Privacy Statement

Overall Purpose

This Privacy Statement explains how DOH processes personal information in pursuit of its public health mission, consistent with the Statewide Privacy Principles (PDF).

Personal Information

DOH collects various types of information to provide public health services and it only uses that information in ways the law allows. To provide some public services, DOH collects personal information, meaning it collects information that could identify an individual. As used in this privacy statement, personal information means information that can identify a specific individual, either directly or indirectly. Personal information may also be referred to as personally identifiable information (PII). Personal information may include your name, address, and phone number, as well as information that can be combined with other information to identify you.

We identify the reasons for collecting information before we collect it, and we limit our use and disclosure to what is reasonably necessary to meet those purposes. If you have questions about how DOH uses your personal information, you may email the DOH Privacy Office at Privacy.Officer@doh.wa.gov.

Information About Immigration and Citizenship Status

DOH serves all Washington residents without regard to immigration or citizenship status. We are committed to following the Governor’s Executive Order 17-01 (PDF) and the Keep Washington Working Act. We don’t inquire, request, or collect information related to immigration or citizenship status unless doing so is necessary to determine eligibility for services, or is otherwise required by law. We don't disclose personal immigration or citizenship information to any person engaged, or intending to engage, in immigration enforcement, including federal immigration authorities, unless required by law.

Personal Information DOH Collects and How It’s Used

Health Information

Various laws direct DOH to collect health information. Health information is information from a health care provider that relates to a patient. DOH follows all relevant privacy laws when handling health information, including Washington’s health privacy law, the Uniform Health Care Information Act. Health information is confidential, as provided under the Public Records Act, chapter 42.56 RCW. It is only used for authorized purposes and disclosed outside DOH only when allowed by law.

DOH uses health information to provide public health services. For example, DOH collects health information from health care providers as part of disease reporting requirements. DOH may use the information to investigate and stop outbreaks, remove harmful health exposures from the environment, assess broader health-related patterns, inform health care providers about treatment and exposure, redirect program activities, and develop policies based on broader health-related patterns.

The types of health information DOH collects include:

Health-Related Data

DOH collects health-related data from private entities, such as insurance companies, health care providers, as well as other state agencies that collect or have data relevant to assessing public health. Health-related data may include some personal information. Health-related data includes, but is not limited to, data on needed health services, health care facilities, and personnel; emerging bioethical issues; health promotion; recommendations from state and national organizations and associations; and programmatic and statutory changes needed to address emerging health needs.

DOH uses this data to understand health care costs, innovations in the delivery of health care services, competition in the health care marketplace; identify high-priority health issues that require study or evaluation; inform communities and public health partners about health issues; and inform public health assessments and the state health report.

DOH may publish health-related data, but the law requires DOH to keep the identity of patients and their health care providers confidential.

Professional or Licensing Information

DOH maintains the Healthcare Enforcement and Licensing Management System (HELMS) for individuals to obtain or renew a professional license or credentials with DOH (e.g., health care providers). DOH collects information related to identity and professional qualifications. This can include license application details, education and training information, background checks, or other information required by law to license and regulate health professionals. DOH uses this information to process licenses and ensure compliance with health regulations.

Vital Records

DOH supports a vital records system that collects personal information related to a vital life event. Vital life events include a birth, death, fetal death, marriage, dissolution of marriage, dissolution of domestic partnership, declaration of invalidity of marriage, declaration of invalidity of domestic partnership, and legal separation. Information collected at vital life events is used for population health data for assessment, evaluation, research, and other public health purposes.

DOH manages these records in accordance with Chapter 70.58A RCW. Some information on vital records is entered in public health surveillance systems or included in annual reports, such as the death with dignity data and violent deaths data.

Prescription Monitoring Program Information

DOH collects information from dispensers to operate a prescription monitoring program to improve health care quality and effectiveness by reducing abuse of controlled substances. WAC 246-470-030 describes the information submitted for each prescription, which includes information about the patient, drug dispensed, date of dispensing, quantity dispensed, and prescriber. DOH uses the information to monitor the prescribing and dispensing of controlled substances.

DOH manages these records in accordance with Chapter 70.225 RCW. Under RCW 70.225.040, prescription monitoring information is confidential, and maintained in compliance with chapter 70.02 RCW and federal health care information privacy requirements. Health care providers may retain prescription monitoring information with the patient's health care records, which are protected by state and federal law.

Population Health Surveys

DOH collects personal information when conducting surveys by telephone, mail, or online. The surveys usually include a range of topics, such as health behaviors, access to resources, and demographic information. DOH population health surveys are always voluntary, will never ask for your social security number, and will never require you to make payment or share banking information.

DOH uses information from surveys to help describe the health status of a population, identify areas for improvement, and monitor changes over time. These surveys are often used to create dashboards and reports that anyone can view publicly online. Population health survey results are subject to the Public Records Act, along with any disclosure exemption criteria that may apply. The surveys DOH conducts include:

Website Usage

When you visit the DOH website, DOH automatically collects certain information about your visit. This information helps us improve our web services and understand how the site is being used. For more information, see our Website Privacy Notice.

How DOH Collects Personal Information

DOH collects personal information when members of the public use our services: online, in-person, or by phone. DOH also collects personal information about individuals from its public health partners, health care providers and other agencies when it is necessary to accomplish its public health mission. Information is collected automatically, voluntarily, or by specific request using data share agreements.

Information You Provide Directly

DOH collects personal information that you voluntarily provide to us if it will help us achieve our public health mission. This may include identifying details such as your name, address, telephone number, email address, or other contact information. For example, if you send us an email, fill out an online form, or request a service, we may collect the information you submit.

Online Services

DOH collects information you provide through our online services, including when you:

  • Submit a complaint
  • Apply for or renew a professional license
  • Apply for or renew a Washington state food worker card
  • Request or update vital records
  • Request or update immunization records
  • Complete a survey

Maintaining this information is central to DOH’s mission, and we take steps to make sure this information is accurate and well-protected. For more information, see Securing Your Information.

Business Transfers

DOH sometimes collects personal information from external partners to provide public health services and comply with state laws. DOH enters a data share agreement when collecting personal information from external partners unless otherwise directed by law. DOH receives personal information from:

  • Health care providers
  • Local health jurisdictions and other public health agencies
  • Tribal organizations
  • Other Washington state agencies
  • Authorized 3rd-party service providers who provide contracted services to DOH
  • Law enforcement or other government entities, as required by law
  • Other entities, as required or allowed by law

Our authorized information providers send sensitive or confidential information to DOH through secure channels, such as Secure Access Washington (SAW), Managed File Transfer (MFT), or via the Health Information Exchange.

Feedback Survey Responses

We use surveys to collect feedback about our services and websites. These include the "Was this information helpful?" prompts at the bottom of many of our webpages, and the "Tell us how we’re doing" prompts after you complete a task online.

If you volunteer information through a survey, we may:

Social Media

DOH maintains several social media accounts and a Granicus account. We use these sites to engage with members of the public. We don’t collect person information through these sites, but any information you make public is viewable. If you submit a question or comment to us through social media, we may reply directly to you on that site.

Calls Monitored for Quality Assurance

Like many organizations, DOH may monitor phone calls to improve customer service. All monitoring of phone calls is done in real time. DOH does not generate or maintain recordings of phone calls.

Information Sharing

Sharing information involves any relationship where a person or organization outside the agency receives, hosts, or has access to information, including access to systems or applications. DOH shares or releases personal information only when allowed by law. DOH does not sell personal information and DOH shares the least information possible to meet the recipient’s needs.

Who DOH Shares Information With

The primary reason DOH shares personal information is to accomplish its public health mission. DOH shares data for public health purposes with other public health authorities at the federal, state, local, and Tribal level; health care providers; contractors; public health funding agencies; and other state and federal agencies and entities with a public health purpose when authorized by law. When this happens, DOH shares only what is needed to accomplish the purpose, and DOH works to protect people and communities from misuse of their information.

In addition, DOH shares personal information with researchers when approved by the Washington State Institutional Review Board (WSIRB). WSIRB ensures that researchers follow federal standards (45 CFR 46) that protect the rights and welfare of people participating in the research. The research project must minimize risks to participants and use appropriate study methods.

DOH may also share personal information with another agency when required by law to support the requesting agency’s mission. For example, DOH may share personal information when requested by the Office of the State Auditor. Before any information is shared, DOH reviews the request through its data sharing process to ensure the requesting agency is legally authorized to receive and use the information.

How DOH Shares Personal Information

Data Sharing Agreements and Contracts

State law requires DOH to enter into data sharing agreements before sharing personal information outside the agency, except when responding to public records requests. Sharing includes any arrangement in which a person or organization outside DOH receives, hosts, or has access to information, including access to systems or applications. DOH follows WAC 246-08-390, Washington Technology Solutions' (WaTech) Data Sharing Policy and Washington's data sharing agreement laws (RCW 39.26.340 and RCW 39.24.240) when it shares personal information that is not available through a public records request. When DOH shares personal information with a contractor, the required data sharing agreement is included as part of a contract.

When DOH receives a request for personal information, it reviews the request for privacy, security, and technical concerns and resolves any issues in an agreement with the partner or contractor before any information is shared. Data sharing agreements describe the personal information being shared and document:

  • The purpose for access to the data or information
  • The laws that permit sharing of personal information
  • Restrictions on how the recipient can use and share the data
  • Data security requirements for how the recipient will manage, store, and dispose of the data at end of the agreement
  • The right for DOH to conduct audits to make sure the recipient is following all requirements
  • Annual assessments and certifications confirming the recipient is still in compliance
  • Requirements to notify DOH if there is a data breach or a misuse of the data

Confidentiality Agreements

A confidentiality agreement is a type of data sharing agreement used to share personal information for research projects approved by the Washington State Institutional Review Board (WSIRB). Confidentiality agreements are used when it’s not possible or feasible to obtain an individual’s consent to use their personal information for research. Researchers agree to privacy and security requirements and the agreement describes the legal authority for the use or disclosure of personally identifiable records for research. For more information about confidentiality agreements, visit the state Department of Social and Human Services Frequently Asked Questions page.

Publicly Available Information

DOH shares information on the Washington state Open Data Portal, which is a portal of free public data provided by Washington state agencies and partners. The data DOH shares on the Open Data Portal is public "Category 1" data, meaning the data doesn't include protected personal or confidential information. Find out more about the data categories and the open data program from WaTech.

DOH and its partners may also publish de-identified or other non-sensitive data for public health purposes or to comply with state laws. When DOH publishes data, it follows statistical guidelines to reduce the risk that a person could be identified by the report.

Public Records Requests

Information DOH collects from its partners, or directly from you, may become a record subject to public inspection and copying under the Public Records Act. However, most of the personal information DOH collects is protected from release and will be withheld or redacted when DOH responds to public record requests.

The Public Records Act promotes government transparency and allows the public to access records and information DOH maintains, unless the records are protected from release by state or federal law. The exceptions below balance the public interest in government transparency with the protection of individual privacy.

If there’s a conflict between DOH’s privacy statement or privacy practices and the Public Records Act, the Public Records Act will take precedence. See our Public Records page for more information.

Common Public Records Exemptions

State and federal law provide specific exemptions that protect certain types of information from disclosure in response to a public records request. Examples of common exemptions include:

  • Social Security numbers – DOH will not release Social Security numbers, unless required by law (RCW 42.56.230).
  • Vital Records Data – DOH will not release vital records data without a data sharing agreement, unless required by law (Disclosure of Vital Records, Data, and Vital Statistics).
  • Health care information – DOH will not release health care information without a data sharing agreement, unless required by law (Health care).
  • Immunization Data – DOH will not release immunization data without a data sharing agreement, unless required by law (Health Care Information Access and Disclosure).
  • Immigration and Citizenship Data – DOH will not release immigration and citizenship data unless required by law and under a valid data sharing agreement (Immigration and Citizenship Status).

Securing Your Information

DOH uses administrative, technical, and physical security practices to protect the confidentiality, integrity, availability, and control of personal information. These measures block unknown or unauthorized access to our systems with personal information and ensure the information is accurate.

Securing Online Transactions

When you complete a task with DOH online—such as renewing a license—you’re using our secure online services. We verify your identity using:

  • A username and password
  • A PIN number
  • A digital certificate
  • Other methods of authentication

We do not disclose your secure login information, such as username and password. Information submitted to us through secure services is only disclosed when required by law.

You can help secure your data by adding an email address to your account. This allows us to notify you if someone makes changes to your information.

Data Security and Access

DOH implements technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes following strict policies and procedures when granting access to personal information. Personal information is stored securely and only accessible to authorized personnel who require access to perform their job duties, and who are subject to strict confidentiality requirements.

How We Address Data Security Issues

DOH requires staff to report privacy and security issues and follows a consistent process to investigate, mitigate, and resolve incidents. If DOH finds that a data recipient is not following security requirements, or is misusing data, DOH requires that they take steps to comply with contractual agreements and report corrective actions taken.

Notifying You of Security Breaches

As required by state law, DOH will notify you if there is a breach of our security systems that results in unauthorized access of your personal information and there is a risk of harm. We will notify you as soon as possible, no later than 30 calendar days after DOH discovers the breach, unless law enforcement requests that DOH delay notice.

Retention and Deletion of Personal Information

DOH retains information and records according to records retention schedules published by the Washington State Archives. These schedules are reviewed and may be updated by the Washington State Archives over time.

Your Rights and Our Responsibilities

When DOH publishes reports, data, or dashboards, DOH follows guidance to reduce the risk that individuals can be identified. You may explore DOH reports and data or visit the Washington State Open Data Portal to view data that is publicly available.

View Your Information

When possible, DOH provides individuals with the opportunity to view their personal information. Visit these links to look up data on your own:

Make a Specific Request for Personal Information

Correct Your Information

Since DOH collects personal information (see Personal Information DOH Collects and How It’s Used), DOH provides a process, when possible, to request corrections to any information you believe is inaccurate. You may ask to see what information we have about you, request public records, or ask us to correct your information. If we received your personal information from a partner—such as a health care provider—we may direct you to contact that partner to make any necessary corrections.

To correct your information, you may:

  • Send a written request to DOH clearly explaining the error, and we’ll verify your identity and work to correct it.
  • Use the DOH feedback form online or call 1-800-525-0127 (TTY: call 711). We'll discuss what types of documents we need to make the correction.
  • If you are a target for threats or harassment, contact the Address Confidentiality Program to request that DOH keep your address confidential.

If you need additional assistance correcting your personally identifiable information, email Privacy.Officer@doh.wa.gov.

Get Help Dealing With Scams

Look out for scams online, over email, and by phone. Scammers often use information about you to trick you into thinking they are legitimate. They may use a website that looks official or "spoof" a phone number when calling to make them appear trustworthy. DOH will never ask you for your social security number or credit card or bank information over the phone. If you get a call from someone claiming to be from DOH and asking for this information, hang up and contact DOH directly.