17:48H-30. Confidentiality of data, information; exceptions

30. Any data or information relating to the diagnosis, treatment or health of an enrollee, prospective enrollee or contract holder obtained by a certified or licensed organized delivery system from the carrier, contract holder, enrollee, prospective enrollee or any provider shall be confidential and shall not be disclosed to any person except:

a. To the extent that it may be necessary to carry out the purposes of this act;

b. Upon the express consent of the enrollee, prospective enrollee or contract holder;

c. Pursuant to statute or court order for the production of evidence or the discovery thereof;

d. In the event of a claim or litigation between an enrollee, a prospective enrollee or a contract holder and the organized delivery system wherein that data or information is relevant. An organized delivery system shall be entitled to claim any statutory privilege against disclosure which the provider who furnished the information to the system is entitled to claim;

e. For epidemiological and outcomes research when the identity of the enrollee, prospective enrollee or contract holder is protected through the use of anonymized information. For the purposes of this subsection, "anonymized information" means information that has been coded or encrypted to protect the identity of the enrollee, prospective enrollee or contract holder in such a manner that decoding or unencryption of the information can occur only with the use of a key that is available only to authorized persons and utilized only as deemed necessary by those persons, and the unauthorized use of which is subject to such penalties as are prescribed by law; or

f. Upon the informed consent of the enrollee, prospective enrollee or contract holder, which is obtained for research that has been approved by an institutional review board, in accordance with federal requirements for informed consent under 21C.F.R.50 et seq. or 45C.F.R.46 et seq.

L.1999, c.409, s.30; amended 2001, c.112.