Law / United States / 
Connecticut
Sale and marketing disclosure of individually identifiable medical record information prohibited
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
As of .
What it requires
- Do not sell or offer for sale individually identifiable medical record information, whether you are an insurance institution, agent, insurance support organization, health care professional, medical care center, pharmacy, pharmaceutical company, school or university, or a person's agent, contractor or employee (section 38a-988a(a)).
- Do not disclose individually identifiable medical record information for marketing purposes without the prior written consent of the individual or, for a minor, of the minor's parent or guardian. The section does not bar a disclosure permitted by section 38a-988 or other law, a transfer by a health care provider for research, utilization review, quality review, billing or direct patient care functions on the terms stated, or a transfer as part of a consummated sale or merger (section 38a-988a(a)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Statutory damages
Section 38a-988a(b): a person who violates the section is liable to the individual harmed for double damages, costs and reasonable attorneys' fees. An action must be brought within two years of the violation's first occurrence or discovery, and no more than five years after the violation.
- As of
Who enforces it
Enforcement body
Any individual harmed by a violation, who may sue for equitable relief, damages or both (section 38a-988a(b)).
Settledness
- As of
What this law does
Under section 38a-988a, no person, including an insurance institution, agent, insurance support organization, health care professional, medical care center, pharmacy, pharmaceutical company, school or university, or any person's agent, contractor or employee, may sell or offer for sale individually identifiable medical record information.
Under section 38a-988a, no person may disclose individually identifiable medical record information for purposes of marketing without the prior written consent of the individual or, for a minor, of the minor's parent or guardian. Under section 38a-988a, an individual harmed by a violation may bring an action for equitable relief, damages or both. A person who violates section 38a-988a is liable to the individual harmed for double damages, costs and reasonable attorneys' fees.
Section 38a-993(b)(2) lets the commissioner, after a hearing under section 38a-990 finds an intentional violation of section 38a-988a, order a penalty of not more than $20,000 for each violation, up to $100,000 in the aggregate. Section 38a-988a took effect on .
When LexLint raises it
When your app profile says your app handles health records or is an insurer.