130A-480. Emergency department data reporting.

(a) For the purpose of ensuring the protection of the public health, the State Health Director shall develop a syndromic surveillance program for hospital emergency departments in order to detect and investigate public health threats that may result from (i) a terrorist incident using nuclear, biological, or chemical agents or (ii) an epidemic or infectious, communicable, or other disease. The State Health Director shall specify the data to be reported by hospitals pursuant to this program, subject to the following:

(1) Each hospital shall submit electronically available emergency department data as specified by rule by the Commission. The Commission, in consultation with hospitals, shall establish by rule a schedule for the implementation of full electronic reporting capability of all data elements by all hospitals. The schedule shall take into consideration the number of data elements already reported by the hospital, the hospital's capacity to electronically maintain the remaining elements, available funding, and other relevant factors.

(2) None of the following data for patients or their relatives, employers, or household members may be collected by the State Health Director: names; postal or street address information, other than town or city, county, state, and the first five digits of the zip code; geocode information; telephone numbers; fax numbers; electronic mail addresses; social security numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers and serial numbers, including license plate numbers; device identifiers and serial numbers; web universal resource locators (URLs); Internet protocol (IP) address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images.

(b) The following are not public records under Chapter 132 of the General Statutes and are privileged and confidential:

(1) Data reported to the State Health Director pursuant to this section.

(2) Data collected or maintained by any entity with whom the State Health Director contracts for the reporting, collection, or analysis of data pursuant to this section.

The State Health Director shall maintain the confidentiality of the data reported pursuant to this section and shall ensure that adequate measures are taken to provide system security for all data and information. The State Health Director may share data with local health departments and the Centers for Disease Control and Prevention (CDC) for public health purposes. Local health departments are bound by the confidentiality provisions of this section. The Department shall enter into an agreement with the CDC to ensure that the CDC complies with the confidentiality provisions of this section. The State Health Director shall not allow information that it receives pursuant to this section to be used for commercial purposes and shall not release data except as authorized by other provisions of law.

(c) A person is immune from liability for actions arising from the required submission of data under this Article.

(d) For purposes of this section, "hospital" means a hospital, as defined in G.S. 131E-214.1(3), that operates an emergency room on a 24-hour basis. The term does not include a psychiatric hospital that operates an emergency room.

(e) Administrative emergency department data shall be reported by hospitals under Article 11A of Chapter 131E of the General Statutes.