(a) In accordance with § 7-243 and without prior consent from the identified individual, an agency or service provider may use and shall disclose to another agency or service provider health and human services information referencing or relating to the identified individual for the following purposes; provided, that the use or disclosure is not specifically prohibited under District or federal law:

(1) To establish the identified individual’s eligibility for, or determine his or her amount and type of:

(A) Treatment;

(B) Services;

(C) Benefits;

(D) Support; or

(E) Assistance;

(2) To coordinate for the identified individual, his or her:

(A) Treatment;

(B) Benefits;

(C) Services;

(D) Support; or

(E) Assistance;

(3) To conduct oversight activities, including:

(A) Management;

(B) Financial and other audits;

(C) Program evaluations;

(D) Planning;

(E) Investigations;

(F) Examinations;

(G) Inspections;

(H) Quality reviews;

(I) Licensure;

(J) Disciplinary actions; or

(K) Civil, administrative, or criminal proceedings or actions; and

(4) To conduct research related to treatment, benefits, services, supports, and assistance; provided, that:

(A) Health and human services information referencing or relating to an identified individual shall not be disclosed in a manner that would permit the identity of the individual to be reasonably inferred by either direct or indirect means; and

(B) The agency or service provider receiving the health and human services information shall affirm in writing that any individually identifiable health information shall be treated in accordance with HIPAA.

(b) A service provider shall disclose health and human services information to an agency upon request by the agency; provided, that the disclosure and use of such information is in accordance with this chapter.

(c) An agency or service provider shall use or disclose individually identifiable health information in accordance with HIPAA.

(d) When using or disclosing health and human services information, an agency or service provider shall make reasonable efforts to limit such information to the minimum amount necessary to accomplish the purpose of the use or disclosure.

(e) An agency or service provider that discloses health and human services information shall designate an individual responsible for:

(1) Responding to requests for health and human services information from another agency or service provider, who shall:

(A) Respond to a request within 48 hours;

(B) Not unreasonably deny a request; and

(C) Within 5 business days of the date of the request, supply the requested information to the extent such request was approved; and

(2) Ensuring that any health and human services information disclosed pursuant to § 7-243 is limited to the minimum amount of information necessary to accomplish the purpose of the disclosure.

(Dec. 4, 2010, D.C. Law 18-273, § 102, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)

The 2012 amendment by D.C. Law 19-171 validated a previously made technical correction.

For temporary (90 days) amendment of this section, see § 2 of Criminal Justice Coordinating Council Information Sharing Emergency Amendment Act of 2019 (D.C. Act 23-106, July 24, 2019, 66 DCR 9754).

For temporary (90 day) addition, see § 102 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).

For temporary (90 day) addition, see § 102 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18-582, October 20, 2010, 57 DCR 10118).

For temporary (225 days) amendment of this section, see § 2 of Criminal Justice Coordinating Council Information Sharing Temporary Amendment Act of 2019 (D.C. Law 23-41, Jan. 10, 2020, 66 DCR 13139).