' benefits board programs beginning July 1, 2020, all health carriers operating in this state, all third-party administrators paying claims on behalf of health plans in this state, and the state labor and industries program must submit claims data to the database within the time frames established by the director in rule and in accordance with procedures established by the lead organization. The director may expand this requirement by rule to include any health plans or health benefit plans defined in *RCW 48.43.005 (26) (a) through (i) to accomplish the goals of this chapter set forth in RCW 43.371.020 (1). Employer-sponsored self-funded health plans and Taft-Hartley trust health plans may voluntarily provide claims data to the database within the time frames and in accordance with procedures established by the lead organization. (2) Any data supplier used by an entity that voluntarily participates in the database must provide claims data to the data vendor upon request of the entity. (3) The lead organization shall submit an annual status report to the authority regarding compliance with this section.

RCW 43.371.040 Claims data and database — Exempt from public disclosure — Not subject to subpoena or compulsory process.

(1) The claims data provided to the database, the database itself, including the data compilation, and any raw data received from the database are not public records and are exempt from public disclosure under chapter 42.56 RCW. (2) Claims data obtained, distributed, or reported in the course of activities undertaken pursuant to or supported under this chapter are not subject to subpoena or similar compulsory process in any civil or criminal, judicial, or administrative proceeding, nor may any individual or organization with lawful access to data under this chapter be compelled to provide such information pursuant to subpoena or testify with regard to such data, except that data pertaining to a party in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of such individual to enforce any liability arising under this chapter. (1) The claims data provided to the database, the database itself, including the data compilation, and any raw data received from the database are not public records and are exempt from public disclosure under chapter 42.56 RCW. (2) Claims data obtained, distributed, or reported in the course of activities undertaken pursuant to or supported under this chapter are not subject to subpoena or similar compulsory process in any civil or criminal, judicial, or administrative proceeding, nor may any individual or organization with lawful access to data under this chapter be compelled to provide such information pursuant to subpoena or testify with regard to such data, except that data pertaining to a party in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of such individual to enforce any liability arising under this chapter.

RCW 43.371.050 Availability of claims or data for retrieval — Confidentiality of claims or data — Duties of the lead organization and the data vendor. (Effective until July 1, 2026.)

(1) Except as otherwise required by law, claims or other data from the database shall only be available for retrieval in processed form to public and private requesters pursuant to this section and shall be made available within a reasonable time after the request. Each request for claims data must include, at a minimum, the following information: (a) The identity of any entities that will analyze the data in connection with the request; (b) The stated purpose of the request and an explanation of how the request supports the goals of this chapter set forth in RCW 43.371.020 (1); (c) A description of the proposed methodology; (d) The specific variables requested and an explanation of how the data is necessary to achieve the stated purpose described pursuant to (b) of this subsection; (e) How the requester will ensure all requested data is handled in accordance with the privacy and confidentiality protections required under this chapter and any other applicable law; (f) The method by which the data will be destroyed at the conclusion of the data use agreement; (g) The protections that will be utilized to keep the data from being used for any purposes not authorized by the requester's approved application; and (h) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1). (2) The lead organization may decline a request that does not include the information set forth in subsection (1) of this section that does not meet the criteria established by the lead organization's data release advisory committee, or for reasons established by rule. (3) Except as otherwise required by law, the authority shall direct the lead organization and the data vendor to maintain the confidentiality of claims or other data it collects for the database that include proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof. Any entity that receives claims or other data must also maintain confidentiality and may only release such claims data or any part of the claims data if: (a) The claims data does not contain proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof; and (b) The release is described and approved as part of the request in subsection (1) of this section. (4) The lead organization shall, in conjunction with the authority and the data vendor, create and implement a process to govern levels of access to and use of data from the database consistent with the following: (a) Claims or other data that include proprietary financial information, direct patient identifiers, indirect patient identifiers, unique identifiers, or any combination thereof may be released only to the extent such information is necessary to achieve the goals of this chapter set forth in RCW 43.371.020 (1) to researchers with approval of an institutional review board upon receipt of a signed data use and confidentiality agreement with the lead organization. A researcher or research organization that obtains claims data pursuant to this subsection must agree in writing not to disclose such data or parts of the data set to any other party, including affiliated entities, and must consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1). (b) Claims or other data that do not contain direct patient identifiers, but that may contain proprietary financial information, indirect patient identifiers, unique identifiers, or any combination thereof may be released to: (i) Federal, state, tribal, and local government agencies upon receipt of a signed data use agreement with the authority and the lead organization. Federal, state, tribal, and local government agencies that obtain claims data pursuant to this subsection are prohibited from using such data in the purchase or procurement of health benefits for their employees; (ii) Any entity when functioning as the lead organization under the terms of this chapter; and (iii) The Washington health benefit exchange established under chapter 43.71 RCW, upon receipt of a signed data use agreement with the authority and the lead organization as directed by rules adopted under this chapter. (c) Claims or other data that do not contain proprietary financial information, direct patient identifiers, or any combination thereof, but that may contain indirect patient identifiers, unique identifiers, or a combination thereof may be released to agencies, researchers, and other entities as approved by the lead organization upon receipt of a signed data use agreement with the lead organization. (d) Claims or other data that do not contain direct patient identifiers, indirect patient identifiers, proprietary financial information, or any combination thereof may be released upon request. (5) Reports utilizing data obtained under this section may not contain proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof. Nothing in this subsection (5) may be construed to prohibit the use of geographic areas with a sufficient population size or aggregate gender, age, medical condition, or other characteristics in the generation of reports, so long as they cannot lead to the identification of an individual. (6) Reports issued by the lead organization at the request of providers, facilities, employers, health plans, and other entities as approved by the lead organization may utilize proprietary financial information to calculate aggregate cost data for display in such reports. The authority shall approve by rule a format for the calculation and display of aggregate cost data consistent with this chapter that will prevent the disclosure or determination of proprietary financial information. In developing the rule, the authority shall solicit feedback from the stakeholders, including those listed in RCW 43.371.020 (5)(h), and must consider, at a minimum, data presented as proportions, ranges, averages, and medians, as well as the differences in types of data gathered and submitted by data suppliers. (7) Recipients of claims or other data under subsection (4) of this section must agree in a data use agreement or a confidentiality agreement to, at a minimum: (a) Take steps to protect data containing direct patient identifiers, indirect patient identifiers, proprietary financial information, or any combination thereof as described in the agreement; (b) Not redisclose the claims data except pursuant to subsection (3) of this section; (c) Not attempt to determine the identity of any person whose information is included in the data set or use the claims or other data in any manner that identifies any individual or their family or attempt to locate information associated with a specific individual; (d) Destroy claims data at the conclusion of the data use agreement; and (e) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1). (1) Except as otherwise required by law, claims or other data from the database shall only be available for retrieval in processed form to public and private requesters pursuant to this section and shall be made available within a reasonable time after the request. Each request for claims data must include, at a minimum, the following information: (a) The identity of any entities that will analyze the data in connection with the request; (b) The stated purpose of the request and an explanation of how the request supports the goals of this chapter set forth in RCW 43.371.020 (1); (c) A description of the proposed methodology; (d) The specific variables requested and an explanation of how the data is necessary to achieve the stated purpose described pursuant to (b) of this subsection; (e) How the requester will ensure all requested data is handled in accordance with the privacy and confidentiality protections required under this chapter and any other applicable law; (f) The method by which the data will be destroyed at the conclusion of the data use agreement; (g) The protections that will be utilized to keep the data from being used for any purposes not authorized by the requester's approved application; and (h) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1). (2) The lead organization may decline a request that does not include the information set forth in subsection (1) of this section that does not meet the criteria established by the lead organization's data release advisory committee, or for reasons established by rule. (3) Except as otherwise required by law, the authority shall direct the lead organization and the data vendor to maintain the confidentiality of claims or other data it collects for the database that include proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof. Any entity that receives claims or other data must also maintain confidentiality and may only release such claims data or any part of the claims data if: (a) The claims data does not contain proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof; and (b) The release is described and approved as part of the request in subsection (1) of this section. (4) The lead organization shall, in conjunction with the authority and the data vendor, create and implement a process to govern levels of access to and use of data from the database consistent with the following: (a) Claims or other data that include proprietary financial information, direct patient identifiers, indirect patient identifiers, unique identifiers, or any combination thereof may be released only to the extent such information is necessary to achieve the goals of this chapter set forth in RCW 43.371.020 (1) to researchers with approval of an institutional review board upon receipt of a signed data use and confidentiality agreement with the lead organization. A researcher or research organization that obtains claims data pursuant to this subsection must agree in writing not to disclose such data or parts of the data set to any other party, including affiliated entities, and must consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1). (b) Claims or other data that do not contain direct patient identifiers, but that may contain proprietary financial information, indirect patient identifiers, unique identifiers, or any combination thereof may be released to: (i) Federal, state, tribal, and local government agencies upon receipt of a signed data use agreement with the authority and the lead organization. Federal, state, tribal, and local government agencies that obtain claims data pursuant to this subsection are prohibited from using such data in the purchase or procurement of health benefits for their employees; (ii) Any entity when functioning as the lead organization under the terms of this chapter; and (iii) The Washington health benefit exchange established under chapter 43.71 RCW, upon receipt of a signed data use agreement with the authority and the lead organization as directed by rules adopted under this chapter. (c) Claims or other data that do not contain proprietary financial information, direct patient identifiers, or any combination thereof, but that may contain indirect patient identifiers, unique identifiers, or a combination thereof may be released to agencies, researchers, and other entities as approved by the lead organization upon receipt of a signed data use agreement with the lead organization. (d) Claims or other data that do not contain direct patient identifiers, indirect patient identifiers, proprietary financial information, or any combination thereof may be released upon request. (5) Reports utilizing data obtained under this section may not contain proprietary financial information, direct patient identifiers, indirect patient identifiers, or any combination thereof. Nothing in this subsection (5) may be construed to prohibit the use of geographic areas with a sufficient population size or aggregate gender, age, medical condition, or other characteristics in the generation of reports, so long as they cannot lead to the identification of an individual. (6) Reports issued by the lead organization at the request of providers, facilities, employers, health plans, and other entities as approved by the lead organization may utilize proprietary financial information to calculate aggregate cost data for display in such reports. The authority shall approve by rule a format for the calculation and display of aggregate cost data consistent with this chapter that will prevent the disclosure or determination of proprietary financial information. In developing the rule, the authority shall solicit feedback from the stakeholders, including those listed in RCW 43.371.020 (5)(h), and must consider, at a minimum, data presented as proportions, ranges, averages, and medians, as well as the differences in types of data gathered and submitted by data suppliers. (7) Recipients of claims or other data under subsection (4) of this section must agree in a data use agreement or a confidentiality agreement to, at a minimum: (a) Take steps to protect data containing direct patient identifiers, indirect patient identifiers, proprietary financial information, or any combination thereof as described in the agreement; (b) Not redisclose the claims data except pursuant to subsection (3) of this section; (c) Not attempt to determine the identity of any person whose information is included in the data set or use the claims or other data in any manner that identifies any individual or their family or attempt to locate information associated with a specific individual; (d) Destroy claims data at the conclusion of the data use agreement; and (e) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, or proprietary financial information adopted under RCW 43.371.070 (1).

RCW 43.371.050 Availability of claims or data for retrieval — Confidentiality of claims or data — Duties of the lead organization and the data vendor. (Effective July 1, 2026.)

(1) Except as otherwise required by law, claims or other data from the database shall only be available for retrieval in processed form to public and private requesters pursuant to this section and shall be made available within a reasonable time after the request. Each request for claims data must include, at a minimum, the following information: (a) The identity of any entities that will analyze the data in connection with the request; (b) The stated purpose of the request and an explanation of how the request supports the goals of this chapter set forth in RCW 43.371.020 (1); (c) A description of the proposed methodology; (d) The specific variables requested and an explanation of how the data is necessary to achieve the stated purpose described pursuant to (b) of this subsection; (e) How the requester will ensure all requested data is handled in accordance with the privacy and confidentiality protections required under this chapter and any other applicable law; (f) The method by which the data will be destroyed at the conclusion of the data use agreement; (g) The protections that will be utilized to keep the data from being used for any purposes not authorized by the requester's approved application; and (h) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1). (2) The lead organization may decline a request that does not include the information set forth in subsection (1) of this section that does not meet the criteria established by the lead organization's data release advisory committee, or for reasons established by rule. (3) Except as otherwise required by law, the authority shall direct the lead organization and the data vendor to maintain the confidentiality of claims or other data it collects for the database that include direct patient identifiers, indirect patient identifiers, or any combination thereof. Any entity that receives claims or other data must also maintain confidentiality, including by agreeing to not reidentify any deidentified patient information, and may only release such claims data or any part of the claims data if: (a) The claims data does not contain direct patient identifiers, indirect patient identifiers, or any combination thereof; and (b) The release is described and approved as part of the request in subsection (1) of this section. (4) The lead organization shall, in conjunction with the authority and the data vendor, create and implement a process to govern levels of access to and use of data from the database consistent with the following: (a) Claims or other data that include direct patient identifiers, indirect patient identifiers, unique identifiers, or any combination thereof may be released only to the extent such information is necessary to achieve the goals of this chapter set forth in RCW 43.371.020 (1) to researchers with approval of an institutional review board upon receipt of a signed data use and confidentiality agreement with the lead organization. A researcher or research organization that obtains claims data pursuant to this subsection must agree in writing not to disclose such data or parts of the data set to any other party, including affiliated entities, and must consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1). (b) Claims or other data that do not contain direct patient identifiers, but that may contain indirect patient identifiers, unique identifiers, or any combination thereof may be released to: (i) Federal, state, tribal, and local government agencies upon receipt of a signed data use agreement with the authority and the lead organization; (ii) Providers who practice a profession identified in RCW 18.130.040 , hospitals licensed under chapter 70.41 or 71.12 RCW, carriers licensed under chapter 48.43 or 41.05 RCW, managed care organizations, and statewide associations representing hospitals, carriers, or providers upon receipt of a signed data use agreement with the authority and the lead organization. For entities within this class, the following purposes support the goals of this chapter set forth in RCW 43.371.020 (1): (A) Promoting informed choices and understanding of health care access, quality, or affordability, including related barriers; (B) Benchmarking value and efficiency against that of others; (C) Validating and assessing third-party analysis and reports based on claims data; and (D) Performing quality improvement activities; (iii) Any entity when functioning as the lead organization under the terms of this chapter; (iv) The Washington health benefit exchange established under chapter 43.71 RCW, upon receipt of a signed data use agreement with the authority and the lead organization as directed by rules adopted under this chapter; and (v) Agencies, researchers, and other entities as approved by the lead organization upon receipt of a signed data use agreement with the authority and the lead organization. (c) Claims or other data that do not contain direct patient identifiers, indirect patient identifiers, or any combination thereof may be released upon request. (5) Reports utilizing data obtained under this section may not contain direct patient identifiers, indirect patient identifiers, or any combination thereof. Nothing in this subsection (5) may be construed to prohibit the use of geographic areas with a sufficient population size or aggregate gender, age, medical condition, or other characteristics in the generation of reports, so long as they cannot lead to the identification of an individual. (6) Recipients of claims or other data under subsection (4) of this section must agree in a data use agreement or a confidentiality agreement to, at a minimum: (a) Take steps to protect data containing direct patient identifiers, indirect patient identifiers, or any combination thereof as described in the agreement; (b) Not redisclose the claims data except pursuant to subsection (3) of this section; (c) Not attempt to determine the identity of any person whose information is included in the data set or use the claims or other data in any manner that identifies any individual or their family or attempt to locate information associated with a specific individual; (d) Destroy claims data at the conclusion of the data use agreement; and (e) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1). (1) Except as otherwise required by law, claims or other data from the database shall only be available for retrieval in processed form to public and private requesters pursuant to this section and shall be made available within a reasonable time after the request. Each request for claims data must include, at a minimum, the following information: (a) The identity of any entities that will analyze the data in connection with the request; (b) The stated purpose of the request and an explanation of how the request supports the goals of this chapter set forth in RCW 43.371.020 (1); (c) A description of the proposed methodology; (d) The specific variables requested and an explanation of how the data is necessary to achieve the stated purpose described pursuant to (b) of this subsection; (e) How the requester will ensure all requested data is handled in accordance with the privacy and confidentiality protections required under this chapter and any other applicable law; (f) The method by which the data will be destroyed at the conclusion of the data use agreement; (g) The protections that will be utilized to keep the data from being used for any purposes not authorized by the requester's approved application; and (h) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1). (2) The lead organization may decline a request that does not include the information set forth in subsection (1) of this section that does not meet the criteria established by the lead organization's data release advisory committee, or for reasons established by rule. (3) Except as otherwise required by law, the authority shall direct the lead organization and the data vendor to maintain the confidentiality of claims or other data it collects for the database that include direct patient identifiers, indirect patient identifiers, or any combination thereof. Any entity that receives claims or other data must also maintain confidentiality, including by agreeing to not reidentify any deidentified patient information, and may only release such claims data or any part of the claims data if: (a) The claims data does not contain direct patient identifiers, indirect patient identifiers, or any combination thereof; and (b) The release is described and approved as part of the request in subsection (1) of this section. (4) The lead organization shall, in conjunction with the authority and the data vendor, create and implement a process to govern levels of access to and use of data from the database consistent with the following: (a) Claims or other data that include direct patient identifiers, indirect patient identifiers, unique identifiers, or any combination thereof may be released only to the extent such information is necessary to achieve the goals of this chapter set forth in RCW 43.371.020 (1) to researchers with approval of an institutional review board upon receipt of a signed data use and confidentiality agreement with the lead organization. A researcher or research organization that obtains claims data pursuant to this subsection must agree in writing not to disclose such data or parts of the data set to any other party, including affiliated entities, and must consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1). (b) Claims or other data that do not contain direct patient identifiers, but that may contain indirect patient identifiers, unique identifiers, or any combination thereof may be released to: (i) Federal, state, tribal, and local government agencies upon receipt of a signed data use agreement with the authority and the lead organization; (ii) Providers who practice a profession identified in RCW 18.130.040 , hospitals licensed under chapter 70.41 or 71.12 RCW, carriers licensed under chapter 48.43 or 41.05 RCW, managed care organizations, and statewide associations representing hospitals, carriers, or providers upon receipt of a signed data use agreement with the authority and the lead organization. For entities within this class, the following purposes support the goals of this chapter set forth in RCW 43.371.020 (1): (A) Promoting informed choices and understanding of health care access, quality, or affordability, including related barriers; (B) Benchmarking value and efficiency against that of others; (C) Validating and assessing third-party analysis and reports based on claims data; and (D) Performing quality improvement activities; (iii) Any entity when functioning as the lead organization under the terms of this chapter; (iv) The Washington health benefit exchange established under chapter 43.71 RCW, upon receipt of a signed data use agreement with the authority and the lead organization as directed by rules adopted under this chapter; and (v) Agencies, researchers, and other entities as approved by the lead organization upon receipt of a signed data use agreement with the authority and the lead organization. (c) Claims or other data that do not contain direct patient identifiers, indirect patient identifiers, or any combination thereof may be released upon request. (5) Reports utilizing data obtained under this section may not contain direct patient identifiers, indirect patient identifiers, or any combination thereof. Nothing in this subsection (5) may be construed to prohibit the use of geographic areas with a sufficient population size or aggregate gender, age, medical condition, or other characteristics in the generation of reports, so long as they cannot lead to the identification of an individual. (6) Recipients of claims or other data under subsection (4) of this section must agree in a data use agreement or a confidentiality agreement to, at a minimum: (a) Take steps to protect data containing direct patient identifiers, indirect patient identifiers, or any combination thereof as described in the agreement; (b) Not redisclose the claims data except pursuant to subsection (3) of this section; (c) Not attempt to determine the identity of any person whose information is included in the data set or use the claims or other data in any manner that identifies any individual or their family or attempt to locate information associated with a specific individual; (d) Destroy claims data at the conclusion of the data use agreement; and (e) Consent to the penalties associated with the inappropriate disclosures or uses of direct patient identifiers or indirect patient identifiers adopted under RCW 43.371.070 (1).

RCW 43.371.060 Health care data reports — Public comment period — Preparation — Contents — Publication or release of reports. (Effective until July 1, 2026.)

(1)(a) Under the supervision of and through contract with the authority, the lead organization shall prepare health care data reports using the database and the statewide health performance and quality measure set. Prior to the lead organization releasing any health care data reports that use claims data, the lead organization must submit the reports to the authority for review. (b) By October 31st of each year, the lead organization shall submit to the director a list of reports it anticipates producing during the following calendar year. The director may establish a public comment period not to exceed thirty days, and shall submit the list and any comment to the appropriate committees of the legislature for review. (2)(a) Health care data reports that use claims data prepared by the lead organization for the legislature and the public should promote awareness and transparency in the health care market by reporting on: (i) Whether providers and health systems deliver efficient, high quality care; and (ii) Geographic and other variations in medical care and costs as demonstrated by data available to the lead organization. (b) Measures in the health care data reports should be stratified by demography, income, language, health status, and geography when feasible with available data to identify disparities in care and successful efforts to reduce disparities. (c) Comparisons of costs among providers and health care systems must account for differences in the case mix and severity of illness of patients and populations, as appropriate and feasible, and must take into consideration the cost impact of subsidization for uninsured and government-sponsored patients, as well as teaching expenses, when feasible with available data. (3) The lead organization may not publish any data or health care data reports that: (a) Directly or indirectly identify individual patients; (b) Disclose a carrier's proprietary financial information; (c) Compare performance in a report generated for the general public that includes any provider in a practice with fewer than four providers; or (d) Contain medicaid data that is in direct conflict with the biannual medicaid forecast. (4) The lead organization may not release a report that compares and identifies providers, hospitals, or data suppliers unless: (a) It allows the data supplier, the hospital, or the provider to verify the accuracy of the information submitted to the data vendor, comment on the reasonableness of conclusions reached, and submit to the lead organization and data vendor any corrections of errors with supporting evidence and comments within thirty days of receipt of the report; (b) It corrects data found to be in error within a reasonable amount of time; and (c) The report otherwise complies with this chapter. (5) The authority and the lead organization may use claims data to identify and make available information on payers, providers, and facilities, but may not use claims data to recommend or incentivize direct contracting between providers and employers. (6) The lead organization shall make information about claims data related to the provision of air ambulance service available on a website that is accessible to the public in a searchable format by geographic region, provider, and other relevant information. (7)(a) The lead organization shall distinguish in advance to the authority when it is operating in its capacity as the lead organization and when it is operating in its capacity as a private entity. Where the lead organization acts in its capacity as a private entity, it may only access data pursuant to RCW 43.371.050 (4) (b), (c), or (d). (b) Except as provided in RCW 43.371.050 (4), claims or other data that contain direct patient identifiers or proprietary financial information must remain exclusively in the custody of the data vendor and may not be accessed by the lead organization. (1)(a) Under the supervision of and through contract with the authority, the lead organization shall prepare health care data reports using the database and the statewide health performance and quality measure set. Prior to the lead organization releasing any health care data reports that use claims data, the lead organization must submit the reports to the authority for review. (b) By October 31st of each year, the lead organization shall submit to the director a list of reports it anticipates producing during the following calendar year. The director may establish a public comment period not to exceed thirty days, and shall submit the list and any comment to the appropriate committees of the legislature for review. (2)(a) Health care data reports that use claims data prepared by the lead organization for the legislature and the public should promote awareness and transparency in the health care market by reporting on: (i) Whether providers and health systems deliver efficient, high quality care; and (ii) Geographic and other variations in medical care and costs as demonstrated by data available to the lead organization. (b) Measures in the health care data reports should be stratified by demography, income, language, health status, and geography when feasible with available data to identify disparities in care and successful efforts to reduce disparities. (c) Comparisons of costs among providers and health care systems must account for differences in the case mix and severity of illness of patients and populations, as appropriate and feasible, and must take into consideration the cost impact of subsidization for uninsured and government-sponsored patients, as well as teaching expenses, when feasible with available data. (3) The lead organization may not publish any data or health care data reports that: (a) Directly or indirectly identify individual patients; (b) Disclose a carrier's proprietary financial information; (c) Compare performance in a report generated for the general public that includes any provider in a practice with fewer than four providers; or (d) Contain medicaid data that is in direct conflict with the biannual medicaid forecast. (4) The lead organization may not release a report that compares and identifies providers, hospitals, or data suppliers unless: (a) It allows the data supplier, the hospital, or the provider to verify the accuracy of the information submitted to the data vendor, comment on the reasonableness of conclusions reached, and submit to the lead organization and data vendor any corrections of errors with supporting evidence and comments within thirty days of receipt of the report; (b) It corrects data found to be in error within a reasonable amount of time; and (c) The report otherwise complies with this chapter. (5) The authority and the lead organization may use claims data to identify and make available information on payers, providers, and facilities, but may not use claims data to recommend or incentivize direct contracting between providers and employers. (6) The lead organization shall make information about claims data related to the provision of air ambulance service available on a website that is accessible to the public in a searchable format by geographic region, provider, and other relevant information. (7)(a) The lead organization shall distinguish in advance to the authority when it is operating in its capacity as the lead organization and when it is operating in its capacity as a private entity. Where the lead organization acts in its capacity as a private entity, it may only access data pursuant to RCW 43.371.050 (4) (b), (c), or (d). (b) Except as provided in RCW 43.371.050 (4), claims or other data that contain direct patient identifiers or proprietary financial information must remain exclusively in the custody of the data vendor and may not be accessed by the lead organization.

RCW 43.371.060 Health care data reports — Public comment period — Preparation — Contents — Publication or release of reports. (Effective July 1, 2026.)

(1)(a) Under the supervision of and through contract with the authority, the lead organization shall prepare health care data reports using the database and the statewide health performance and quality measure set. Prior to the lead organization releasing any health care data reports that use claims data, the lead organization must submit the reports to the authority for review. (b) By October 31st of each year, the lead organization shall submit to the director a list of reports it anticipates producing during the following calendar year. The director may establish a public comment period not to exceed thirty days, and shall submit the list and any comment to the appropriate committees of the legislature for review. (2)(a) Health care data reports that use claims data prepared by the lead organization for the legislature and the public should promote awareness and transparency in the health care market by reporting on: (i) Whether providers and health systems deliver efficient, high quality care; and (ii) Geographic and other variations in medical care and costs as demonstrated by data available to the lead organization. (b) Measures in the health care data reports should be stratified by demography, income, language, health status, and geography when feasible with available data to identify disparities in care and successful efforts to reduce disparities. (c) Comparisons of costs among providers and health care systems must account for differences in the case mix and severity of illness of patients and populations, as appropriate and feasible, and must take into consideration the cost impact of subsidization for uninsured and government-sponsored patients, as well as teaching expenses, when feasible with available data. (3) The lead organization may not publish any data or health care data reports that: (a) Directly or indirectly identify individual patients; (b) Compare performance in a report generated for the general public that includes any provider in a practice with fewer than four providers; or (c) Contain medicaid data that is in direct conflict with the biannual medicaid forecast. (4) The lead organization may not release a report that compares and identifies providers, hospitals, or data suppliers unless: (a) It allows the data supplier, the hospital, or the provider to verify the accuracy of the information submitted to the data vendor, comment on the reasonableness of conclusions reached, and submit to the lead organization and data vendor any corrections of errors with supporting evidence and comments within thirty days of receipt of the report; (b) It corrects data found to be in error within a reasonable amount of time; and (c) The report otherwise complies with this chapter. (5) The authority and the lead organization may use claims data to identify and make available information on payers, providers, and facilities, but may not use claims data to recommend or incentivize direct contracting between providers and employers. (6) The lead organization shall make information about claims data related to the provision of air ambulance service available on a website that is accessible to the public in a searchable format by geographic region, provider, and other relevant information. (7)(a) The lead organization shall distinguish in advance to the authority when it is operating in its capacity as the lead organization and when it is operating in its capacity as a private entity. Where the lead organization acts in its capacity as a private entity, it may only access data pursuant to RCW 43.371.050 (4) (b)(v) or (c). (b) Except as provided in RCW 43.371.050 (4), claims or other data that contain direct patient identifiers must remain exclusively in the custody of the data vendor and may not be accessed by the lead organization. (1)(a) Under the supervision of and through contract with the authority, the lead organization shall prepare health care data reports using the database and the statewide health performance and quality measure set. Prior to the lead organization releasing any health care data reports that use claims data, the lead organization must submit the reports to the authority for review. (b) By October 31st of each year, the lead organization shall submit to the director a list of reports it anticipates producing during the following calendar year. The director may establish a public comment period not to exceed thirty days, and shall submit the list and any comment to the appropriate committees of the legislature for review. (2)(a) Health care data reports that use claims data prepared by the lead organization for the legislature and the public should promote awareness and transparency in the health care market by reporting on: (i) Whether providers and health systems deliver efficient, high quality care; and (ii) Geographic and other variations in medical care and costs as demonstrated by data available to the lead organization. (b) Measures in the health care data reports should be stratified by demography, income, language, health status, and geography when feasible with available data to identify disparities in care and successful efforts to reduce disparities. (c) Comparisons of costs among providers and health care systems must account for differences in the case mix and severity of illness of patients and populations, as appropriate and feasible, and must take into consideration the cost impact of subsidization for uninsured and government-sponsored patients, as well as teaching expenses, when feasible with available data. (3) The lead organization may not publish any data or health care data reports that: (a) Directly or indirectly identify individual patients; (b) Compare performance in a report generated for the general public that includes any provider in a practice with fewer than four providers; or (c) Contain medicaid data that is in direct conflict with the biannual medicaid forecast. (4) The lead organization may not release a report that compares and identifies providers, hospitals, or data suppliers unless: (a) It allows the data supplier, the hospital, or the provider to verify the accuracy of the information submitted to the data vendor, comment on the reasonableness of conclusions reached, and submit to the lead organization and data vendor any corrections of errors with supporting evidence and comments within thirty days of receipt of the report; (b) It corrects data found to be in error within a reasonable amount of time; and (c) The report otherwise complies with this chapter. (5) The authority and the lead organization may use claims data to identify and make available information on payers, providers, and facilities, but may not use claims data to recommend or incentivize direct contracting between providers and employers. (6) The lead organization shall make information about claims data related to the provision of air ambulance service available on a website that is accessible to the public in a searchable format by geographic region, provider, and other relevant information. (7)(a) The lead organization shall distinguish in advance to the authority when it is operating in its capacity as the lead organization and when it is operating in its capacity as a private entity. Where the lead organization acts in its capacity as a private entity, it may only access data pursuant to RCW 43.371.050 (4) (b)(v) or (c). (b) Except as provided in RCW 43.371.050 (4), claims or other data that contain direct patient identifiers must remain exclusively in the custody of the data vendor and may not be accessed by the lead organization.

RCW 43.371.070 Rules. (Effective until July 1, 2026.)

(1) The director shall adopt any rules necessary to implement this chapter, including: (a) Definitions of claim and data files that data suppliers must submit to the database, including: Files for covered medical services, pharmacy claims, and dental claims; member eligibility and enrollment data; and provider data with necessary identifiers; (b) Deadlines for submission of claim files; (c) Penalties for failure to submit claim files as required; (d) Procedures for ensuring that all data received from data suppliers are securely collected and stored in compliance with state and federal law; (e) Procedures for ensuring compliance with state and federal privacy laws; (f) Procedures for establishing appropriate fees; (g) Procedures for data release; (h) Penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, and proprietary financial information; and (i) A minimum reporting threshold below which a data supplier is not required to submit data. (2) The director may not adopt rules, policies, or procedures beyond the authority granted in this chapter. (1) The director shall adopt any rules necessary to implement this chapter, including: (a) Definitions of claim and data files that data suppliers must submit to the database, including: Files for covered medical services, pharmacy claims, and dental claims; member eligibility and enrollment data; and provider data with necessary identifiers; (b) Deadlines for submission of claim files; (c) Penalties for failure to submit claim files as required; (d) Procedures for ensuring that all data received from data suppliers are securely collected and stored in compliance with state and federal law; (e) Procedures for ensuring compliance with state and federal privacy laws; (f) Procedures for establishing appropriate fees; (g) Procedures for data release; (h) Penalties associated with the inappropriate disclosures or uses of direct patient identifiers, indirect patient identifiers, and proprietary financial information; and (i) A minimum reporting threshold below which a data supplier is not required to submit data. (2) The director may not adopt rules, policies, or procedures beyond the authority granted in this chapter.

RCW 43.371.070 Rules. (Effective July 1, 2026.)

(1) The director shall adopt any rules necessary to implement this chapter, including: (a) Definitions of claim and data files that data suppliers must submit to the database, including: Files for covered medical services, pharmacy claims, and dental claims; member eligibility and enrollment data; and provider data with necessary identifiers; (b) Deadlines for submission of claim files; (c) Penalties for failure to submit claim files as required; (d) Procedures for ensuring that all data received from data suppliers are securely collected and stored in compliance with state and federal law; (e) Procedures for ensuring compliance with state and federal privacy laws; (f) Procedures for establishing appropriate fees; (g) Procedures for data release; (h) Penalties associated with the inappropriate disclosures or uses of direct patient identifiers and indirect patient identifiers; and (i) A minimum reporting threshold below which a data supplier is not required to submit data. (2) The director may not adopt rules, policies, or procedures beyond the authority granted in this chapter. (1) The director shall adopt any rules necessary to implement this chapter, including: (a) Definitions of claim and data files that data suppliers must submit to the database, including: Files for covered medical services, pharmacy claims, and dental claims; member eligibility and enrollment data; and provider data with necessary identifiers; (b) Deadlines for submission of claim files; (c) Penalties for failure to submit claim files as required; (d) Procedures for ensuring that all data received from data suppliers are securely collected and stored in compliance with state and federal law; (e) Procedures for ensuring compliance with state and federal privacy laws; (f) Procedures for establishing appropriate fees; (g) Procedures for data release; (h) Penalties associated with the inappropriate disclosures or uses of direct patient identifiers and indirect patient identifiers; and (i) A minimum reporting threshold below which a data supplier is not required to submit data. (2) The director may not adopt rules, policies, or procedures beyond the authority granted in this chapter.

RCW 43.371.080 Cost, performance, and effectiveness of database and performance of lead organization — Reports to the legislature.

(1) The authority shall report every two years to the appropriate committees of the legislature regarding the cost, performance, and effectiveness of the database and the performance of the lead organization under its contract with the authority. Using independent economic expertise, subject to appropriation, the report must evaluate whether the database has advanced the goals set forth in RCW 43.371.020 (1), as well as the performance of the lead organization. The report must also make recommendations regarding but not limited to how the database can be improved, whether the contract for the lead organization should be modified, renewed, or terminated, and the impact the database has had on competition between and among providers, purchasers, and payers. (2) The authority shall annually report to the appropriate committees of the legislature regarding any additional grants received or extended. (1) The authority shall report every two years to the appropriate committees of the legislature regarding the cost, performance, and effectiveness of the database and the performance of the lead organization under its contract with the authority. Using independent economic expertise, subject to appropriation, the report must evaluate whether the database has advanced the goals set forth in RCW 43.371.020 (1), as well as the performance of the lead organization. The report must also make recommendations regarding but not limited to how the database can be improved, whether the contract for the lead organization should be modified, renewed, or terminated, and the impact the database has had on competition between and among providers, purchasers, and payers. (2) The authority shall annually report to the appropriate committees of the legislature regarding any additional grants received or extended.

RCW 43.371.090 State agency coordinating structure — Biennial review — Recommendations. (Effective until July 1, 2026.)

(1) To ensure the database is meeting the needs of state agencies and other data users, the authority shall convene a state agency coordinating structure, consisting of state agencies with related data needs and the Washington health benefit exchange to ensure effectiveness of the database and the agencies' programs. The coordinating structure must collaborate in a private/public manner with the lead organization and other partners key to the broader success of the database. The coordinating structure shall advise the authority and lead organization on the development of any database policies and rules relevant to agency data needs. (2) The office must participate as a key part of the coordinating structure and evaluate progress towards meeting the goals of the database, and, as necessary, recommend strategies for maintaining and promoting the progress of the database in meeting the intent of this section, and report its findings biennially to the governor and the legislature. The authority shall facilitate the office obtaining the information needed to complete the report in a manner that is efficient and not overly burdensome for the parties. The authority must provide the office with access to database processes, procedures, nonproprietary methodologies, and outcomes to conduct the review and issue the biennial report. The biennial review shall assess, at a minimum the following: (a) The list of approved agency use case projects and related data requirements under RCW 43.371.050 (4); (b) Successful and unsuccessful data requests and outcomes related to agency and nonagency health researchers pursuant to RCW 43.371.050 (4); (c) Online data portal access and effectiveness related to research requests and data provider review and reconsideration; (d) Adequacy of data security and policy consistent with the policy of Washington technology solutions; and (e) Timeliness, adequacy, and responsiveness of the database with regard to requests made under RCW 43.371.050 (4) and for potential improvements in data sharing, data processing, and communication. (3) To promote the goal of improving health outcomes through better cost and quality information, the authority, in consultation with the agency coordinating structure, the office, lead organization, and data vendor shall make recommendations to the Washington state performance measurement coordinating committee as necessary to improve the effectiveness of the state common measure set as adopted under RCW 70.320.030 . (1) To ensure the database is meeting the needs of state agencies and other data users, the authority shall convene a state agency coordinating structure, consisting of state agencies with related data needs and the Washington health benefit exchange to ensure effectiveness of the database and the agencies' programs. The coordinating structure must collaborate in a private/public manner with the lead organization and other partners key to the broader success of the database. The coordinating structure shall advise the authority and lead organization on the development of any database policies and rules relevant to agency data needs. (2) The office must participate as a key part of the coordinating structure and evaluate progress towards meeting the goals of the database, and, as necessary, recommend strategies for maintaining and promoting the progress of the database in meeting the intent of this section, and report its findings biennially to the governor and the legislature. The authority shall facilitate the office obtaining the information needed to complete the report in a manner that is efficient and not overly burdensome for the parties. The authority must provide the office with access to database processes, procedures, nonproprietary methodologies, and outcomes to conduct the review and issue the biennial report. The biennial review shall assess, at a minimum the following: (a) The list of approved agency use case projects and related data requirements under RCW 43.371.050 (4); (b) Successful and unsuccessful data requests and outcomes related to agency and nonagency health researchers pursuant to RCW 43.371.050 (4); (c) Online data portal access and effectiveness related to research requests and data provider review and reconsideration; (d) Adequacy of data security and policy consistent with the policy of Washington technology solutions; and (e) Timeliness, adequacy, and responsiveness of the database with regard to requests made under RCW 43.371.050 (4) and for potential improvements in data sharing, data processing, and communication. (3) To promote the goal of improving health outcomes through better cost and quality information, the authority, in consultation with the agency coordinating structure, the office, lead organization, and data vendor shall make recommendations to the Washington state performance measurement coordinating committee as necessary to improve the effectiveness of the state common measure set as adopted under RCW 70.320.030 .

RCW 43.371.090 State agency coordinating structure — Review — Recommendations. (Effective July 1, 2026.)

(1) To ensure the database is meeting the needs of state agencies and other data users, the authority shall convene a state agency coordinating structure, consisting of state agencies with related data needs and the Washington health benefit exchange to ensure effectiveness of the database and the agencies' programs. The coordinating structure must collaborate in a private/public manner with the lead organization and other partners key to the broader success of the database. The coordinating structure shall advise the authority and lead organization on the development of any database policies and rules relevant to agency data needs. (2) The office must participate as a key part of the coordinating structure and evaluate progress towards meeting the goals of the database, and, as necessary, recommend strategies for maintaining and promoting the progress of the database in meeting the intent of this section, and report its findings every five years to the governor and the legislature. The authority shall facilitate the office obtaining the information needed to complete the report in a manner that is efficient and not overly burdensome for the parties. The authority must provide the office with access to database processes, procedures, nonproprietary methodologies, and outcomes to conduct the review and issue the five-year report. The five-year review shall assess, at a minimum the following: (a) The list of approved agency use case projects and related data requirements under RCW 43.371.050 (4); (b) Successful and unsuccessful data requests and outcomes related to agency and nonagency health researchers pursuant to RCW 43.371.050 (4); (c) Online data portal access and effectiveness related to research requests and data provider review and reconsideration; (d) Adequacy of data security and policy consistent with the policy of Washington technology solutions; and (e) Timeliness, adequacy, and responsiveness of the database with regard to requests made under RCW 43.371.050 (4) and for potential improvements in data sharing, data processing, and communication. (3) To promote the goal of improving health outcomes through better cost and quality information, the authority, in consultation with the agency coordinating structure, the office, lead organization, and data vendor shall make recommendations to the Washington state performance measurement coordinating committee as necessary to improve the effectiveness of the state common measure set as adopted under RCW 70.320.030 . (1) To ensure the database is meeting the needs of state agencies and other data users, the authority shall convene a state agency coordinating structure, consisting of state agencies with related data needs and the Washington health benefit exchange to ensure effectiveness of the database and the agencies' programs. The coordinating structure must collaborate in a private/public manner with the lead organization and other partners key to the broader success of the database. The coordinating structure shall advise the authority and lead organization on the development of any database policies and rules relevant to agency data needs. (2) The office must participate as a key part of the coordinating structure and evaluate progress towards meeting the goals of the database, and, as necessary, recommend strategies for maintaining and promoting the progress of the database in meeting the intent of this section, and report its findings every five years to the governor and the legislature. The authority shall facilitate the office obtaining the information needed to complete the report in a manner that is efficient and not overly burdensome for the parties. The authority must provide the office with access to database processes, procedures, nonproprietary methodologies, and outcomes to conduct the review and issue the five-year report. The five-year review shall assess, at a minimum the following: (a) The list of approved agency use case projects and related data requirements under RCW 43.371.050 (4); (b) Successful and unsuccessful data requests and outcomes related to agency and nonagency health researchers pursuant to RCW 43.371.050 (4); (c) Online data portal access and effectiveness related to research requests and data provider review and reconsideration; (d) Adequacy of data security and policy consistent with the policy of Washington technology solutions; and (e) Timeliness, adequacy, and responsiveness of the database with regard to requests made under RCW 43.371.050 (4) and for potential improvements in data sharing, data processing, and communication. (3) To promote the goal of improving health outcomes through better cost and quality information, the authority, in consultation with the agency coordinating structure, the office, lead organization, and data vendor shall make recommendations to the Washington state performance measurement coordinating committee as necessary to improve the effectiveness of the state common measure set as adopted under RCW 70.320.030 .

RCW 43.371.100 Development of data set and business process to assist in determining commercially reasonable payment amounts and resolving out-of-network payment disputes for medical services covered under the balance billing protection act.

(1) The office of the insurance commissioner shall contract with the state agency responsible for administration of the database and the lead organization to establish a data set and business process to provide health carriers, health care providers, hospitals, ambulatory surgical facilities, and arbitrators with data to assist in determining commercially reasonable payments and resolving payment disputes for out-of-network medical services rendered by health care facilities or providers. (a) The data set and business process must be developed in collaboration with health carriers, health care providers, hospitals, and ambulatory surgical facilities. (b) The data set must provide the amounts for the services described in RCW 48.49.020 . The data used to calculate the median in-network and out-of-network allowed amounts and the median billed charge amounts by geographic area, for the same or similar services, must be drawn from commercial health plan claims, and exclude medicare and medicaid claims as well as claims paid on other than a fee-for-service basis. (c) The data set and business process must be available beginning November 1, 2019, and must be reviewed by an advisory committee established under this chapter that includes representatives of health carriers, health care providers, hospitals, and ambulatory surgical facilities for validation before use. (2) The 2019 data set must be based upon the most recently available full calendar year of claims data. The data set for each subsequent year must be adjusted by applying the consumer price index-medical component established by the United States department of labor, bureau of labor statistics to the previous year's data set. (3) Until December 31, 2030, the office of the insurance commissioner shall contract with the state agency responsible for administration of the database or other organizations biennially beginning in 2022, for an analysis of commercial health plan claims data to assess any impact that chapter 48.49 RCW or P.L. 116-260 have had or may have had on payments to participating and nonparticipating providers and facilities and on the volume and percentage of claims that are provided by participating compared to nonparticipating providers. To the extent that data related to self-funded group health plans is available within funds appropriated for this purpose, the analysis may include such data. The first analysis shall compare 2019 claims data to the most recent full year's claims data. The analysis must be published on the website of the office of the insurance commissioner, with the first analysis published on or before December 15, 2022. (1) The office of the insurance commissioner shall contract with the state agency responsible for administration of the database and the lead organization to establish a data set and business process to provide health carriers, health care providers, hospitals, ambulatory surgical facilities, and arbitrators with data to assist in determining commercially reasonable payments and resolving payment disputes for out-of-network medical services rendered by health care facilities or providers. (a) The data set and business process must be developed in collaboration with health carriers, health care providers, hospitals, and ambulatory surgical facilities. (b) The data set must provide the amounts for the services described in RCW 48.49.020 . The data used to calculate the median in-network and out-of-network allowed amounts and the median billed charge amounts by geographic area, for the same or similar services, must be drawn from commercial health plan claims, and exclude medicare and medicaid claims as well as claims paid on other than a fee-for-service basis. (c) The data set and business process must be available beginning November 1, 2019, and must be reviewed by an advisory committee established under this chapter that includes representatives of health carriers, health care providers, hospitals, and ambulatory surgical facilities for validation before use. (2) The 2019 data set must be based upon the most recently available full calendar year of claims data. The data set for each subsequent year must be adjusted by applying the consumer price index-medical component established by the United States department of labor, bureau of labor statistics to the previous year's data set. (3) Until December 31, 2030, the office of the insurance commissioner shall contract with the state agency responsible for administration of the database or other organizations biennially beginning in 2022, for an analysis of commercial health plan claims data to assess any impact that chapter 48.49 RCW or P.L. 116-260 have had or may have had on payments to participating and nonparticipating providers and facilities and on the volume and percentage of claims that are provided by participating compared to nonparticipating providers. To the extent that data related to self-funded group health plans is available within funds appropriated for this purpose, the analysis may include such data. The first analysis shall compare 2019 claims data to the most recent full year's claims data. The analysis must be published on the website of the office of the insurance commissioner, with the first analysis published on or before December 15, 2022.
Source: WA Statutes (Official Site)URL: https://app.leg.wa.gov/RCW/default.aspx?cite=43.371&full=trueFetched: 6/29/2026