§ 22 §1711-C — Confidentiality of health care information

1.
Definitions.
As used in this section, unless the context otherwise indicates, the following terms have the following meanings.
2.
Confidentiality of health information; disclosure.
An individual's health care information is confidential and may not be disclosed other than to the individual by the health care practitioner or facility except as provided in subsection 3, 3‑A, 3‑B, 6 or 11. Nothing in this section prohibits a health care practitioner or health care facility from adhering to applicable ethical or professional standards provided that these standards do not decrease the protection of confidentiality granted by this section.
3.
Written authorization to disclose.
A health care practitioner or facility may disclose health care information pursuant to a written authorization signed by an individual for the specific purpose stated in the authorization. A written authorization to disclose health care information must be retained with the individual's health care information. A written authorization to disclose is valid whether it is in an original, facsimile or electronic form. A written authorization to disclose must contain the following elements:
3-A.
Oral authorization to disclose.
When it is not practical to obtain written authorization under subsection 3 from an individual or person acting pursuant to subsection 3‑B or when a person chooses to give oral authorization to disclose, a health care practitioner or facility may disclose health care information pursuant to oral authorization. A health care practitioner or facility shall record with the individual's health care information receipt of oral authorization to disclose, including the name of the authorizing person, the date, the information and purposes for which disclosure is authorized and the identity or description of the 3rd party to whom the information is to be disclosed.
3-B.
Authorization to disclose provided by a 3rd party.
When an individual or an authorized representative is unable to provide authorization to disclose under subsection 3 or 3‑A, a health care practitioner or facility may disclose health care information pursuant to authorization to disclose that meets the requirements of subsection 3 or 3‑A given by a 3rd party listed in this subsection. A health care practitioner or facility may determine not to obtain authorization from a person listed in this subsection when the practitioner or facility determines it would not be in the best interest of the individual to do so. In making this decision, the health care practitioner or facility shall respect the safety of the individual and shall consider any indicators, suspicion or substantiation of abuse. Persons who may authorize disclosure under this subsection include:
4.
Duration of authorization to disclose.
An authorization to disclose may not extend longer than 30 months, except that the duration of an authorization for the purposes of insurance coverage under Title 24, 24‑A or 39‑A is governed by the provisions of Title 24, 24‑A or 39‑A, respectively.
5.
Revocation of authorization to disclose.
A person who may authorize disclosure may revoke authorization to disclose at any time, subject to the rights of any person who acted in reliance on the authorization prior to receiving notice of revocation. A written revocation of authorization must be signed and dated. If the revocation is in electronic form, a unique identifier of the individual and the date the individual authenticated the electronic authorization must be stated in place of the individual's signature and date of signature. A health care practitioner or facility shall record receipt of oral revocation of authorization, including the name of the person revoking authorization and the date. A revocation of authorization must be retained with the authorization and the individual's health care information.
6.
Disclosure without authorization to disclose.
A health care practitioner or facility may disclose, or when required by law must disclose, health care information without authorization to disclose under the circumstances stated in this subsection or as provided in subsection 11. Disclosure may be made without authorization as follows:
7.
Confidentiality policies.
A health care practitioner, facility or state-designated statewide health information exchange shall develop and implement policies, standards and procedures to protect the confidentiality, security and integrity of health care information to ensure that information is not negligently, inappropriately or unlawfully disclosed. The policies of health care facilities must provide that an individual being admitted for inpatient care be given notice of the right of the individual to control the disclosure of health care information. The policies must provide that routine admission forms include clear written notice of the individual's ability to direct that that individual's name be removed from the directory listing of persons cared for at the facility and notice that removal may result in the inability of the facility to direct visitors and telephone calls to the individual.
8.
Prohibited disclosure.
Disclosure of health care information is prohibited as follows.
9.
Disclosures of corrections or clarifications to health care information.
A health care practitioner or facility shall provide to a 3rd party a copy of an addition submitted by an individual to the individual's health care information if:
10.
Requirements for disclosures.
Except as otherwise provided by law, disclosures of health care information pursuant to this section are subject to the professional judgment of the health care practitioner and to the following requirements.
11.
Health care information subject to other laws, rules and regulations.
Health care information that is subject to the provisions of 42 United States Code, Section 290dd‑2 (Supplement 1998); chapters 710‑B and 711; Title 5, section 200‑E; Title 5, chapter 501; Title 24 or 24‑A; Title 34‑B, section 1207; Title 39‑A; or other provisions of state or federal law, rule or regulation is governed solely by those provisions.
12.
Minors.
If a minor has consented to health care in accordance with the laws of this State, authorization to disclose health care information pursuant to this section must be given by the minor unless otherwise provided by law.
13.
Enforcement.
This section may be enforced within 2 years of the date a disclosure in violation of this section was or should reasonably have been discovered.
14.
Waiver prohibited.
Any agreement to waive the provisions of this section is against public policy and void.
15.
Immunity.
A cause of action in the nature of defamation, invasion of privacy or negligence does not arise against any person for disclosing health care information in accordance with this section. This section provides no immunity for disclosing information with malice or willful intent to injure any person.
16.
Application.
This section applies to all requests, directives and authorizations to disclose health care information executed on or after February 1, 2000. An authorization to disclose health care information executed prior to February 1, 2000 that does not meet the standards of this section is deemed to comply with the requirements of this section until the next health care encounter between the individual and the health care practitioner or facility.
17.
Repeal.
18.
Participation in a state-designated statewide health information exchange.
The following provisions apply to participation in a state-designated statewide health information exchange.
20.
Exemption from freedom of access laws.
Except as provided in this section, the names and other identifying information of individuals in a state-designated statewide health information exchange are confidential and are exempt from the provisions of Title 1, chapter 13.

Legislative History

RR 1997, c. 2, §44 (COR). PL 1997, c. 793, §A8 (NEW). PL 1997, c. 793, §A10 (AFF). PL 1999, c. 3, §§1,2 (AMD). PL 1999, c. 3, §§3,5 (AFF). PL 1999, c. 512, §A5 (AMD). PL 1999, c. 512, §A6, 7 (AFF). PL 1999, c. 790, §§A58,60 (AFF). RR 2001, c. 1, §26 (COR). PL 2001, c. 346, §1 (AMD). PL 2009, c. 211, Pt. B, §17 (AMD). PL 2009, c. 292, §3 (AMD). PL 2009, c. 292, §6 (AFF). PL 2009, c. 387, §§1, 2 (AMD). PL 2011, c. 347, §§6-8 (AMD). PL 2011, c. 373, §§1-4 (AMD). PL 2011, c. 572, §1 (AMD). PL 2011, c. 691, Pt. A, §20 (AMD). PL 2013, c. 289, §§1, 2 (AMD). PL 2013, c. 326, §1 (AMD). PL 2013, c. 528, §1 (AMD). PL 2013, c. 528, §12 (AFF). RR 2015, c. 1, §17 (COR). PL 2015, c. 218, §1 (AMD). PL 2015, c. 370, §§4, 5 (AMD). PL 2017, c. 203, §§2-4 (AMD). PL 2017, c. 402, Pt. C, §44 (AMD). PL 2017, c. 402, Pt. F, §1 (AFF). PL 2017, c. 407, Pt. A, §72 (AMD). PL 2019, c. 417, Pt. B, §14 (AFF). PL 2021, c. 398, Pt. MMMM, §§3-5 (AMD). RR 2021, c. 2, Pt. B, §106 (COR). PL 2023, c. 648, Pt. F, §§1-5 (AMD). PL 2025, c. 332, §§1-3 (AMD).