(CONTAINS TEXT WITH VARYING EFFECTIVE DATES)
1. Definitions. As used in this section, unless the context otherwise indicates, the following terms have the following meanings. A. "Authorized representative of an individual" or "authorized representative" means an individual's legal guardian; agent pursuant to Title 18-C, section 5-803; agent pursuant to Title 18-C, Article 5, Part 9; or other authorized representative or, after death, that person's personal representative or a person identified in subsection 3-B. For a minor who has not consented to health care treatment in accordance with the provisions of state law, "authorized representative" means the minor's parent, legal guardian or guardian ad litem. [2017, c. 402, Pt. C, §44(AMD); 2019, c. 417, Pt. B, §14(AFF).]A-1. "Authorization to disclose" means authorization to disclose health care information in accordance with subsection 3, 3-A or 3-B. [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF).]A-2. "Aiding and assisting legally protected health care activity" has the same meaning as in Title 1 4, section 9002, subsection 1.B. "Disclosure" means the release, transfer of or provision of access to health care information in any manner obtained as a result of a professional health care relationship between the individual and the health care practitioner or facility to a person or entity other than the individual. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]B-1. "Gender-affirming health care services" has the same meaning as in Title 14, section9002, subsection 4.C. "Health care" means preventative, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, services, treatment, procedures or counseling, including appropriate assistance with disease or symptom management and maintenance, that affects an individual's physical, mental or behavioral condition, including individual cells or their components or genetic information, or the structure or function of the human body or any part of the human body. Health care includes prescribing, dispensing or furnishing to an individual drugs, biologicals, medical devices or health care equipment and supplies; providing hospice services to an individual; and the banking of blood, sperm, organs or any other tissue. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]D. "Health care facility" or "facility" means a facility, institution or entity licensed pursuant to this Title that offers health care to persons in this State, including a home health care provider, hospice program and a pharmacy licensed pursuant to Title 32. For the purposes of this section, "health care facility" does not include a state mental health institute, the Elizabeth Levinson Center, the Aroostook Residential Center or Freeport Towne Square. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]E. "Health care information" means information that directly identifies the individual and that relates to an individual's physical, mental or behavioral condition, personal or family medical history or medical treatment or the health care provided to that individual. "Health care information" does not include information that protects the anonymity of the individual by means of encryption or encoding of individual identifiers or information pertaining to or derived from federally sponsored, authorized or regulated research governed by 21 Code of Federal Regulations, Parts 50 and 56 and 45 Code of Federal Regulations, Part 46, to the extent that such information is used in a manner that protects the identification of individuals. The Board of Directors of the Maine Health Data Organization shall adopt rules to define health care information that directly identifies an individual. Rules adopted pursuant to this paragraph are routine technical rules as defined in Title 5, chapter 375, subchapter II-A. "Health care information" does not include information that is created or received by a member of the clergy or other person using spiritual means alone for healing as provided in Title 32, sections 2103 and 3270. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
F. "Health care practitioner" means a person licensed by this State to provide or otherwise lawfully providing health care or a partnership or corporation made up of those persons or an officer, employee, agent or contractor of that person acting in the course and scope of employment, agency or contract related to or supportive of the provision of health care to individuals. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]G. "Individual" means a natural person who is the subject of the health care information under consideration and, in the context of disclosure of health care information, includes the individual's authorized representative. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]G-1. "Legally protected health care activity" has the same meaning as in Title 14, section9002, subsection 8.G-2. "Reproductive health care services" has the same meaning as in Title 14, section9002, subsection 9.H. "Third party" or "3rd party" means a person other than the individual to whom the health care information relates. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).] [2017, c. 402, Pt. C, §44(AMD); 2019, c. 417, Pt. B, §14(AFF).]
2.Confidentiality of health information; disclosure. An individual's health care information is confidential and may not be disclosed other than to the individual by the health care practitioner or facility except as provided in subsection 3, 3-A, 3-B, 6 or 11. Nothing in this section prohibits a health care practitioner or health care facility from adhering to applicable ethical or professional standards provided that these standards do not decrease the protection of confidentiality granted by this section. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
3.Written authorization to disclose. A health care practitioner or facility may disclose health care information pursuant to a written authorization signed by an individual for the specific purpose stated in the authorization. A written authorization to disclose health care information must be retained with the individual's health care information. A written authorization to disclose is valid whether it is in an original, facsimile or electronic form. A written authorization to disclose must contain the following elements: A. The name and signature of the individual and the date of signature. If the authorization is in electronic form, a unique identifier of the individual and the date the individual authenticated the electronic authorization must be stated in place of the individual's signature and date of signature; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]B. The types of persons authorized to disclose health care information and the nature of the health care information to be disclosed; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]C. The identity or description of the 3rd party to whom the information is to be disclosed; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]D. The specific purpose or purposes of the disclosure and whether any subsequent disclosures may be made pursuant to the same authorization. An authorization to disclose health care information related to substance use disorder treatment or care subject to the requirements of 42 United States Code, Section 290dd-2 (Supplement 1998) is governed by the provisions of that law; [2017, c. 407, Pt. A, §72(AMD).]E. The duration of the authorization; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]F. A statement that the individual may refuse authorization to disclose all or some health care information but that refusal may result in improper diagnosis or treatment, denial of coverage or a claim for health benefits or other insurance or other adverse consequences; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]G. A statement that the authorization may be revoked at any time by the individual by executing a written revocation, subject to the right of any person who acted in reliance on the authorization prior to receiving notice of revocation, instructions on how to revoke an authorization and a statement that revocation may be the basis for denial of health benefits or other insurance coverage or benefits; and [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]H. A statement that the individual is entitled to a copy of the authorization form. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).] [2017, c. 407, Pt. A, §72(AMD).]
3-A.Oral authorization to disclose. When it is not practical to obtain written authorization under subsection 3 from an individual or person acting pursuant to subsection 3-B or when a person chooses to give oral authorization to disclose, a health care practitioner or facility may disclose health care information pursuant to oral authorization. A health care practitioner or facility shall record with the individual's health care information receipt of oral authorization to disclose, including the name of the authorizing person, the date, the information and purposes for which disclosure is authorized and the identity or description of the 3rd party to whom the information is to be disclosed. [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
3-B.Authorization to disclose provided by a 3rd party. When an individual or an authorized representative is unable to provide authorization to disclose under subsection 3 or 3-A, a health care practitioner or facility may disclose health care information pursuant to authorization to disclose that meets the requirements of subsection 3 or 3-A given by a 3rd party listed in this subsection. A health care practitioner or facility may determine not to obtain authorization from a person listed in this subsection when the practitioner or facility determines it would not be in the best interest of the individual to do so. In making this decision, the health care practitioner or facility shall respect the safety of the individual and shall consider any indicators, suspicion or substantiation of abuse. Persons who may authorize disclosure under this subsection include: A. The spouse of the individual; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]B. A parent of the individual; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]C. An adult who is a child, grandchild or sibling of the individual; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]D. An adult who is a sibling of the individual's parent or that sibling's spouse or a child of a sibling of the individual or a child of a sibling of the individual's spouse, related by blood or adoption; [RR 2021, c. 2, Pt. B, §106(COR).]E. An adult related to the individual, by blood or adoption, who is familiar with the individual's personal values; and [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]F. An adult who has exhibited special concern for the individual and who is familiar with the individual's personal values. [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).] [RR 2021, c. 2, Pt. B, §106(COR).]
4.Duration of authorization to disclose. An authorization to disclose may not extend longer than 30 months, except that the duration of an authorization for the purposes of insurance coverage under Title 24, 24-A or 39-A is governed by the provisions of Title 24, 24-A or 39-A, respectively. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
5.Revocation of authorization to disclose. A person who may authorize disclosure may revoke authorization to disclose at any time, subject to the rights of any person who acted in reliance on the authorization prior to receiving notice of revocation. A written revocation of authorization must be signed and dated. If the revocation is in electronic form, a unique identifier of the individual and the date the individual authenticated the electronic authorization must be stated in place of the individual's signature and date of signature. A health care practitioner or facility shall record receipt of oral revocation of authorization, including the name of the person revoking authorization and the date. A revocation of authorization must be retained with the authorization and the individual's health care information. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
6.Disclosure without authorization to disclose. A health care practitioner or facility may disclose, or when required by law must disclose, health care information without authorization to disclose under the circumstances stated in this subsection or as provided in subsection 11. Disclosure may be made without authorization as follows: A. To another health care practitioner or facility for diagnosis, treatment or care of individuals or to complete the responsibilities of a health care practitioner or facility that provided diagnosis, treatment or care of individuals, as provided in this paragraph. (1) For a disclosure within the office, practice or organizational affiliate of the health care practitioner or facility, no authorization is required.(2) For a disclosure outside of the office, practice or organizational affiliate of the health care practitioner or facility, authorization is not required, except that in nonemergency circumstances authorization is required for health care information derived from mental health services provided by:(a) A clinical nurse specialist licensed under the provisions of Title 32, chapter 31;(b) A psychologist licensed under the provisions of Title 32, chapter 56;(c) A social worker licensed under the provisions of Title 32, chapter 83;(d) A counseling professional licensed under the provisions of Title 32, chapter 119; or(e) A physician specializing in psychiatry licensed under the provisions of Title 32, chapter 36 or 48. This subparagraph does not prohibit the disclosure of health care information between a licensed pharmacist and a health care practitioner or facility providing mental health services for the purpose of dispensing medication to an individual.
This subparagraph does not prohibit the disclosure without authorization of health care information covered under this section to a state-designated statewide health information exchange that satisfies the requirement in subsection 18, paragraph C of providing a general opt-out provision to an individual at all times and that provides and maintains an individual protection mechanism by which an individual may choose to opt in to allow the state-designated statewide health information exchange to disclose that individual's health care information covered under Title 34-B, section 1207.
This subparagraph does not prohibit the disclosure without authorization of health care information covered under this paragraph to a health care practitioner or health care facility, or to a payor or person engaged in payment for health care, for purposes of care management or coordination of care. Disclosure of psychotherapy notes is governed by 45 Code of Federal Regulations, Section 164.508(a)(2). A person who has made a disclosure under this subparagraph shall make a reasonable effort to notify the individual or the authorized representative of the individual of the disclosure; [2013, c. 326, §1(AMD).]
B. To an agent, employee, independent contractor or successor in interest of the health care practitioner or facility including a state-designated statewide health information exchange that makes health care information available electronically to health care practitioners and facilities or to a member of a quality assurance, utilization review or peer review team to the extent necessary to carry out the usual and customary activities relating to the delivery of health care and for the practitioner's or facility's lawful purposes in diagnosing, treating or caring for individuals, including billing and collection, risk management, quality assurance, utilization review and peer review. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales; [2011, c. 347, §7(AMD).]C. To a family or household member unless expressly prohibited by the individual or a person acting pursuant to subsection 3-B; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]D. To appropriate persons when a health care practitioner or facility that is providing or has provided diagnosis, treatment or care to the individual in good faith believes that disclosure is made to avert a serious threat to health or safety and meets the conditions, as applicable, described in 45 Code of Federal Regulations, Section 164.512(j) (2012). A disclosure pursuant to this paragraph must protect the confidentiality of the health care information consistent with sound professional judgment; [2013, c. 289, §1(AMD).]E. To federal, state or local governmental entities in order to protect the public health and welfare when reporting is required or authorized by law, to report a suspected crime against the health care practitioner or facility or to report information that the health care facility's officials or health care practitioner in good faith believes constitutes evidence of criminal conduct that occurred on the premises of the health care facility or health care practitioner; [2011, c. 572, §1(AMD).]E-1. To federal, state or local governmental entities if the health care practitioner or facility that is providing diagnosis, treatment or care to an individual has determined in the exercise of sound professional judgment that the following requirements, as applicable, are satisfied:(1) With regard to a disclosure for public health activities, for law enforcement purposes or that pertains to victims of abuse, neglect or domestic violence, the provisions of 45 Code of Federal Regulations, Section 164.512(b), (c) or (f) (2012) must be met; and(2) With regard to a disclosure that pertains to a victim of domestic violence or a victim of sexual assault, the provisions of 45 Code of Federal Regulations, Section 164.512(c)(1)(iii)(A) (2012) and Section 164.512(c)(1)(iii)(B) (2012) must be met. [2013, c. 289, §2(NEW).]E-2. To federal, state or local governmental entities if the health care practitioner or facility that is providing diagnosis, treatment or care to an individual has determined in the exercise of sound professional judgment that the disclosure is required by section 1727; [RR 2015, c. 1, §17(COR).]F. [1999, c. 512, Pt. A, §5(RP); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]F-1. As directed by order of a court or as authorized or required by statute; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]F-2. To a governmental entity pursuant to a lawful subpoena requesting health care information to which the governmental entity is entitled according to statute or rules of court; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]F-3.[Effective on adoption of rules; See 2014, c. 528, §1] To the Maine Health Data Organization as required by and for use in accordance with chapter 1683. Health care information, including protected health information, as defined in 45 Code of Federal Regulations, Section 160.103 (2013), submitted to the Maine Health Data Organization must be protected by means of encryption; [2013, c. 528, §1(NEW); 2013, c. 528, §12(AFF).]G. To a person when necessary to conduct scientific research approved by an institutional review board or by the board of a nonprofit health research organization or when necessary for a clinical trial sponsored, authorized or regulated by the federal Food and Drug Administration. A person conducting research or a clinical trial may not identify any individual patient in any report arising from the research or clinical trial. For the purposes of this paragraph, "institutional review board" means any board, committee or other group formally designated by a health care facility and authorized under federal law to review, approve or conduct periodic review of research programs. Health care information disclosed pursuant to this paragraph that identifies an individual must be returned to the health care practitioner or facility from which it was obtained or must be destroyed when it is no longer required for the research or clinical trial. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]H. To a person engaged in the assessment, evaluation or investigation of the provision of or payment for health care or the practices of a health care practitioner or facility or to an agent, employee or contractor of such a person, pursuant to statutory or professional standards or requirements. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]I. To a person engaged in the regulation, accreditation, licensure or certification of a health care practitioner or facility or to an agent, employee or contractor of such a person, pursuant to standards or requirements for regulation, accreditation, licensure or certification; [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]J. To a person engaged in the review of the provision of health care by a health care practitioner or facility or payment for such health care under Title 24, 24-A or 39-A or under a public program for the payment of health care or professional liability insurance for a health care practitioner or facility or to an agent, employee or contractor of such a person; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]K. To attorneys for the health care practitioner or facility that is disclosing the health care information or to a person as required in the context of legal proceedings or in disclosure to a court or governmental entity, as determined by the practitioner or facility to be required for the practitioner's or facility's own legal representation; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]L. To a person outside the office of the health care practitioner or facility engaged in payment activities, including but not limited to submission to payors for the purposes of billing, payment, claims management, medical data processing, determination of coverage or adjudication of health benefit or subrogation claims, review of health care services with respect to coverage or justification of charges or other administrative services. Payment activities also include but are not limited to:(1) Activities necessary to determine responsibility for coverage;(2) Activities undertaken to obtain payment for health care provided to an individual; and(3) Quality assessment and utilization review activities, including precertification and preauthorization of services and operations or services audits relating to diagnosis, treatment or care rendered to individuals by the health care practitioner or facility and covered by a health plan or other payor; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]M. To schools, educational institutions, youth camps licensed under section 2495, correctional facilities, health care practitioners and facilities, providers of emergency services or a branch of federal or state military forces, information regarding immunization of an individual; [2009, c. 211, Pt. B, §17(AMD).]N. To a person when disclosure is needed to set or confirm the date and time of an appointment or test or to make arrangements for the individual to receive those services; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]O. To a person when disclosure is needed to obtain or convey information about prescription medication or supplies or to provide medication or supplies under a prescription; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]P. To a person representing emergency services, health care and relief agencies, corrections facilities or a branch of federal or state military forces, of brief confirmation of general health status; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]Q. To a member of the clergy, of information about the presence of an individual in a health care facility, including the person's room number, place of residence and religious affiliation unless expressly prohibited by the individual or a person acting pursuant to subsection 3-B; [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]R. To a member of the media who asks a health care facility about an individual by name, of brief confirmation of general health status unless expressly prohibited by the individual or a person acting pursuant to subsection 3-B; [2015, c. 370, §4(AMD).]S. To a member of the public who asks a health care facility about an individual by name, of the room number of the individual and brief confirmation of general health status unless expressly prohibited by the individual or a person acting pursuant to subsection 3-B; [2017, c. 203, §2(AMD).]T. To a lay caregiver designated by an individual pursuant to section 1711-G; [2021, c. 398, Pt. MMMM, §3(AMD).]U. To a panel coordinator of the maternal, fetal and infant mortality review panel pursuant to section 261, subsection 4, paragraph B-1 for the purposes of reviewing health care information of a deceased person and a mother of a child who died within one year of birth, including fetal deaths after 28 weeks of gestation. For purposes of this paragraph, "panel coordinator" has the same meaning as in section 261, subsection 1, paragraph E and "deceased person" has the same meaning as in section 261, subsection 1, paragraph B; and [2021, c. 398, Pt. MMMM, §4(AMD).]V. To a panel coordinator of the Aging and Disability Mortality Review Panel pursuant to section 264, subsection 5, paragraph B, subparagraph (4) for the purposes of reviewing health care information of an adult receiving services who is deceased, in accordance with section 264, subsection 5, paragraph A. For purposes of this paragraph, "panel coordinator" has the same meaning as in section 264, subsection 2, paragraph B. [2021, c. 398, Pt. MMMM, §5(NEW).] [2021, c. 398, Pt. MMMM, §§3-5(AMD).]
7. Confidentiality policies. A health care practitioner, facility or state-designated statewide health information exchange shall develop and implement policies, standards and procedures to protect the confidentiality, security and integrity of health care information to ensure that information is not negligently, inappropriately or unlawfully disclosed. The policies of health care facilities must provide that an individual being admitted for inpatient care be given notice of the right of the individual to control the disclosure of health care information. The policies must provide that routine admission forms include clear written notice of the individual's ability to direct that that individual's name be removed from the directory listing of persons cared for at the facility and notice that removal may result in the inability of the facility to direct visitors and telephone calls to the individual. [2011, c. 373, §1(AMD).]
8. Prohibited disclosure. Disclosure of health care information is prohibited as follows. A. A health care practitioner, facility or state-designated statewide health information exchange may not disclose health care information for the purpose of marketing or sales without written or oral authorization for the disclosure.B. Notwithstanding any provision of this section to the contrary and except as provided in paragraph C, a health care practitioner, facility or state-designated statewide health information exchange may not disclose any of the following in a civil or administrative action or proceeding or in response to a subpoena issued in a civil or administrative action or proceeding unless authorized in writing by the individual or the individual's authorized representative or pursuant to a court order issued by a court of competent jurisdiction in this State upon a showing of good cause, as long as the court order limits the use and disclosure of records and includes sanctions for misuse of records or sets forth other methods to ensure confidentiality:(1) Any communication about reproductive health care services or gender-affirming health care services made to the health care practitioner, facility or state-designated statewide health information exchange from the individual or anyone acting on behalf of the individual, including an authorized representative of the individual; and(2) Any information obtained through a personal examination of an individual relating to reproductive health care services or gender-affirming health care services.C. Paragraph B does not apply if: (1) The communication or information to be disclosed relates to an individual who is a plaintiff in a medical malpractice action and the health care practitioner, facility or state-designated statewide health information exchange from which the communication or information is requested is a defendant in the medical malpractice action;(2) The communication or information to be disclosed is requested by a professional licensing board that licenses health care practitioners in this State and the request relates to and is made in connection with a complaint investigation. This subparagraph does not apply if the complaint is based solely on an allegation that a licensee of the board provided reproductive health care services or gender-affirming health care services that are legally protected health care activity or aiding and assisting legally protected health care activity within the licensee's scope of practice; or(3) The communication or information to be disclosed is requested by the United States Department of Justice, a law enforcement agency of this State or a political subdivision of this State or any other federal agency or agency of this State that pursuant to statute is responsible for investigating abuse, neglect or exploitation and the request is made in connection with an investigation of abuse, neglect or exploitation of a child pursuant to the Child and Family Services and Child Protection Act or of an incapacitated or dependent adult pursuant to the Adult Protective Services Act.D. This subsection may not be construed to impede the lawful disclosure of information to another health care practitioner or facility for diagnosis, treatment or care of individuals or to complete the responsibilities of a health care practitioner or facility that provides diagnosis, treatment or care of individuals or to impede the lawful disclosure of information to an insurer or payor related to the treatment provided by a health care practitioner or facility or to the payment or operations of a health care practitioner or facility. 9.Disclosures of corrections or clarifications to health care information. A health care practitioner or facility shall provide to a 3rd party a copy of an addition submitted by an individual to the individual's health care information if: A. The health care practitioner or facility provided a copy of the original health care record to the 3rd party on or after February 1, 2000; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]B. The correction or clarification was submitted by the individual pursuant to section 1711 or 1711-B and relates to diagnosis, treatment or care; [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]C. The individual requests that a copy be sent to the 3rd party and provides an authorization that meets the requirements of subsection 3, 3-A or 3-B; and [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]D. If requested by the health care practitioner or facility, the individual pays to the health care practitioner or facility all reasonable costs requested by that practitioner or facility. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).] [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
10.Requirements for disclosures. Except as otherwise provided by law, disclosures of health care information pursuant to this section are subject to the professional judgment of the health care practitioner and to the following requirements. A. A health care practitioner or facility that discloses health care information pursuant to subsection 3, 3-A or 3-B may not disclose information in excess of the information requested in the authorization. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]B. A health care practitioner or facility that discloses health care information pursuant to subsections 3, 3-A, 3-B or 6 may not disclose information in excess of the information reasonably required for the purpose for which it is disclosed. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]C. If a health care practitioner or facility believes that release of health care information to the individual would be detrimental to the health of the individual, the health care practitioner or facility shall advise the individual and make copies of the records available to the individual's authorized representative upon receipt of a written authorization. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]D. If a health care practitioner or facility discloses partial or incomplete health care information, as compared to the request or directive to disclose under subsection 3, 3-A, 3-B or 6, the disclosure must expressly indicate that the information disclosed is partial or incomplete. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).] [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
11.Health care information subject to other laws, rules and regulations. Health care information that is subject to the provisions of 42 United States Code, Section 290dd-2 (Supplement 1998); chapters 710-B and 711; Title 5, section 200-E; Title 5, chapter 501; Title 24 or 24-A; Title 34-B, section 1207; Title 39-A; or other provisions of state or federal law, rule or regulation is governed solely by those provisions. [2009, c. 387, §2(AMD).]
12.Minors. If a minor has consented to health care in accordance with the laws of this State, authorization to disclose health care information pursuant to this section must be given by the minor unless otherwise provided by law. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]
13. Enforcement. This section may be enforced within 2 years of the date a disclosure in violation of this section was or should reasonably have been discovered. A. When the Attorney General has reason to believe that a person has intentionally violated a provision of this section, the Attorney General may bring an action to enjoin unlawful disclosure of health care information. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]B. An individual who is aggrieved by conduct in violation of this section may bring a civil action against a person who has intentionally unlawfully disclosed health care information in the Superior Court in the county in which the individual resides or the disclosure occurred. The action may seek to enjoin unlawful disclosure and may seek costs and a forfeiture or penalty under paragraph C. An applicant for injunctive relief under this paragraph may not be required to give security as a condition of the issuance of the injunction. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]C. A person who intentionally violates this section is subject to a civil penalty not to exceed $5,000, payable to the State, plus costs. If a court finds that intentional violations of this section have occurred after due notice of the violating conduct with sufficient frequency to constitute a general business practice, the person is subject to a civil penalty not to exceed $10,000 for health care practitioners and $50,000 for health care facilities, payable to the State. A civil penalty under this subsection is recoverable in a civil action. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]D. Nothing in this section may be construed to prohibit a person aggrieved by conduct in violation of this section from pursuing all available common law remedies, including but not limited to an action based on negligence. [1999, c. 512, Pt. A, §5(NEW); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).] [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
14.Waiver prohibited. Any agreement to waive the provisions of this section is against public policy and void. [1997, c. 793, Pt. A, §8(NEW); 1997, c. 793, Pt. A, §10(AFF).]
15. Immunity. A cause of action in the nature of defamation, invasion of privacy or negligence does not arise against any person for disclosing health care information in accordance with this section. This section provides no immunity for disclosing information with malice or willful intent to injure any person. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
16.Application. This section applies to all requests, directives and authorizations to disclose health care information executed on or after February 1, 2000. An authorization to disclose health care information executed prior to February 1, 2000 that does not meet the standards of this section is deemed to comply with the requirements of this section until the next health care encounter between the individual and the health care practitioner or facility. [1999, c. 512, Pt. A, §5(AMD); 1999, c. 512, Pt. A, §7(AFF); 1999, c. 790, Pt. A, §§58, 60(AFF).]
17.Repeal.[2001, c. 346, §1(RP).]
18.Participation in a state-designated statewide health information exchange. The following provisions apply to participation in a state-designated statewide health information exchange. A. A health care practitioner may not deny a patient health care treatment and a health insurer may not deny a patient a health insurance benefit based solely on the provider's or patient's decision not to participate in a state-designated statewide health information exchange. Except when otherwise required by federal law, a payor of health care benefits may not require participation in a state-designated statewide health information exchange as a condition of participating in the payor's provider network. [2011, c. 691, Pt. A, §20(RPR).]B. Recovery for professional negligence is not allowed against any health care practitioner or health care facility on the grounds of a health care practitioner's or a health care facility's nonparticipation in a state-designated statewide health information exchange arising out of or in connection with the provision of or failure to provide health care services. In any civil action for professional negligence or in any proceeding related to such a civil action or in any arbitration, proof of a health care practitioner's, a health care facility's or a patient's participation or nonparticipation in a state-designated statewide health information exchange is inadmissible as evidence of liability or nonliability arising out of or in connection with the provision of or failure to provide health care services. This paragraph does not prohibit recovery or the admission of evidence of reliance on information in a state-designated statewide electronic health information exchange when there was participation by both the patient and the patient's health care practitioner. [2011, c. 691, Pt. A, §20(RPR).]C. A state-designated statewide health information exchange to which health care information is disclosed under this section shall provide an individual protection mechanism by which an individual may opt out from participation to prohibit the state-designated statewide health information exchange from disclosing the individual's health care information to a health care practitioner or health care facility. [2011, c. 691, Pt. A, §20(RPR).]D. At point of initial contact, a health care practitioner, health care facility or other entity participating in a state-designated statewide health information exchange shall provide to each patient, on a separate form, at minimum: (1) Information about the state-designated statewide health information exchange, including a description of benefits and risks of participation in the state-designated statewide health information exchange;(2) A description of how and where to obtain more information about or contact the state-designated statewide health information exchange;(3) An opportunity for the patient to decline participation in the state-designated statewide health information exchange; and(4) A declaration that a health care practitioner, health care facility or other entity may not deny a patient health care treatment based solely on the provider's or patient's decision not to participate in a state-designated statewide health information exchange. The state-designated statewide health information exchange shall develop the form for use under this paragraph, with input from consumers and providers. The form must be approved by the office of the state coordinator for health information technology within the Governor's office of health policy and finance. [2011, c. 691, Pt. A, §20(RPR).]
E. A health care practitioner, health care facility or other entity participating in a state-designated statewide health information exchange shall communicate to the exchange the decision of each patient who has declined participation and shall do so within a reasonable time frame, but not more than 2 business days following the receipt of a signed form, as described in paragraph D, from the patient, or shall establish a mechanism by which the patient may decline participation in the state-designated statewide health information exchange at no cost to the patient. [2011, c. 691, Pt. A, §20(RPR).]F. A state-designated statewide health information exchange shall process the request of a patient who has decided not to participate in the state-designated statewide health information exchange within 2 business days of receiving the patient's decision to decline, unless additional time is needed to verify the identity of the patient. A signed authorization from the patient is required before a patient is newly entered or reentered into the system if the patient chooses to begin participation at a later date. Except as otherwise required by applicable law, regulation or rule or state or federal contract, or when the state-designated statewide health information exchange is acting as the agent of a health care practitioner, health care facility or other entity, the state-designated statewide health information exchange shall remove health information of individuals who have declined participation in the exchange. In no event may health information retained in the state-designated statewide health information exchange as set forth in this paragraph be made available to health care practitioners, health care facilities or other entities except as otherwise required by applicable law, regulation or rule or state or federal contract, or when the health care practitioner, health care facility or other entity is the originator of the information. [2011, c. 691, Pt. A, §20(RPR).]
G. A state-designated statewide health information exchange shall establish a secure website accessible to patients. This website must: (1) Permit a patient to request a report of who has accessed that patient's records and when the access occurred. This report must be delivered to the patient within 2 business days upon verification of the patient's identity by the state-designated statewide health information exchange;(2) Provide a mechanism for a patient to decline participation in the state-designated statewide health information exchange; and(3) Provide a mechanism for the patient to consent to participation in the state-designated statewide health information exchange if the patient had previously declined participation. [2011, c. 691, Pt. A, §20(RPR).]H. A state-designated statewide health information exchange shall establish for patients an alternate procedure to that provided for in paragraph F that does not require Internet access. A health care practitioner, health care facility or other entity participating in the state-designated statewide health information exchange shall provide information about this alternate procedure to all patients. The information must be included on the form identified in paragraph D. [2011, c. 691, Pt. A, §20(RPR).]I. A state-designated statewide health information exchange shall maintain records regarding all disclosures of health care information by and through the state-designated statewide health information exchange, including the requesting party and the dates and times of the requests and disclosures. [2011, c. 691, Pt. A, §20(RPR).]J. A state-designated statewide health information exchange may not charge a patient or an authorized representative of a patient any fee for access or communication as provided in this subsection. [2011, c. 691, Pt. A, §20(RPR).]K. Notwithstanding any provision of this subsection to the contrary, a health care practitioner, health care facility or other entity shall provide the form and communication required by paragraphs D and F to all existing patients following the effective date of this subsection. [2011, c. 691, Pt. A, §20(RPR).]L. A state-designated statewide health information exchange shall meet or exceed all applicable federal laws and regulations pertaining to privacy, security and breach notification regarding personally identifiable protected health information, as defined in 45 Code of Federal Regulations, Part 160. If a breach occurs, the state-designated statewide health information exchange shall arrange with its participants for notification of each individual whose protected health information has been, or is reasonably believed by the exchange to have been, breached. For purposes of this paragraph, "breach" has the same meaning as in 45 Code of Federal Regulations, Part 164, as amended. [2011, c. 691, Pt. A, §20(RPR).]M. The state-designated statewide health information exchange shall develop a quality management plan, including auditing mechanisms, in consultation with the office of the state coordinator for health information technology within the department, who shall review the plan and results. [2011, c. 691, Pt. A, §20(RPR).] [2011, c. 691, Pt. A, §20(RPR).]
20.Exemption from freedom of access laws. Except as provided in this section, the names and other identifying information of individuals in a state-designated statewide health information exchange are confidential and are exempt from the provisions of Title 1, chapter 13. [2011, c. 373, §4(NEW).]
Amended by 2024, c. 648,§ F-5, eff. 8/9/2024.Amended by 2024, c. 648,§ F-4, eff. 8/9/2024.Amended by 2024, c. 648,§ F-3, eff. 8/9/2024.Amended by 2024, c. 648,§ F-2, eff. 8/9/2024.Amended by 2024, c. 648,§ F-1, eff. 8/9/2024.Amended by 2021SP1, c. 398,§ MMMM-5, eff. 7/1/2021.Amended by 2021SP1, c. 398,§ MMMM-4, eff. 7/1/2021.Amended by 2021SP1, c. 398,§ MMMM-3, eff. 7/1/2021.Amended by 2019, c. 417,§ B-14, eff. 6/20/2019.Amended by 2018, c. 407,§ A-72, eff. 8/1/2018.Amended by 2018, c. 402,§ C-44, eff. 7/1/2019.Amended by 2017, c. 203,§ 2 to § 4, eff. 11/1/2017.Amended by 2015, c. 370,and , c. 370,§ 4 § 5, eff. 10/15/2015.Amended by 2015, c. 218,§ 1, eff. 10/15/2015.Amended by 2014, c. 528,§ 1, eff. upon the final adoption of major substantive rules required to implement the provisions of 2014, c. 528.Amended by 2013, c. 326,§ 1, eff. 10/9/2013.Amended by 2013, c. 289,§§ 1 and 2, eff. 10/9/2013.Amended by 2012, c. 691,§ A-20, eff. 5/22/2012.Amended by 2012, c. 572,§ 1, eff. 3/30/2012.Amended by 2011, c. 373,§§ 1 to 4, eff. 9/28/2011.Amended by 2011, c. 347,§§ 6 to 8, eff. 9/28/2011.RR 1997, c. 2, § 44 (COR) . 1997, c. 793, §A10 (AFF) . 1997, c. 793, §A8 (NEW) . 1999, c. 3, §§1,2 (AMD) . 1999, c. 3, §§3,5 (AFF) . 1999, c. 512, §A5 (AMD) . 1999, c. 512, §A6 (AFF) . 1999, c. 790, §§A58,60 (AFF) . RR 2001, c. 1, § 26 (COR) . 2001, c. 346, § 1 (AMD) . 2009, c. 211, Pt. B, §17 (AMD) . 2009, c. 292, § 3 (AMD) . 2009, c. 292, § 6 (AFF) . 2009, c. 387, §§1, 2 (AMD) .