Washington Revised Code Title 43. State Government--Executive § 43.371.020. Statewide all-payer health care claims database--Selection and duties of lead organization--Certification as qualified entity pursuant to 42 C.F.R. Sec. 401.703(a)--Contract with data vendor

(b) Due to the complexities of the all-payer claims database and the unique privacy, quality, and financial objectives, the authority must give strong consideration to the following elements in determining the appropriate lead organization contractor: (i) The organization's degree of experience in health care data collection, analysis, analytics, and security; (ii) whether the organization has a long-term self-sustainable financial model; (iii) the organization's experience in convening and effectively engaging stakeholders to develop reports, especially among groups of health providers, carriers, and self-insured purchasers; (iv) the organization's experience in meeting budget and timelines for report generations; and (v) the organization's ability to combine cost and quality data to assess total cost of care.

(c) The successful lead organization must apply to be certified as a qualified entity pursuant to 42 C.F.R. Sec. 401.703(a) by the centers for medicare and medicaid services.

(d) The authority may not select a lead organization that:

(a) Establish a secure data submission process with data suppliers;

(b) Review data submitters' files according to standards established by the authority;

(c) Assess each record's alignment with established format, frequency, and consistency criteria;

(d) Maintain responsibility for quality assurance, including, but not limited to: (i) The accuracy and validity of data suppliers' data; (ii) accuracy of dates of service spans; (iii) maintaining consistency of record layout and counts; and (iv) identifying duplicate records;

(e) Assign unique identifiers, as defined in RCW 43.371.010, to individuals represented in the database;

(f) Ensure that direct patient identifiers, indirect patient identifiers, and proprietary financial information are released only in compliance with the terms of this chapter;

(g) Demonstrate internal controls and affiliations with separate organizations as appropriate to ensure safe data collection, security of the data with state of the art encryption methods, actuarial support, and data review for accuracy and quality assurance;

(h) Store data on secure servers that are compliant with the federal health insurance portability and accountability act and regulations, with access to the data strictly controlled and limited to staff with appropriate training, clearance, and background checks; and

(i) Maintain state of the art security standards for transferring data to approved data requestors.

(a) Collect claims data from data suppliers as provided in RCW 43.371.030;

(b) Design data collection mechanisms with consideration for the time and cost incurred by data suppliers and others in submission and collection and the benefits that measurement would achieve, ensuring the data submitted meet quality standards and are reviewed for quality assurance;

(c) Ensure protection of collected data and store and use any data in a manner that protects patient privacy and complies with this section. All patient-specific information must be deidentified with an up-to-date industry standard encryption algorithm;

(d) Consistent with the requirements of this chapter, make information from the database available as a resource for public and private entities, including carriers, employers, providers, hospitals, and purchasers of health care;

(e) Report performance on cost and quality pursuant to RCW 43.371.060 using, but not limited to, the performance measures developed under RCW 41.05.690;

(f) Develop protocols and policies, including prerelease peer review by data suppliers, to ensure the quality of data releases and reports;

(g) Develop a plan for the financial sustainability of the database as may be reasonable and customary as compared to other states' databases and charge fees for reports and data files as needed to fund the database. Any fees must be approved by the authority and should be comparable, accounting for relevant differences across data requests and uses. The lead organization may not charge providers or data suppliers fees other than fees directly related to requested reports and data files; and

(h) Convene advisory committees with the approval and participation of the authority, including: (i) A committee on data policy development; and (ii) a committee to establish a data release process consistent with the requirements of this chapter and to provide advice regarding formal data release requests. The advisory committees must include in-state representation from key provider, hospital, public health, health maintenance organization, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data to the database.