§ 4284. Protection and disclosure of information

(a) The data collected pursuant to this chapter and all related information and records shall be confidential, except as provided in this chapter, and shall not be subject to the Public Records Act. The Department shall maintain procedures to protect patient privacy, ensure the confidentiality of patient information collected, recorded, transmitted, and maintained, and ensure that information is not disclosed to any person except as provided in this section.

(b)(1) The Department shall provide only the following persons with access to query the VPMS:

(A) a health care provider, dispenser, or delegate who is registered with the VPMS and certifies that the requested information is for the purpose of providing medical or pharmaceutical treatment to a bona fide current patient;

(B) personnel or contractors, as necessary for establishing and maintaining the VPMS;

(C) the Medical Director of the Department of Vermont Health Access, for the purposes of Medicaid quality assurance, utilization, and federal monitoring requirements with respect to Medicaid recipients for whom a Medicaid claim for a Schedule II, III, or IV controlled substance has been submitted;

(D) a medical examiner or delegate from the Office of the Chief Medical Examiner, for the purpose of conducting an investigation or inquiry into the cause, manner, and circumstances of an individual's death;

(E) a health care provider or medical examiner licensed to practice in another state, to the extent necessary to provide appropriate medical care to a Vermont resident or to investigate the death of a Vermont resident.

(2) The Department shall provide reports of data available to the Department through the VPMS only to the following persons:

(A) A patient or that person's health care provider, or both, when VPMS reveals that a patient may be receiving more than a therapeutic amount of one or more regulated substances.

(B) A designated representative of a board responsible for the licensure, regulation, or discipline of health care providers or dispensers pursuant to a bona fide specific investigation.

(C) A patient for whom a prescription is written, insofar as the information relates to that patient.

(D) The relevant occupational licensing or certification authority if the Commissioner reasonably suspects fraudulent or illegal activity by a health care provider. The licensing or certification authority may report the data that are the evidence for the suspected fraudulent or illegal activity to a drug diversion investigator.

(E)(i) The Commissioner of Public Safety, personally, or the Deputy Commissioner of Public Safety, personally, if the Commissioner of Health, personally, or a Deputy Commissioner of Health, personally, makes the disclosure and has consulted with at least one of the patient's health care providers, when the disclosure is necessary to avert a serious and imminent threat to a person or the public.

(ii) The Commissioner of Public Safety, personally, or the Deputy Commissioner of Public Safety, personally, when he or she requests data from the Commissioner of Health, and the Commissioner of Health believes, after consultation with at least one of the patient's health care providers, that disclosure is necessary to avert a serious and imminent threat to a person or the public.

(iii) The Commissioner or Deputy Commissioner of Public Safety may disclose such data received pursuant to this subdivision (E) as is necessary, in his or her discretion, to avert the serious and imminent threat.

(F) A prescription monitoring system or similar entity in another state pursuant to a reciprocal agreement to share prescription monitoring information with the Vermont Department of Health as described in section 4288 of this title.

(G) The Commissioner of Health or the Commissioner's designee in order to identify patients who filled prescriptions written pursuant to chapter 113 of this title.

(c) A person who receives data or a report from VPMS or from the Department shall not share that data or report with any other person or entity not eligible to receive that data pursuant to subsection (b) of this section, except as necessary and consistent with the purpose of the disclosure and in the normal course of business. Nothing shall restrict the right of a patient to share his or her own data.

(d) The Commissioner shall offer health care providers and dispensers training in the proper use of information they may receive from VPMS. Training may be provided in collaboration with professional associations representing health care providers and dispensers.

(e) A drug diversion investigator who may receive information pursuant to this section shall not have access to VPMS except for information provided to the officer by the licensing or certification authority.

(f) The Department is authorized to use information from VPMS for research, trend analysis, and other public health promotion purposes, provided that data are aggregated or otherwise de-identified. The Department shall post the results of trend analyses on its website for use by health care providers, dispensers, and the general public. When appropriate, the Department shall send alerts relating to identified trends to health care providers and dispensers by electronic mail.

(g) Following consultation with the Vermont Prescription Drug Advisory Council and an opportunity for input from stakeholders, the Department shall develop a policy that will enable it to use information from VPMS to determine if individual prescribers and dispensers are using VPMS appropriately.

(h) Following consultation with the Vermont Prescription Drug Advisory Council and an opportunity for input from stakeholders, the Department shall develop a policy that will enable it to evaluate the prescription of regulated drugs by prescribers.

(i) Knowing disclosure of transmitted data to a person not authorized by subsection (b) of this section, or obtaining information under this section not relating to a bona fide specific investigation, shall be punishable by imprisonment for not more than one year or a fine of not more than $1,000.00, or both, in addition to any penalties under federal law.

(j) All information and correspondence relating to the disclosure of information by the Commissioner to a patient's health care provider pursuant to subdivision (b)(2)(A) of this section shall be confidential and privileged, exempt from public inspection and copying under the Public Records Act, immune from subpoena or other disclosure, and not subject to discovery or introduction into evidence.

(k) Each request for disclosure of data pursuant to subdivision (b)(2)(B) of this section shall document a bona fide specific investigation and shall specify the case number of the investigation. (Added 2005, No. 205 (Adj. Sess.), § 1; amended 2013, No. 75, § 8, eff. Oct. 1, 2013; 2015, No. 27, § 3, eff. May 20, 2015; 2015, No. 173 (Adj. Sess.), § 1; 2019, No. 82, § 7.)