Handles health records, in New Hampshire

RSA 332-I:4 to 332-I:6 · Read the law's page

• If you are a health care provider or a business associate of one, obtain an authorization for any use or disclosure of protected health information for marketing, meeting the HIPAA authorization specifications for marketing (RSA 332-I:4, I).
• For fundraising uses of protected health information, give each intended recipient a clear and conspicuous opportunity to elect not to receive fundraising communications, and treat an election as a revocation of authorization (RSA 332-I:4, II).
• Do not disclose protected health information used for marketing or fundraising by voice mail, an unattended facsimile, or other methods of communication that are not secure (RSA 332-I:4, III).
• Promptly notify in writing the individuals whose protected health information was disclosed when a use or disclosure is allowed under federal law but not permitted by RSA 332-I:4; a business associate bears the cost of notice for its own disclosures (RSA 332-I:5).

RSA 332-I:1 · Read the law's page

• If you are a health care provider, or a third-party vendor that stores and issues copies of a provider's medical records, give a patient or the patient's requestor a copy of the patient's medical records on request (RSA 332-I:1, I).
• Provide the records within 30 days of receipt of the request, and provide any records not provided within 30 days at no cost (RSA 332-I:1, I(d)).
• Charge a requestor no more than $50.00 for electronic copies and no more than $5 for the first page, $.41 per page for pages 2 through 50 and $.30 per page for pages 51 and higher for paper copies (RSA 332-I:1, I(b)).
• Provide the records in electronic format when they are stored and available in that format, unless the requestor asks for paper (RSA 332-I:1, I(c)).
• When the requestor is the person's health care provider, make the requested transfer within 14 days at no cost (RSA 332-I:1, I(f)).
• Do not release or use patient identifiable medical information for the purpose of sales or marketing of services or products without written authorization (RSA 332-I:1, III).

RSA 332-I:2, I(g); 332-I:3, III · Read the law's page

• If you are the health information organization, maintain an audit log of the transactions transmitted through it (RSA 332-I:3, III).
• If you transmit or receive protected health information through the health information organization, maintain audit logs in accordance with nationally accepted interoperability standards, practices, regulations and statutes, including the identity of the health care provider accessing the information, the identity of the individual whose information was accessed, the date of access and the area of the record that was accessed (RSA 332-I:3, III).
• If you are a health care provider that maintains an individual's medical record in electronic form, give the individual, on request, a report of access to the record by a provider the individual names within an identified period in the prior 3 years, based on whatever audit trail you maintain (RSA 332-I:2, I(g)).