Handles health records, in American Samoa

American Samoa Public Health Act, ASCA 13.0216 to 13.0223 · Read the law's page

• If you are the American Samoa Department of Health, acquire identifiable health information only where the acquisition relates directly to a public health purpose, is reasonably likely to achieve it, and the purpose cannot be achieved as well with non-identifiable health information, and never acquire it secretly (13.0217(a) and (b)).
• If you are the Department of Health, before you implement a decision to acquire or store identifiable health information, announce your intention and its purposes by public written notice posted and distributed so as to reasonably inform the affected community (13.0217(c)).
• If you are the Department of Health, use identifiable health information only for public health purposes directly related to the purpose it was acquired for, limited to the minimum you reasonably believe necessary, under a confidentiality statement from each person who receives it, and never for commercial purposes (13.0218(a) and (c)).
• If you are the Department of Health, expunge identifiable health information in a confidential manner once its use no longer furthers the public health purpose for which it was acquired (13.0218(e)).
• If you are the Department of Health, disclose identifiable health information only with the written authorization of the individual or the individual's legal representative, unless the Act or other controlling law permits it, limit each disclosure to the minimum necessary, and accompany or follow it with the written statement of the department's disclosure policy (13.0219(a) to (d)).
• If you are the Department of Health, keep a written or electronic record of each authorized disclosure for ten years, naming the recipient, the date and purpose, a description of what was disclosed and the legal authority (13.0219(g)).
• If you have received identifiable health information that the Department of Health disclosed, do not disclose it to another person except as the Act or other controlling law authorizes (13.0219(f)).
• If you are the Department of Health, keep identifiable health information you receive from any source other than the individual it concerns (or that individual's legal representative) in a physically and technologically secure environment, limit access to persons with a demonstrable need, train every person who handles it, investigate any potential or actual security breach, impose disciplinary sanctions where appropriate, and prepare an annual report on the status of its security protections for department personnel (13.0220(a) and (d)).
• If you are the Department of Health, display a written notice of the disclosure policy wherever identifiable health information is accessible (13.0220(b)).
• If you are department personnel or another person with authority to acquire, use, disclose, or store identifiable health information, sign a confidentiality statement and report any known security breach, or action that may lead to one, to the director or the director's designee (13.0220(c)).
• If you are the Department of Health, let a requestor inspect their identifiable health information within fourteen days of a request, provide copies without charge within ten days of a request, and give written reasons if you deny a request (13.0221 and 13.0222(b)).
• If you are the Department of Health, correct, amend, or delete erroneous, incomplete, or false identifiable health information within fourteen days of a request where the modification is reasonably supported, and notify the requestor in writing of the outcome (13.0223(c) and (d)).