Law / United States / 
Montana
Uniform Health Care Information Act: disclosure for research projects and audits
Mont. Code Ann. § 50-16-529(6), (7)
In force.
A de-identification rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Audit expectation
- none
What it requires
- If you are a health care provider not subject to the Health Insurance Portability and Accountability Act (HIPAA) privacy provisions and you disclose health care information without the patient's authorization for use in a research project, disclose it only for a project that an institutional review board has determined contains reasonable safeguards to protect against directly or indirectly identifying any patient in any report of the project, and procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention for another research project (section 50-16-529(6)(d) and (e)).
- If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information to a person who obtains it for an audit, disclose it only to a person who agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified, and not to disclose the information further except to accomplish the audit or to report unlawful or improper conduct involving fraud in payment for health care or other unlawful conduct by a health care provider (section 50-16-529(7)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The attorney general or the appropriate county attorney, who may maintain a civil action to enforce the part.
What it reaches
Obligation class
Disclosure, Prohibition
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- a health care provider that is not subject to the privacy provisions of the Health Insurance Portability and Accountability Act of 1996
What record it asks for
Logging duty
Section 50-16-529(6) and (7) state no log or record duty of their own. The record of persons who received or examined health care information is described on the row for sections 50-16-501 to 50-16-553.
- Kind
- None
- As of
What this law does
A health care provider is a person who is licensed, certified, or otherwise authorized by the laws of Montana to provide health care in the ordinary course of business or practice of a profession. A person includes an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or other legal or commercial entity.
A health care provider may disclose health care information about a patient without the patient's authorization, to the extent a recipient needs to know the information, for use in a research project that an institutional review board has determined contains reasonable safeguards to protect against directly or indirectly identifying any patient in any report of the research project.
The research project must also contain procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project.
A health care provider may also disclose the information to a person who obtains it for purposes of an audit if that person agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified, and not to disclose the information further except to accomplish the audit or to report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient or other unlawful conduct by a health care provider.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .