Haw. Code R. § 12-55-12
Whenever employee medical information obtained pursuant to a written access order is taken offsite with direct personal identifiers included, the principal HIOSH investigator shall, unless otherwise authorized by the HIOSH medical records officer, promptly separate all direct personal identifiers from the medical information, and code the medical information and the list of direct identifiers with a unique identifying number for each employee. The medical information with its numerical code shall thereafter be used and kept secured as though still in a directly identifiable form. The principal HIOSH investigator shall also hand deliver or mail the list of direct personal identifiers with their corresponding numerical codes to the HIOSH medical records officer. The HIOSH medical records officer shall thereafter limit the use and distribution of the list of coded identifiers to those with a need to know its contents.
Haw. Code R. § 12-55-12