§329-104 Confidentiality of information; disclosure of information. (a) The information collected under this part shall not be available to the public or used for any commercial purpose. Ownership of all data collected shall reside with the State.

(b) Responsibility for limiting access to information in the system is vested in the administrator. Access to the information collected at the central repository pursuant to this part shall be confidential, and access to the information shall be limited to personnel of the designated state agency.

(c) This section shall not prevent the disclosure, at the discretion of the administrator, of investigative information to:

(1) Law enforcement officers, investigative agents of federal, state, or county law enforcement or regulatory agencies, United States attorneys, county prosecuting attorneys, or the attorney general; provided that the administrator has reasonable grounds to believe that the disclosure of any information collected under this part is in furtherance of an ongoing criminal or regulatory investigation or prosecution;

(2) Registrants authorized under chapters 448, 453, and 463E who are registered to administer, prescribe, or dispense controlled substances and their practitioner delegate; provided that the information disclosed relates only to the registrant's own patient;

(3) Pharmacists or pharmacist delegates, employed by a pharmacy registered under section 329-32, who request prescription information about a customer relating to a violation or possible violation of this chapter;

(4) Other state-authorized governmental prescription-monitoring programs;

(5) The chief medical examiner or licensed physician designee who requests information and certifies the request is for the purpose of investigating the death of an individual;

(6) Qualified personnel for the purpose of bona fide research or education; provided that data elements that would reasonably identify a specific recipient, prescriber, or dispenser shall be deleted or redacted from the information prior to disclosure; provided further that release of the information may be made only pursuant to a written agreement between qualified personnel and the administrator in order to ensure compliance with this subsection;

(7) Other entities or individuals authorized by the administrator to assist the program with projects that enhance the electronic prescription accountability system;

(8) Authorized employees of the State of Hawaii department of health alcohol and drug abuse division and the emergency medical services and injury prevention system branch; and

(9) The United States Department of Defense health agency prescription monitoring program.

Information disclosed to a registrant, pharmacist, or authorized government agency under this section shall be transmitted by a secure means determined by the designated agency.

(d) No person shall knowingly disclose or attempt to disclose, or use or attempt to use, information in the system in violation of this section. Any person who violates this section is guilty of a class C felony.

(e) The designated state agency shall purge or cause to be purged from the central repository system, no later than five years after the date a patient's prescription data are made available to the designated state agency, the identification number of the patient, unless the information is part of an active investigation. [L 1996, c 268, pt of §2; am L 1999, c 145, §1; am L 2001, c 162, §1; am L 2006, c 69, §6; am L 2009, c 11, §42; am L 2010, c 123, §8; am L 2016, c 218, §17; am L 2019, c 230, §1]