- (1) A recipient must have a data sharing agreement with a subrecipient before giving the subrecipient access to protected personal information. The data sharing agreement terms need not be in a stand-alone document, but may be included in a general contract.
- (2) The subrecipient data sharing agreement must include those requirements that the department has identified in the recipient's data sharing agreement as those to be passed on to subrecipient. A subrecipient data sharing agreement that does not contain all necessary requirements will not be considered adequate.
[Statutory Authority: RCW 46.01.110. WSR 23-19-010, § 308-10A-301, filed 9/7/23, effective 10/8/23.]