N.H. Admin. Code § He-P 304.08

Current through Register No. 45, November 7, 2024

Section He-P 304.08 - Procedures for Disclosure of Protected Health Information

(a) The SCR shall use and disclose protected health information in accordance with RSA 141-B:9 and the provisions of 45 CFR 164 generally, and specifically, 45 CFR 164.502, 164.506 and 164.512.

(b) The department shall maintain the confidentiality of reports submitted to the SCR pursuant to RSA 141-B:9 except in accordance with (c) below.

(c) A report submitted to the SCR concerning an individual, and any other information maintained by the SCR, which, because of a personal identifier, can be readily associated with an individual, shall only be released:

(1) To the individual upon:

a. Receipt of a written request which shall be signed by the individual; and

b. Presentation of identification, such as a driver's license, by the individual;

(2) If the individual is a minor, to a parent of the individual upon:

a. Receipt of a written request, which shall be signed by the parent;

b. Receipt of a certified copy of the birth certificate of the individual; and

c. Receipt of a copy of the parent's identification, such as a driver's license of the parent;

(3) If the individual has a court-appointed guardian or if the individual is deceased, to the court-appointed guardian or to the executor or administrator of the individual's estate upon:

a. Receipt of a written request, which shall be signed by the court-appointed guardian, executor, or administrator of the estate;

b. Receipt of a certified copy of the order or decree which appoints the guardian, executor, or administrator; and

c. Receipt of a copy of identification, such as a driver's license, by the guardian, executor, or administrator;

(4) To an attorney or other person designated by the individual upon receipt of a written medical release request which shall be signed by the individual;

(5) To persons conducting health related research, upon receipt and approval pursuant to He-P 304.09 of a written application to the department, which shall be signed by the applicant and includes:

a. The following information about the principal investigator:

1. Name, address, and phone number;

2. Organizational affiliation;

3. Professional qualification; and

4. Name and phone number of principal investigator's contact person, if any;

b. The following information about the data or record copies being requested:

1. Type of event or record copies;

2. Time period of the data or record copies;

3. Specific data items required, if applicable;

4. Medium in which the data or record copies are to be supplied by the bureau; and

5. Any special format or layout of data required by the principal investigator;

c. A research protocol which shall contain:

1. A summary of background and origin of the research;

2. A statement of the health-related problem or issue to be addressed by the research;

3. The primary research hypothesis to be tested;

4. The research design, which shall include:

(i) Case definition;

(ii) Method of case selection; and

(iii) Method of data analysis;

5. The research methodology, which shall include:

(i) The way in which the requested data will be used; and

(ii) The procedures for follow-back to any persons or facilities named in records, if applicable;

6. Procedures to obtain informed consent from the research participants, if applicable;

7. The procedures that shall be followed to maintain the confidentiality of any data or copies of records provided to the requester; and

8. The intended completion date;

d. A statement signed by the principal investigator agreeing to the following:

1. The investigator shall acknowledge the department as the source of the data in any and all public reports, publications, or presentations generated by the requester from these data;

2. The investigator shall specify that the analyses, conclusions, and recommendations drawn from such data are solely those of the requester and are not necessarily those of the department;

3. Any data or record copies provided shall not be used for any purpose other than that described in the application;

4. The principal investigator and the research staff shall not disclose the identity of individuals revealed in the data or record copies to any persons except as is necessary to perform the research described in the application;

5. The data record shall not be further released to any other person or organization without the written consent of the commissioner or his designee; and

6. No form of information derived from the data or record copies that identify any individuals shall be made public;

e. A written statement ensuring that the investigator shall hold all information confidential; and

f. When contact with patients will occur, submission of an Institutional Review Board (IRB) approval for the study by an IRB formed in accordance with the requirements of the U.S. Department of Health and Human Services Code of Federal Regulations for Protection of Human Subjects, 45 CFR 46, June 23, 2005; or

(6) In association with an audit as required under Title III of Public Health Services Act, 42 U.S.C. 241 et seq.

(d) Persons fraudulently requesting data or information shall be subject to penalty for unsworn falsification pursuant to RSA 641:3.

N.H. Admin. Code § He-P 304.08

#9046, eff 12-5-07

Amended by Volume XXXVI Number 14, Filed April 7, 2016, Proposed by #11054, Effective 3/15/2016, Expires 3/15/2026.