143-518. Confidentiality of patient information.

(a) Medical records compiled and maintained by the Department, hospitals participating in the statewide trauma system, or EMS providers in connection with dispatch, response, treatment, or transport of individual patients or in connection with the statewide trauma system pursuant to Article 7 of Chapter 131E of the General Statutes may contain patient identifiable data which will allow linkage to other health care-based data systems for the purposes of quality management, peer review, and public health initiatives.

These medical records and data shall be strictly confidential and shall not be considered public records within the meaning of G.S. 132-1 and shall not be released or made public except under any of the following conditions:

(1) Release is made of specific medical or epidemiological information for statistical purposes in a way that no person can be identified.

(2) Release is made of all or part of the medical record with the written consent of the person or persons identified or their guardians.

(3) Release is made to health care personnel providing medical care to the patient.

(4) Release is made pursuant to a court order. Upon request of the person identified in the record, the record shall be reviewed in camera. In the trial, the trial judge may, during the taking of testimony concerning such information, exclude from the courtroom all persons except the officers of the court, the parties, and those engaged in the trial of the case.

(5) Release is made to a Medical Review Committee as defined in G.S. 131E-95, 90-21.22A, or 130A-45.7 or to a peer review committee as defined in G.S. 131E-108, 131E-155, 131E-162, 122C-30, or 131D-21.1.

(6) Release is made for use in a health research project under rules adopted by the North Carolina Medical Care Commission. The Commission shall adopt rules that allow release of information when an institutional review board, as defined by the Commission, has determined that the health research project:

a. Is of sufficient scientific importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;

b. Is impracticable without the use or disclosure of identifying health information;

c. Contains safeguards to protect the information from redisclosure;

d. Contains safeguards against identifying, directly or indirectly, any patient in any report of the research project; and

e. Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project.

(7) Release is made to a statewide data processor, as defined in Article 11A of Chapter 131E of the General Statutes, in which case the data is deemed to have been submitted as if it were required to have been submitted under that Article.

(8) Release is made pursuant to any other law.

(b) Charges, accounts, credit histories, and other personal financial records compiled and maintained by the Department or EMS providers in connection with the admission, treatment, and discharge of individual patients are strictly confidential and shall not be released.