935 CMR, § 501.820

Current through Register 1536, December 6, 2024

Section 501.820 - Confidentiality

(1) All records made or received by the Commission shall be public records and shall be available for disclosure on request pursuant to 935 CMR 501.820, and 950 CMR 32.00: Public Records Access, except the following, which shall be exempt from disclosure to the extent permitted by law:

(a) All records exempt from disclosure pursuant to M.G.L. c. 4, § 7, cl. 26;

(b) All records to the extent that they contain "personal data" pursuant to M.G.L. c. 66, § 1;

(c) All records to the extent that they contain "personal information" pursuant to M.G.L. c. 93H, § 1;

(d) All records which contain CORI as defined by 803 CMR 2.02: Definitions;

(e) All records which contain CHRI as defined by 803 CMR 7.02: Definitions; and

(f) All Confidential Records as defined in 935 CMR 501.002.

(2) The Commission shall maintain the confidentiality of all medical records including, but not limited to:

(a) All Confidential Records and information contained in the Confidential Database, including applicants for registration as a Qualifying Patient, Personal Caregiver, Institutional Caregiver, Certifying Healthcare Provider, Card Holder; or Registered Qualifying Patients, Personal Caregivers, Institutional Caregivers, Certifying Healthcare Providers, Card Holders; and

(b) Other identifying patient information.

(3) All records protected from disclosure under 935 CMR 501.820(1) or pursuant to the laws of an Other Jurisdiction may be disclosed by the Commission:

(a) If disclosure is required pursuant to a state or federal law;

(b) To the individual or the individual's authorized representative, if the individual executes a written release in a form and manner determined by the Commission;

(c) To the Commission staff for the purpose of carrying out their official duties;

(d) To the Commission Delegee(s) as authorized by the Commission;

(e) To other government officials and agencies acting within their lawful jurisdiction, which includes, but is not limited to:

1. Law enforcement personnel for the sole purpose of verifying a cardholder's registration and certification; and

2. The Board of Registration in Medicine when necessary in connection with referrals to said Board concerning violations of 935 CMR 501.000.

(f) To a healthcare professional who has a Bona Fide Healthcare Professional Patient Relationship with the Qualifying Patient to facilitate dispensing of Medical-use Marijuana;

(g) To an MTC or any state agency to facilitate dispensing of medical-use Marijuana;

(h) To the Commission staff if required in the course of an administrative or a judicial proceeding; or

(i) If an individual or entity obtains an order from a court of competent jurisdiction.

(4) Nothing in 935 CMR 501.820 shall prevent the Commission from acting in accordance with its authority.