The agency, the agency's designees, and any recipient of data, such as subcontractors and business associates, shall comply with the applicable Health Insurance Portability and Accountability Act's security, privacy, and confidentiality rules, including uses and disclosures required by law, public health activities, and health oversight activities, and shall not disclose any individual patient's personal health information or personal identifiers in violation of state or federal law.
Haw. Code R. § 11-188-24