Relating to the establishment of the sickle cell disease registry.

Contracts

• EMR/EHR Vendors: You must amend service agreements to require a system update that creates a "hard stop" on data transmission. The system must not upload Sickle Cell data to the state unless a specific "Consent Obtained" field is validated.
• Business Associate Agreements (BAAs): Review BAAs with downstream data processors. Ensure they acknowledge that this specific dataset requires explicit consent and cannot be aggregated or shared under standard TPO (Treatment, Payment, Operations) provisions without it.

Hiring/Training

• Intake & Registration Staff: Train staff to distinguish between general HIPAA releases and the specific Sickle Cell Registry consent. They must be trained to present the option neutrally and record the patient's decision accurately.
• Medical Records/HIM: Staff must be trained to verify the presence of a signed consent form before releasing any records to DSHS for this registry.

Reporting & Record-Keeping

• Consent Documentation: You must implement a specific consent form (or a distinct section in admission paperwork) authorizing disclosure to the registry.
• Audit Trails: Maintain a permanent log linking the data submission to the specific signed consent form. If DSHS audits your facility, you must produce the consent record for every patient submitted.
• Opt-Out Processing: Establish a protocol to handle patients who initially consent but later withdraw. You must have a mechanism to notify DSHS to scrub their data.

Fees & Costs

• IT Remediation: Budget for one-time costs to modify EMR interfaces to handle the conditional logic (Consent = Yes/No).
• No Filing Fees: There are no statutory fees for submitting data to the registry.