Processes de-identified data, in Montana

Mont. Code Ann. § 33-19-306(10), (14) · Read the law's page

• If you are a licensee disclosing personal or privileged information for an actuarial or research study, limit the disclosure to what is reasonably necessary, make sure no individual is identified in any actuarial or research report, return or destroy the materials that allow an individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to further disclose the information without the individual's separate, written authorization (section 33-19-306(10)(a)).
• If you are a licensee disclosing for health research, make sure the research is subject to institutional review board approval and the federal requirements for biomedical research, and if you disclose for epidemiological or drug therapy outcomes research, disclose only information that has been made anonymous to protect the identity of the patient through coding or encryption (section 33-19-306(10)(b)).
• If you are a licensee disclosing to a group policyholder for reporting claims experience or auditing your operations or services, disclose only what the group policyholder reasonably needs, get its agreement not to further disclose the information without the individual's separate, written authorization, and edit any medical record information disclosed to prevent the identification of the applicant, policyholder or certificate holder (section 33-19-306(14)).

Mont. Code Ann. § 30-14-2815 · Read the law's page

• To hold data as de-identified under the MCDPA, take reasonable measures to ensure that the data cannot be associated with an individual (Mont. Code Ann. section 30-14-2815(1)(a)).
• Publicly commit to maintaining and using de-identified data without attempting to re-identify it (Mont. Code Ann. section 30-14-2815(1)(b)).
• Contractually obligate every recipient of de-identified data to comply with all provisions of the MCDPA (Mont. Code Ann. section 30-14-2815(1)(c)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments that bind it and take appropriate steps to address any breach of those commitments (Mont. Code Ann. section 30-14-2815(5)).

Mont. Code Ann. § 50-16-529(6), (7) · Read the law's page

• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information without the patient's authorization for use in a research project, disclose it only for a project that an institutional review board has determined contains reasonable safeguards to protect against directly or indirectly identifying any patient in any report of the project, and procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention for another research project (section 50-16-529(6)(d) and (e)).
• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information to a person who obtains it for an audit, disclose it only to a person who agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified, and not to disclose the information further except to accomplish the audit or to report unlawful or improper conduct involving fraud in payment for health care or other unlawful conduct by a health care provider (section 50-16-529(7)).