Law / United States / 
Vermont
Health care privacy: protected health information related to legally protected health care activity
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a covered entity or business associate under the federal health privacy regulations, do not disclose protected health information that is identifiable or susceptible to reidentification and is related to a legally protected health care activity to a government entity other than the State of Vermont or its political subdivisions or instrumentalities if you have reason to believe it will be used to investigate, impose liability or professional discipline on, or identify any individual for the mere act of seeking, obtaining, providing or facilitating that activity, or for use in a civil or criminal action, a proceeding preliminary to one, or a probate, legislative or administrative proceeding.
- You may make such a disclosure only where the patient or the patient's conservator, guardian or other authorized legal representative authorizes it, a Vermont or federal court of competent jurisdiction orders it (a State court order must include the court's determination that the information will not be used to impose liability or discipline solely because a person sought, obtained, provided or facilitated a legally protected health care activity), it goes to your designated business associate solely for your defense against a claim, it goes to Vermont's Board of Medical Practice or Office of Professional Regulation for a bona fide investigation of a provider or unauthorized practice, it goes to the Department of Health or the Department of Disabilities, Aging, and Independent Living for a bona fide investigation of a licensed facility, or it is required in the ordinary course of business of Vermont's Medicaid program, subject to 12 V.S.A. section 7306.
These lines are LexLint's reading of the law's text, as of .
What this law does
Except as subdivision (2) provides, a covered entity or business associate may not disclose identifiable protected health information related to a legally protected health care activity to a government entity other than the State of Vermont or its political subdivisions or instrumentalities if it has reason to believe the information will be used to investigate any individual for the mere act of seeking, obtaining, providing or facilitating that activity.
Identifiable protected health information related to a legally protected health care activity may not be disclosed for use in a civil or criminal action, a proceeding preliminary to a civil or criminal action, or a probate, legislative or administrative proceeding, except as subdivision (2) provides.
A covered entity or business associate may disclose identifiable protected health information related to a legally protected health care activity where the patient or the patient's conservator, guardian or other authorized legal representative authorizes it, or where another condition in subdivision (2) is met.
A covered entity or business associate is not subject to any civil, criminal or administrative liability or professional disciplinary action for refusing to disclose such information in accordance with subsection (c). Section 6 of Act 20 of 2025 amended section 1881, including subsection (c). Act 20 of 2025 took effect on passage and was signed . Section 1881 was amended by Act 15 of 2023, effective , and by Act 20 of 2025, effective .
When LexLint raises it
When your app profile says your app handles health records.