9-2-126. Client treatment records; research; access; disclosure; penalties.

(a) The department may authorize or provide access to or provide copies of an individually identifiable record for research purposes if informed written consent for the disclosure has been given to the department by the person to whom the record pertains or, in the case of minors and legally incompetent adults, the person's legal representative.

(b) The department may authorize or provide access to or provide copies of an individually identifiable record it has in its control or the registration or treatment records of a treatment facility for research purposes without the informed consent of the person to whom the record pertains or the person's legally authorized representative, only if:

(i) The department adopts research review and approval rules including, but not limited to, the requirement that the research organization appoints a standing human research review board competent to review research proposals as to ethical and scientific soundness and the review board determines that the disclosure request has scientific merit and is of importance in terms of the agency's program concerns, that the research purposes cannot be reasonably accomplished without disclosure of the information in individually identifiable form and without waiver of the informed consent of the person to whom the record pertains or the person's legal representative, that disclosure risks have been minimized, and that remaining risks are outweighed by anticipated health, safety or scientific benefits;

(ii) The disclosure does not violate federal law or regulations; and

(iii) The department negotiates with the research organization receiving the records or record information a written and legally binding confidentiality agreement prior to disclosure. The agreement shall:

(A) Establish specific safeguards to assure the continued confidentiality and security of individually identifiable records or record information;

(B) Ensure that the research organization will report or publish research findings and conclusions in a manner that does not permit identification of the person whose record was used for the research. Final research reports or publications shall not include photographs or other visual representations contained in personal records;

(C) Establish that the research professional will destroy the individual identifiers associated with the records or record information as soon as the purposes of the research project have been accomplished and notify the department to this effect in writing;

(D) Prohibit any subsequent disclosure of the records or record information in individually identifiable form except as provided in subsection (c) of this section; and

(E) Provide for the signature of the research professional, of any of the research professional's team members who require access to the information in identified form, and of the department official authorized to approve disclosure of identifiable records or record information for research purposes.

(c) No research professional who has established an individually identifiable research record from record information pursuant to subsection (b) of this section, or who has established a research record from data or information voluntarily provided by a treatment facility under a written confidentiality assurance for the explicit purpose of research, may disclose the record in individually identifiable form unless:

(i) The person to whom the research record pertains or the person's legal representative has given prior informed written consent for the disclosure;

(ii) The research organization reasonably believes that disclosure will prevent or minimize injury to a person and the disclosure is limited to information necessary to protect the person who has been or may be injured, and the research organization reports the disclosure only to the person involved or the person's guardian, the person's physician and the department;

(iii) The research record is disclosed in individually identifiable form for the purposes of auditing or evaluating a research program and:

(A) The audit or evaluation is authorized or required by federal or state law or regulation or is based upon an explicit provision in a research contract, grant or other written research agreement; and

(B) No subsequent disclosure of the research record in individually identifiable form will be made by the auditor or evaluator except as provided in this section; or

(iv) The research record is furnished in compliance with a search warrant or court order, provided that:

(A) The court issues the search warrant or judicial subpoena concerning the research record solely for the purpose of facilitating inquiry into an alleged violation of law by the research organization using the record for a research purpose or by the agency; and

(B) Any research record obtained pursuant to this paragraph and any information directly or indirectly derived from the research record shall remain confidential to the extent possible and shall not be used as evidence in an administrative or judicial proceeding except against the research organization using the record for a research purpose or against the department.

(d) Unauthorized disclosure, whether willful or negligent, by a research organization that has obtained an individually identifiable record or record information from the department or a treatment facility pursuant to subsection (b) of this section is a misdemeanor punishable by imprisonment for not more than six (6) months, a fine of not more than ten thousand dollars ($10,000.00), or both. All fines and penalties collected under this section shall be paid to the state treasurer and credited as provided in W.S. 8-1-109. A patient, or in the case of a minor or legally incompetent person, the person's legal representative, may maintain a civil action for damages for unauthorized disclosure of protected health information against any person or entity making such an unauthorized disclosure.

(e) Nothing in W.S. 9-2-125 or 9-2-126 shall require the department to provide client registration records or client treatment records in a format that is not within the technological capabilities of the department at the time the request is made for such records.