Before giving a subrecipient access to protected personal information, the recipient must validate that the subrecipient demonstrates the following minimum requirements:
- (1) The subrecipient has a permissible use under federal or Washington state laws, whichever is more restrictive.
- (2) The subrecipient is a qualified recipient under federal or Washington state laws.
- (3) The subrecipient has sufficient protections in place to secure the privacy of the protected personal information in accordance with the data sharing agreement.
[Statutory Authority: RCW 46.01.110. WSR 23-19-010, § 308-10A-202, filed 9/7/23, effective 10/8/23.]