CHAPTER 23-01.3 HEALTH INFORMATION PROTECTION 23-01.3-01. Definitions

As used in this chapter: 1

"Confidential information" includes any confidential record as defined in subsection 3 of section 44-04-17.1, any protected health information, and any other information declared confidential by law

"Disclose" means to disclose, transfer, permit access to, or otherwise divulge protected health information to any person other than the individual who is the subject of that information and includes the initial disclosure and any subsequent redisclosures of individually identifiable health care information

"Institutional review board" means any board, committee, or other group formally designated by an institution or public health authority or authorized under federal or state law to review, approve the initiation of, or conduct a periodic review of research programs to assure the protection of the rights and welfare of human research subjects

"Law enforcement inquiry" means any executive branch investigation or official proceeding inquiring into a violation of, or failure to comply with, any criminal or civil statute or any regulation, rule, or order issued pursuant to such a statute

"Nonidentifiable health information" means any information that would otherwise be protected health information except that it does not reveal the identity of the individual whose health or health care is the subject of the information and there is no reasonable basis to believe that the information could be used to identify that individual

"Person" means a government, governmental subdivision of an executive branch agency or authority, corporation, company, association, firm, partnership, society, estate, trust, joint venture, individual, individual representative, tribal government, and any other legal entity

"Protected health information" means any information, including genetic information, demographic information, and fluid or tissue samples collected from an individual, diagnostic and test results, whether oral or recorded in any form or medium, which: a

Is created or received by a health care provider, health researcher, health plan, health oversight authority, public health authority, employer, health or life insurer, school or university; and (1) Relates to the past, present, or future physical or mental health or condition of an individual, including individual cells and their components; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (a) (b) With respect to which there is a reasonable basis to believe that the Identifies an individual; or (2) b

information can be used to identify an individual

"Public health authority" means the state department of health, department of environmental quality, a local public health unit, and any authority or instrumentality of the United States, a tribal government, a state, or a political subdivision of a state, a foreign nation, or a political subdivision of a foreign nation, which is: a

b

Primarily responsible for public health matters; and Primarily engaged in activities such as injury reporting, public health surveillance, and public health investigation or intervention

"School or university" means an institution or place for instruction or education, including an elementary school, secondary school, or institution of higher learning, a college, or an assemblage of colleges united under one corporate organization or government

"State" includes the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands

2

3

4

5

6

7

8

9

10

Page No. 1 11

"Writing" or "written" means writing in either a paper-based or computer-based form, including electronic signatures

23-01.3-02. Disclosure of protected health information - In general

Protected health information in possession of a public health authority may be disclosed only as authorized by this chapter or another law of this state explicitly authorizing the disclosure of that information, except that protected health information received or maintained under chapter 23-01.1 may be disclosed only as authorized by that chapter. Subject to section 23-01-15, subsection 1 of section 23-07-02.2, and any other requirements of this title, this chapter does not prohibit a public health authority from disclosing protected health information for use in a biomedical research project approved by an institutional review board or a privacy board or protected health information that has been transformed to protect the identity of the patient through coding or encryption if the information is disclosed for use in an epidemiological or statistical study

23-01.3-03. Disclosure of a patient's own record

Repealed by S.L. 2003, ch. 211, ยง 27

23-01.3-04. Nonpublic disclosure to a public health authority

1

b

A health care provider, public health authority, law enforcement official, school or university, or the agent of any such individual or entity, may disclose protected health information concerning an individual to a public health authority if: a

There is a specific nexus between the individual's identity and a threat of a specific disease, death, or injury to any individual or to the public health; and The individual's identity would allow that public health authority to prevent or significantly reduce the possibility of disease, injury, or death to any individual or the public health

An entity described in subsection 1 is not liable for the disclosure of protected health information: a

To a public health authority based upon a good-faith belief and credible representation made by that authority that this information is required to protect an individual or the public health from a threat of a specific disease, injury, or death; or If that disclosure is made pursuant to a federal or state law that is designed to protect the public health or safety

Except for the failure to report information required by chapter 23-07, 23-07.1, 23-07.3, or 23-07.4, or any other law requiring disclosure of information regarding a disease or condition, an entity described in subsection 1 is not liable for the failure to disclose protected health information to a public health authority

Any disclosure of protected health information under this section must be limited to the minimum amount of information necessary to achieve the purposes of this section

A recipient of information pursuant to this section may use or disclose that information solely to achieve the purposes of this section

b

2

3

4

5

6. Nothing in this section permitting the disclosure of protected health information may be construed to require that disclosure, unless disclosure is otherwise required by law

Protected health information disclosed under this section must be clearly identified as protected health information that is subject to this chapter

7

23-01.3-05. Nonpublic disclosure in emergency circumstances

1

In the event of a threat of imminent physical or mental harm to the subject of protected health information, a public health authority, in order to allay or remedy that threat, may disclose protected health information about that subject to a health care practitioner, health care facility, law enforcement authority, or emergency medical personnel to protect the health or safety of that subject

Page No. 2 2

3

4

5

b

c

In the event of a threat of harm to an individual other than the subject of protected health information, a public health authority may disclose protected health information about that subject if: a

There is an identifiable threat of serious disease, injury, or death to an identifiable individual or group of individuals; The subject of the protected health information has the ability to carry out that threat; and The disclosure of that information is necessary to prevent or significantly reduce the possibility of that threat

Any disclosure of protected health information under this section must be limited to the minimum amount of information necessary to achieve the purposes of this section

A recipient of information pursuant to this section may use or disclose that information solely to carry out the purposes of this section

Protected health information disclosed under this section must be clearly identified as protected health information that is subject to this section

23-01.3-06. Disclosure for law enforcement purposes

1. Notwithstanding any other law, a public health authority, or the agent of any such entity, may disclose protected health information to a law enforcement authority if the state health officer determines that: a

The protected health information is necessary to a legitimate law enforcement inquiry that has begun or may be initiated into a particular violation of a criminal law or public health law being conducted by the authority; and The investigative or evidentiary needs of the law enforcement authority cannot be satisfied by nonidentifiable health information or by any other information

b

2

3

If a public health authority discloses protected health information under this section, that authority shall impose appropriate written safeguards to ensure the confidentiality of the information and to protect against unauthorized or improper use or disclosure

Protected health information about an individual that is disclosed under this section may not be used in, or disclosed to any person for use in, any administrative, civil, or criminal action or investigation directed against the individual, unless the action or investigation arises out of, or is directly related to, the law enforcement inquiry for which the information was obtained

5

4. When the matter or need for which protected health information was disclosed to a law enforcement authority or grand jury has concluded, including any derivative matters arising from that matter or need, the law enforcement authority or grand jury must either destroy the protected health information or return it to the person from whom it was obtained

To the extent practicable, and consistent with the requirements of due process, a law enforcement authority shall redact personally identifying information from protected health information prior to the public disclosure of that protected information in a judicial or administrative proceeding

Any disclosure of protected health information under this section must be limited to the minimum amount of information necessary to fulfill the purposes of this section

A recipient of information pursuant to this section may use or disclose that information solely to fulfill the purposes of this section

Protected health information disclosed under this section must be clearly identified as protected health information that is subject to this chapter

This section may not be construed to limit or restrict the ability of law enforcement authorities to gain information while in hot pursuit of a suspect or if other exigent circumstances exist

6

7

8

9

23-01.3-07. Disclosure of a public health incident

1. Notwithstanding any other law, the state health officer may disclose confidential information or protected health information to a health care provider or the public if the state health officer determines that: Page No. 3 a. Disclosure of information is required to prevent the spread of disease; b. Disclosure of information is required to identify the cause or source of disease; or c. Disclosure of information is required to allay fear and aid the public in understanding the risk of its exposure to disease

2

The state health officer may disclose protected health information only to the extent necessary to accomplish the purposes of this section, and may require any health care provider receiving confidential or protected health information under this section to keep that information confidential under written terms

23-01.3-08. Status of information in possession of a local public health authority

Any protected health information that is created or received by a local public health authority, and that is submitted or is required to be submitted to the state department of health, is confidential and subject to the protection of, and may be disclosed only as authorized by, this chapter

23-01.3-09. Penalty for unauthorized disclosure

A person who knowingly discloses protected health information in violation of this chapter is guilty of a class A misdemeanor

Page No. 4