Compliance

Regulatory response guidance

Objective: This guidance is meant to assist University of Washington front-line staff (including student employees) and supervisors to respond appropriately to requests by government agency officials to obtain information from data or documents in the University’s custody, and to avoid an inadvertent or unauthorized release of data or documents which include the personal information of faculty, staff or students.

This guidance does not supplant UW Medicine Compliance or other applicable policies regarding patient privacy, information security, or legal process. Staff should continue to observe those policies.*

Guidance for responding to information requests
The University of Washington is subject to numerous laws, regulations and contract provisions which may give certain federal and state government agencies the authority to inspect data or documents in the University’s custody. Many of these requests are handled by designated subject matter experts throughout the University who are familiar with appropriate regulatory response practices. Other staff members may have received specific instructions on how to respond to certain requests such as transcript requests and public record requests. This guidance is not intended to supplant those specific instructions. Some unusual requests, however, may be received by front-line staff in central administration units such as the Office of the University Registrar, Enrollment Information Services, Student Life or Office of Student Financial Aid. The following guidance is intended to help front-line staff and their supervisors to act appropriately in response to such requests from governmental agencies or law enforcement officials.

Requests made by telephone, email or letter

Front-line staff
If you receive a written request to provide documents in the form of an email, a letter, a subpoena or a warrant:

  • Deliver it immediately to your supervisor.
  • Do not attempt to gather or provide the records yourself without instructions from your supervisor.

Supervisors
When you receive a written request for data or documents:

  • Unless you determine that there is another UW applicable process such as the public records process, immediately call the Attorney General’s Office (AGO) at 206-543-4150. You will be asked to forward the written request to the AGO, along with your contact information. Such requests are typically time-sensitive, invested with the authority of law and requiring action by the party to whom they are directed, and should be forwarded as quickly and securely as possible.
  • The AGO will work with appropriate offices to ensure that the release is legally required and to help determine who can serve as the UW point of contact with regard to the request. The AGO will also provide guidance regarding whether and how the UW should respond to the request, including the process for gathering any information that is responsive to the request, ensuring that the record is complete, and tracking the request and any data or documents released as a result of the request.

In-person requests

Front-line staff

If someone representing himself or herself as a regulatory, governmental or law enforcement official appears at your office, facility or workstation and requests records, documents, or information, and you have not been otherwise instructed by your supervisor to follow a specific protocol, you are advised to:

  • Obtain the name, title, agency, phone number and address of the individual.
  • Ask the visitor to be seated in a public area or remain outside the office or facility while you contact your supervisor.
  • Lock your computer.
  • Report the visitor and the request to your supervisor, with any details you can recall about the type of information being requested.
  • Do not attempt to gather or provide the records yourself.
  • Do not give the visitor access to paper or electronic records. If the visitor continues to ask you questions, explain that you aren’t authorized to respond.

Supervisors
When a member of your staff reports a visit from a regulatory, governmental or law enforcement official, you are advised to:

  • Immediately introduce yourself to the visitor.
  • Politely ask what information is being requested and under what authority the request is being made. Tell the visitor you will return shortly.
  • If you ascertain that the visitor is not a government or law enforcement official, but a member of the public seeking information, then refer the individual to the University’s Public Records Office or other applicable office.
  • If the individual is acting on behalf of a governmental entity or law enforcement, then immediately call the Attorney General’s Office (AGO) at 206-543-4150, or if you are aware of the matter being within the authority of another UW office, refer the visitor to that office.
  • The AGO can help identify the person or entity making the request, verify the person or entity’s authority, and provide advice on how to proceed and to respond to the visitor.
  • Forward any written documents, including any written requests for information, to the AGO. Such requests are typically time-sensitive, invested with the authority of law and requiring action by the party to whom they are directed, and should be forwarded as quickly and securely as possible.
  • The AGO will work with appropriate offices to ensure that the release of data and documents, if any, is legally appropriate, and will help determine who can serve as the UW point of contact with regard to the request. The AGO will also provide guidance regarding whether and how the UW should respond to the request, including the process for gathering any information that is responsive to the request, and tracking the request and any data or documents released as a result of the request.

    Attorney General’s Office, University of Washington Division: 206-543-4150
    Additional information about subpoenas, depositions and legal process

*In addition to this guidance, University of Washington staff and supervisors working in health care settings should follow specific policies and procedures regarding the handling of documents and information related to patients and patient care, including professional liability claims or quality improvement (QI) information. If applicable, these specific policies and procedures take precedence over this guidance. For patient information, staff should follow the UW Medicine Compliance or other applicable policies regarding patient privacy and, as appropriate, contact the relevant UW Medicine or other Health Information Management (HIM) department. For information related to clinical patient care, including professional liability claims and QI activities, staff should contact Health Sciences Risk Management (HSRM) and follow HSRM procedures.