58-2-40. Promulgation of rules to protect privacy of medical records. The director of insurance shall promulgate rules pursuant to chapter 1-26, to protect the privacy of personally identifiable health care and medical information, data, and records. The rules shall cover health care and medical information, data, and records collected, used, or disclosed by any person licensed or registered under Title 58 or any person with whom such licensees or registrants contract, and shall include all health care and medical information, data, and records received by or in the possession of the Division of Insurance. The rules may include the following:

(1) Definition of terms;

(2) Standards for the protection of the privacy and confidentiality of personally identifiable health care information and medical records;

(3) Rules for the collection, use, storage, security, disclosure, release, and disposal of health care and medical information, data, and records in all forms, including printed material, plastic media, audio, video, computerized and electronic transmissions;

(4) Rules regarding the sale and exchange of health care and medical information, data, and records;

(5) Rules to define the responsibilities and limitations of those needing or requiring access to health care and medical information, data, and records;

(6) Rules for procedures and documents required for the release or transfer of health care and medical information, data, and records, including the identity of who may release such information and records and under what conditions and provisions of the law, as needed to protect the privacy of personally identifiable health care and medical information, data, and records;

(7) Rules for the collection, use, storage, security, disclosure, distribution, release, and disposal of health care information and medical records obtained, used, or held in connection with the operation, maintenance, or review of insurance certificates, contracts, policies, and plans, and health maintenance organizations, subject to the jurisdiction of the director of insurance.Source: SL 2000, ch 234, § 1.