Handles health records, in Montana

Mont. Code Ann. § 33-19-306(10), (14) · Read the law's page

• If you are a licensee disclosing personal or privileged information for an actuarial or research study, limit the disclosure to what is reasonably necessary, make sure no individual is identified in any actuarial or research report, return or destroy the materials that allow an individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to further disclose the information without the individual's separate, written authorization (section 33-19-306(10)(a)).
• If you are a licensee disclosing for health research, make sure the research is subject to institutional review board approval and the federal requirements for biomedical research, and if you disclose for epidemiological or drug therapy outcomes research, disclose only information that has been made anonymous to protect the identity of the patient through coding or encryption (section 33-19-306(10)(b)).
• If you are a licensee disclosing to a group policyholder for reporting claims experience or auditing your operations or services, disclose only what the group policyholder reasonably needs, get its agreement not to further disclose the information without the individual's separate, written authorization, and edit any medical record information disclosed to prevent the identification of the applicant, policyholder or certificate holder (section 33-19-306(14)).

Mont. Code Ann. § 50-16-529(6), (7) · Read the law's page

• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information without the patient's authorization for use in a research project, disclose it only for a project that an institutional review board has determined contains reasonable safeguards to protect against directly or indirectly identifying any patient in any report of the project, and procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention for another research project (section 50-16-529(6)(d) and (e)).
• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information to a person who obtains it for an audit, disclose it only to a person who agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified, and not to disclose the information further except to accomplish the audit or to report unlawful or improper conduct involving fraud in payment for health care or other unlawful conduct by a health care provider (section 50-16-529(7)).

Mont. Code Ann. §§ 50-16-501 to 50-16-553 · Read the law's page

• If you are a health care provider not subject to the HIPAA privacy provisions, do not disclose health care information about a patient to any other person without the patient's written authorization, except as sections 50-16-529 and 50-16-530 and other law allow, and conform any disclosure to the authorization.
• Keep with a patient's recorded health care information a record of each person who received or examined it in the preceding 3 years, with name, address, institutional affiliation, date and, to the extent practicable, a description of the information disclosed.
• Effect reasonable safeguards for the security of all health care information you maintain.
• If you provide health care at a facility you operate and maintain patient records, create a notice of information practices and post it in a conspicuous place in the facility.
• Within 10 days of a written request from a patient to examine or copy recorded health care information, make it available for examination without charge or provide a copy, or tell the patient it does not exist, who keeps it, why there is a delay (not later than 21 days) or that the request is denied under section 50-16-542.
• If you are a mental health digital service handling health care information on behalf of an individual, comply with the disclosure and confidentiality provisions of the part.