Maintenance and Release of Patient Health Care Information Rules: disclosure only with authorization, listed exceptions, safeguards and retention

Under section 140-10.6-101 of the NMI Administrative Code, the Department of Public Health, or an agent or employee of the Department, may not disclose health care information about a patient to any other person without the patient's written authorization, except as the rules on compulsory process and disclosure without authorization allow.

The Department must chart all disclosures of health care information, except to third party payors, and the chartings become part of the health care information. The Department may not disclose medical records for mental health treatment to any person other than the patient without proof that the requester obtained the patient's written consent, or a court order issued after the court afforded the patient the opportunity to object to the release.

The restrictions on the release of mental health records do not apply to the patient's attorney. For records pertaining to alcohol and substance abuse treatment, care or counseling, the person requesting the records must comply with the federal requirements for confidentiality of patient records.

For records pertaining to HIV testing and diagnosis of AIDS, disclosure may not be made without either the patient's written consent or a court order, except to Department of Public Health employees on an as needed basis.

To be valid, a disclosure authorization to the Department must be in writing, dated and signed by the patient or the patient's legally authorized representative, and must identify the nature of the information, the name, address and institutional affiliation of the recipient, and the patient.

Except for authorizations given under an agreement with a treatment or monitoring program or to provide information to third party payors, an authorization may not permit the release of health care information relating to future health care that the patient receives more than six months after the authorization was signed.

A patient may revoke a disclosure authorization in writing at any time unless disclosure is required to effectuate payments for health care that has been provided, or other substantial action has been taken in reliance on the authorization.

Before service of a discovery request or compulsory process demand on the Department for health care information, an attorney must provide advance written notice to the patient or the patient's attorney stating what information is sought and that the patient may obtain a protective order to prevent the Department from complying.

The date by which the Department must comply with the discovery request or compulsory process demand must allow the patient adequate time to seek a protective order, and in no event be less than fourteen days from the date of service or delivery. The Department may disclose health care information about a patient without the patient's authorization to the extent that a recipient needs to know the information, in the cases the section lists.

The Department must adopt and implement reasonable safeguards for the security of all health care information it maintains. The Department must retain medical records for a minimum of seven years after the date of the last entry on the record, and for a minor for a minimum of seven years after the child reaches 18 years of age unless there are later entries, and must retain X-ray films for a minimum of five years.

Public Law 16-51 established the Commonwealth Healthcare Corporation, which assumed the duties of the Department of Public Health as of January 15, 2011.