90-113.74. Confidentiality.

(a) Prescription information submitted to the Department is privileged and confidential, is not a public record pursuant to G.S. 132-1, is not subject to subpoena or discovery or any other use in civil proceedings, and except as otherwise provided below may only be used (i) for investigative or evidentiary purposes related to violations of State or federal law, (ii) for regulatory activities, or (iii) to inform medical records or clinical care. Except as otherwise provided by this section, prescription information shall not be disclosed or disseminated to any person or entity by any person or entity authorized to review prescription information.

(b) The Department may use prescription information data in the controlled substances reporting system only for purposes of implementing this Article in accordance with its provisions.

(b1) The Department may review the prescription information data in the controlled substances reporting system and upon review may:

(1) Notify practitioners that a patient may have obtained prescriptions for controlled substances in a manner that may represent abuse, diversion of controlled substances, or an increased risk of harm to the patient.

(1a) Notify practitioners and their respective licensing boards of prescribing behavior that (i) increases risk of diversion of controlled substances, (ii) increases risk of harm to the patient, or (iii) is an outlier among other practitioner behavior.

(2) Report information regarding the prescribing practices of a practitioner to the agency responsible for licensing, registering, or certifying the practitioner pursuant to rules adopted by the agency as set forth below in subsection (b2) of this section.

(b2) In order to receive a report pursuant to subdivision (2) of subsection (b1) of this section, an agency responsible for licensing, registering, or certifying a practitioner with prescriptive or dispensing authority shall adopt rules setting the criteria by which the Department may report the information to the agency. The criteria for reporting established by rule shall not establish the standard of care for prescribing or dispensing, and it shall not be a basis for disciplinary action by an agency that the Department reported a practitioner to an agency based on the criteria.

(c) The Department shall release data in the controlled substances reporting system to the following persons only:

(1) Persons authorized to prescribe or dispense controlled substances for the purpose of providing medical or pharmaceutical care for their patients. A person authorized to receive data pursuant to this paragraph may delegate the authority to receive the data to other persons working under his or her direction and supervision, provided the Department approves this delegation.

The administrator of a hospital emergency department or hospital acute care facility shall provide the Department with a list of prescribers who are authorized to prescribe controlled substances for the purpose of providing medical care for patients of the hospital emergency department or hospital acute care facility and a list of delegates who are authorized to receive data on behalf of the providers listed. The administrator acting under this paragraph shall submit the lists to the Department no later than December 1 of the calendar year preceding the year during which the delegates are to receive data and may provide updated lists at any time during the course of the year. Within one week of receiving the initial or updated lists described in this paragraph, the Department shall establish all of the delegate accounts necessary to enable each delegate listed by the administrator of the hospital emergency department or hospital acute care facility to receive data on behalf of the listed prescribers. Delegations made pursuant to this paragraph are valid during the calendar year for which submitted by the administrator.

(2) An individual who requests the individual's own controlled substances reporting system information.

(3) Special agents of the North Carolina State Bureau of Investigation who are assigned to the Diversion & Environmental Crimes Unit and whose primary duties involve the investigation of diversion and illegal use of prescription medication. SBI agents assigned to the Diversion & Environmental Crimes Unit may then provide this information to other SBI agents who are engaged in a bona fide specific investigation related to enforcement of laws governing licit drugs. The Attorney General of North Carolina, or a designee who is a full-time employee in the North Carolina Department of Justice, shall have access to the system to monitor requests for inspection of records.

(4) Primary monitoring authorities for other states pursuant to a specific ongoing investigation involving a designated person, if information concerns the dispensing of a Schedule II through V controlled substance to an ultimate user who resides in the other state or the dispensing of a Schedule II through V controlled substance prescribed by a licensed health care practitioner whose principal place of business is located in the other state.

(5) To a sheriff or designated deputy sheriff or a police chief or a designated police investigator who is assigned to investigate the diversion and illegal use of prescription medication or pharmaceutical products identified in Article 5 of this Chapter of the General Statutes as Schedule II through V controlled substances and who is engaged in a bona fide specific investigation related to the enforcement of laws governing licit drugs pursuant to a lawful court order specifically issued for that purpose.

(5a) Local law enforcement officers pursuant to subsection (i) of this section.

(6) The Division of Medical Assistance for purposes of administering the State Medical Assistance Plan.

(7) Licensing boards with jurisdiction over health care disciplines pursuant to an ongoing investigation by the licensing board of a specific individual licensed by the board.

(8) Any county medical examiner appointed by the Chief Medical Examiner pursuant to G.S. 130A-382 and the Chief Medical Examiner, for the purpose of investigating the death of an individual.

(9) The federal Drug Enforcement Administration's Office of Diversion Control or Tactical Diversion Squad in North Carolina.

(10) The North Carolina Health Information Exchange Authority (NC HIE Authority), established under Article 29B of this Chapter, through Web-service calls.

(d) The Department may provide data to public or private entities for statistical, research, or educational purposes only after removing information that could be used to identify individual patients who received prescription medications from dispensers.

(e) In the event that the Department finds patterns of prescribing medications that are unusual, the Department shall inform the Attorney General's Office of its findings. The Office of the Attorney General shall review the Department's findings to determine if the findings should be reported to the SBI and the appropriate sheriff for investigation of possible violations of State or federal law relating to controlled substances.

(f) The Department shall, on a quarterly basis, purge from the controlled substances reporting system database all information more than six years old. The Department shall maintain in a separate database all information purged from the controlled substances reporting system database pursuant to this subsection and may release data from that separate database only as provided in subsection (d) of this section.

(g) Nothing in this Article shall prohibit a person authorized to prescribe or dispense controlled substances pursuant to Article 1 of Chapter 90 of the General Statutes from disclosing or disseminating data regarding a particular patient obtained under subsection (c) of this section to another person (i) authorized to prescribe or dispense controlled substances pursuant to Article 1 of Chapter 90 of the General Statutes and (ii) authorized to receive the same data from the Department under subsection (c) of this section.

(h) Nothing in this Article shall prevent persons licensed or approved to practice medicine or perform medical acts, tasks, and functions pursuant to Article 1 of Chapter 90 of the General Statutes from retaining data received pursuant to subsection (c) of this section in a patient's confidential health care record.

(i) Data released by the Department from the controlled substances reporting system to local law enforcement officers is subject to all of the following conditions and requirements:

(1) The Department shall release data in the controlled substances reporting system to a local law enforcement officer only if all of the following conditions are satisfied:

a. The local law enforcement officer is a certified diversion investigator.

b. The agency that supervises the investigator is a qualified law enforcement agency.

c. The request is reasonably related to a bona fide active investigation involving a specific violation of any State or federal law involving a controlled substance.

d. The request has been reviewed and approved by the State Bureau of Investigation, Diversion & Environmental Crimes Unit.

(2) In the event a special agent of the State Bureau of Investigation, Diversion & Environmental Crimes Unit, takes action upon a request by a certified diversion investigator for access to data in the controlled substances reporting system, the special agent shall not incur criminal or civil liability for such action or for actions taken by the certified diversion investigator making the request.

(3) The conditions outlined in this subsection shall create an audit trail that may be used to investigate or prosecute violations of this section. The Department shall grant access to the system to the Attorney General of North Carolina or a designee and Special Agents of the State Bureau of Investigation who are assigned to the Diversion & Environmental Crimes Unit for the purpose of reviewing the audit trail. The State Bureau of Investigation shall conduct periodic audits of a random sample of requests from certified diversion investigators for access to data in the controlled substances reporting system.

(4) Data obtained by certified diversion investigators from the controlled substances reporting system in the manner prescribed by this subsection may be shared with other law enforcement personnel or prosecutorial officials (i) only upon the direction of the certified diversion investigator who originally requested the information and (ii) in the case of law enforcement personnel from other law enforcement agencies, only with law enforcement personnel who are directly participating in an official joint investigation or as provided in subdivision (5) of this subsection.

(5) In the event the data provided to the local law enforcement officer indicates transactions solely outside of that local law enforcement officer's jurisdiction, the matter shall be referred to the State Bureau of Investigation, Diversion & Environmental Crimes Unit, or to a certified diversion investigator employed by a qualified law enforcement agency with jurisdiction over the transactions at issue.

(6) Certified diversion investigators may not request or receive prescription data from other states through PMP Interconnect or any other mechanism established by the Department to facilitate interstate connectivity of the controlled substances reporting system.

(7) As used in this subsection, the following terms have the following meanings:

a. Bona fide active investigation. - An investigation of one or more specific persons conducted with a reasonable, good-faith belief based on specific facts and circumstances equivalent to those normally necessary for the issuance of a court order, as described in G.S. 90-113.74(c)(5).

a1. Certified diversion investigator. - An officer affiliated with a qualified law enforcement agency who is certified as a diversion investigator by either the North Carolina Sheriffs' Education and Training Standards Commission or the North Carolina Criminal Justice Education and Training Standards Commission. If for any reason a certified diversion investigator leaves a position involving diversion investigation, the qualified law enforcement agency shall notify the North Carolina Department of Health and Human Services Controlled Substance Reporting System and the State Bureau of Investigation, Diversion & Environmental Crimes Unit, within 72 hours after the effective date of the change.

b. Certified diversion supervisor. - The head of a municipal police department, a county police department, a sheriff's office, or the designee of the agency head with supervisory authority over that agency's diversion investigators who is certified as a diversion supervisor by either the North Carolina Sheriffs' Education and Training Standards Commission or the North Carolina Criminal Justice Education and Training Standards Commission.

c. Qualified law enforcement agency. - Any of the following entities whose head is a certified diversion investigator or that employs at least one certified diversion investigator and at least one certified diversion supervisor:

1. A municipal police department.

2. A county police department.

3. A sheriff's office.

(j) The Department shall do all of the following:

(1) Enable each certified diversion investigator associated with a qualified law enforcement agency to register with the controlled substances reporting system by providing, at a minimum, all of the following information:

a. The investigator's name and certification number.

b. The name of the qualified law enforcement agency for whom the investigator works.

c. The name and certification number of each certified diversion supervisor with whom the investigator works.

(2) Enable each certified diversion investigator associated with a qualified law enforcement agency to request and receive data in connection with a bona fide active investigation involving a specific violation of any state or federal law involving a controlled substance by providing, at a minimum, all of the following:

a. The case number associated with the request.

b. A description of the nature and purpose of the request.

c. The first name, last name, and date of birth of each individual whose prescription data the investigator seeks, including, when appropriate, any alternative name, spelling, or date of birth associated with each such individual.

d. An acknowledgement that the certified diversion investigator is aware of the penalties associated with improperly obtaining, disclosing, or disseminating data from the controlled substances reporting system.

(3) Enable the State Bureau of Investigation, Diversion & Environmental Crimes Unit, to review each request for data from a certified diversion investigator associated with a qualified law enforcement agency and, upon such review, to determine if the request is approved, denied, or delayed pending further review or investigation.

(4) Create an audit trail that may be used to investigate or prosecute violations of this Part and ensure that the Attorney General of North Carolina or a designee and Special Agents of the North Carolina State Bureau of Investigation who are assigned to the Diversion & Environmental Crimes Unit have access to the system to review the audit trail.

(k) In addition to the civil penalties provided in G.S. 90-113.75(a) and any other applicable civil or criminal penalties, the following criminal penalties apply to any individual authorized to access data in the controlled substances reporting system when that access is authorized by subdivisions (3) through (10) of subsection (c) of this section:

(1) An individual who knowingly and intentionally accesses prescription information in the controlled substances reporting system for a purpose not authorized by this section shall be guilty of a Class I felony.

(2) An individual who knowingly and intentionally discloses or disseminates prescription information from the system for a purpose not authorized by this section shall be guilty of a Class I felony.

(3) An individual who willfully and maliciously obtains, discloses, or disseminates prescription information for a purpose not authorized by this section and with the intent to use such information for commercial advantage or personal gain, or to maliciously harm any person, shall be guilty of a Class H felony.

Any person who is convicted of a criminal offense under this subsection is permanently barred from accessing the controlled substances reporting system.

(l) The State Bureau of Investigation, Diversion & Environmental Crimes Unit, may investigate suspected violations of this section and shall notify the Department of any charges or convictions pursuant to this section.