Law / United States / 
American Samoa
American Samoa Public Health Act: identifiable health information held by the Department of Health
American Samoa Public Health Act, ASCA 13.0216 to 13.0223
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Security, Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- If you are the American Samoa Department of Health, acquire identifiable health information only where the acquisition relates directly to a public health purpose, is reasonably likely to achieve it, and the purpose cannot be achieved as well with non-identifiable health information, and never acquire it secretly (13.0217(a) and (b)).
- If you are the Department of Health, before you implement a decision to acquire or store identifiable health information, announce your intention and its purposes by public written notice posted and distributed so as to reasonably inform the affected community (13.0217(c)).
- If you are the Department of Health, use identifiable health information only for public health purposes directly related to the purpose it was acquired for, limited to the minimum you reasonably believe necessary, under a confidentiality statement from each person who receives it, and never for commercial purposes (13.0218(a) and (c)).
- If you are the Department of Health, expunge identifiable health information in a confidential manner once its use no longer furthers the public health purpose for which it was acquired (13.0218(e)).
- If you are the Department of Health, disclose identifiable health information only with the written authorization of the individual or the individual's legal representative, unless the Act or other controlling law permits it, limit each disclosure to the minimum necessary, and accompany or follow it with the written statement of the department's disclosure policy (13.0219(a) to (d)).
- If you are the Department of Health, keep a written or electronic record of each authorized disclosure for ten years, naming the recipient, the date and purpose, a description of what was disclosed and the legal authority (13.0219(g)).
- If you have received identifiable health information that the Department of Health disclosed, do not disclose it to another person except as the Act or other controlling law authorizes (13.0219(f)).
- If you are the Department of Health, keep identifiable health information you receive from any source other than the individual it concerns (or that individual's legal representative) in a physically and technologically secure environment, limit access to persons with a demonstrable need, train every person who handles it, investigate any potential or actual security breach, impose disciplinary sanctions where appropriate, and prepare an annual report on the status of its security protections for department personnel (13.0220(a) and (d)).
- If you are the Department of Health, display a written notice of the disclosure policy wherever identifiable health information is accessible (13.0220(b)).
- If you are department personnel or another person with authority to acquire, use, disclose, or store identifiable health information, sign a confidentiality statement and report any known security breach, or action that may lead to one, to the director or the director's designee (13.0220(c)).
- If you are the Department of Health, let a requestor inspect their identifiable health information within fourteen days of a request, provide copies without charge within ten days of a request, and give written reasons if you deny a request (13.0221 and 13.0222(b)).
- If you are the Department of Health, correct, amend, or delete erroneous, incomplete, or false identifiable health information within fourteen days of a request where the modification is reasonably supported, and notify the requestor in writing of the outcome (13.0223(c) and (d)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The Department of Health, which may maintain a civil action against any person to enforce compliance with or violations of the Act (13.0239).
What record it asks for
What the log must hold
Event time, Access record
Log retention
Section 13.0219(g) sets a ten-year period for the record of disclosures, which continues even if the department no longer holds the information disclosed.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
Section 13.0219(g) requires the department to keep a written or electronic record of each disclosure of identifiable health information that the Act authorizes, and to maintain that record for ten years even if the information is no longer in the department's possession. The record is itself treated as identifiable health information.
- Kind
- Explicit
- As of
- Provision
- Am. Samoa Code Ann. 13.0219(g)
- Trigger
- personal_data_processing
What this law does
Public Law 30-11 created new chapters 02 and 03 under title 13 of the American Samoa Code Annotated and was approved on . In the Act, the Department means the Department of Health.
Identifiable health information includes information in any form that relates to an individual's past, present, or future physical or mental health status, condition, treatment, service, products purchased, or provision of care and reveals the identity of the individual whose health care is the subject of the information. Identifiable health information may only be acquired, used, disclosed, and stored consistent with the requirements of the Act.
The Department of Health may not secretly acquire identifiable health information. The Department of Health may acquire identifiable health information only where the acquisition relates directly to a public health purpose and two further conditions are met. The Department of Health may use identifiable health information solely for public health purposes that are directly related to the purpose for which the information was acquired.
The Department of Health may not use identifiable health information for commercial purposes. Identifiable health information is not public information and may not be disclosed without the written authorization of the individual or the individual's legal representative, except as the Act and other controlling law provide. No person to whom identifiable health information has been disclosed may disclose it to another person except as the Act or other controlling law authorizes.
The Department of Health must keep a written or electronic record of its authorized disclosures of identifiable health information. The Department of Health must maintain its record of authorized disclosures for a period of ten years. When the Department of Health receives identifiable health information from any source other than the individual who is its subject, the Department must take appropriate measures to protect the security of that information.
The security measures required of the Department of Health include thoroughly investigating any potential or actual breaches of security concerning the information. Department personnel and other persons with authority to acquire, use, disclose, or store identifiable health information must report to the director, or the director's designee, any known security breaches or actions that may lead to security breaches.
Within fourteen days of a request to review identifiable health information, the Department of Health must give the requestor an opportunity during regular business hours to inspect copies of the information that concerns the requestor. Within ten days of a request for copies of the requestor's identifiable health information, the Department of Health must provide the copies without charge.
The Department of Health must correct, amend, or delete erroneous, incomplete, or false information within fourteen days of a request, provided it determines the modification is reasonably supported. The Department of Health may maintain a civil action against any person to enforce compliance with the Act.
When LexLint raises it
When your app profile says your app processes personal data or handles health records.
Back to the example · Lint your app
Page updated .