Section 21a-408-34 - Confidentiality of information(a) Except as provided by section 21a-408-50 of the Regulations of Connecticut State Agencies, a dispensary facility employee, producer, production facility employee, research program or research program employee or any other person associated with a dispensary facility, producer or research program, shall not disclose patient-specific or research subject-specific information received and records kept pursuant to sections 21a-408-1 to 21a-408-72, inclusive, of the Regulations of Connecticut State Agencies, except that such person shall disclose patient or research program subject treatment or dispensing information to: (1) The department or state and local law enforcement agencies for purposes of investigating and enforcing the Act or sections 21a-408-1 to 21a-408-72, inclusive, of the Regulations of Connecticut State Agencies;(2) Physicians, APRNs, pharmacists or other dispensaries for the purpose of providing patient care and drug therapy management and monitoring controlled substances obtained by the qualifying patient or research program subject;(3) A qualifying patient or research program subject, but only with respect to information related to such patient or research program subject;(4) A primary caregiver, but only with respect to the qualifying patient of such primary caregiver;(5) Third party payors who pay claims for dispensary services rendered to a qualifying patient or who have a formal agreement or contract to audit any records or information in connection with such claims;(6) Any person, the state or federal government or any agency thereof pursuant to an order of a court of competent jurisdiction or pursuant to a search warrant; and(7) Any person upon the express written consent of the patient or research program subject and only with respect to information related to such patient or research program subject. Such written consent shall clearly identify the specific person and purpose for which consent is being granted, but in no event shall such information be disclosed to an electronic data intermediary.(b) An electronic data intermediary shall not have access to any data involving marijuana, qualifying patients, research program subjects, primary caregivers or other data from a dispensary facility or an agent of the dispensary facility.(c) No electronic equipment utilized by a dispensary department shall collect patient-specific data for use outside the dispensary department, except that such data shall be disclosed to the department for purposes of an inspection or investigation.(d) No electronic equipment utilized by a research program shall collect research program subject specific data for use outside of the research program, except that such data shall be disclosed to the department for purposes of an inspection or investigation.Conn. Agencies Regs. § 21a-408-34
Effective September 6, 2013; amended 8/28/2018