36-664

36-664. Confidentiality; exceptions

A. A person who obtains communicable disease related information in the course of
providing a health service or obtains that information from a health care provider
pursuant to an authorization shall not disclose or be compelled to disclose that
information except to the following:

1. The protected person or, if the protected person lacks capacity to consent, the
protected person's health care decision maker.

2. The department or a local health department for purposes of notifying a good
Samaritan pursuant to subsection E of this section.

3. An agent or employee of a health facility or health care provider to provide
health services to the protected person or the protected person's child or for billing or
reimbursement for health services.

4. A health facility or health care provider, in relation to the procurement,
processing, distributing or use of a human body or a human body part, including organs,
tissues, eyes, bones, arteries, blood, semen, milk or other body fluids, for use in
medical education, research or therapy or for transplantation to another person.

5. A health facility or health care provider, or an organization, committee or
individual designated by the health facility or health care provider, that is engaged in
the review of professional practices, including the review of the quality, utilization or
necessity of medical care, or an accreditation or oversight review organization
responsible for the review of professional practices at a health facility or by a health
care provider.

6. A private entity that accredits the health facility or health care provider and
with whom the health facility or health care provider has an agreement requiring the
agency to protect the confidentiality of patient information.

7. A federal, state, county or local health officer if disclosure is mandated by
federal or state law.

8. A federal, state or local government agency authorized by law to receive the
information. The agency is authorized to redisclose the information only pursuant to this
article or as otherwise permitted by law.

9. An authorized employee or agent of a federal, state or local government agency
that supervises or monitors the health care provider or health facility or administers
the program under which the health service is provided. An authorized employee or agent
includes only an employee or agent who, in the ordinary course of business of the
government agency, has access to records relating to the care or treatment of the
protected person.

10. A person, health care provider or health facility to which disclosure is ordered
by a court or administrative body pursuant to section 36-665.

11. The industrial commission or parties to an industrial commission claim pursuant
to section 23-908, subsection D and section 23-1043.02.

12. Insurance entities pursuant to section 20-448.01 and third party payors or the
payors' contractors.

13. Any person or entity as authorized by the patient or the patient's health care
decision maker.

14. A person or entity as required by federal law.

15. The legal representative of the entity holding the information in order to
secure legal advice.

16. A person or entity for research only if the research is conducted pursuant to
applicable federal or state laws and regulations governing research.

B. At the request of the department of economic security in conjunction with the
placement of children in foster care or for adoption or court-ordered placement, a health
care provider shall disclose communicable disease information, including HIV-related
information, to the department of economic security.

C. A state, county or local health department or officer may disclose communicable
disease related information if the disclosure is any of the following:

1. Specifically authorized or required by federal or state law.

2. Made pursuant to an authorization signed by the protected person or the
protected person's health care decision maker.

3. Made to a contact of the protected person. The disclosure shall be made without
identifying the protected person.

4. For the purposes of research as authorized by state and federal law.

D. The director may authorize the release of information that identifies the
protected person to the national center for health statistics of the United States public
health service for the purposes of conducting a search of the national death index.

E. The department or a local health department shall disclose communicable disease
related information to a good Samaritan who submits a request to the department or the
local health department. The request shall document the occurrence of the accident, fire
or other life-threatening emergency and shall include information regarding the nature of
the significant exposure risk. The department shall adopt rules that prescribe standards
of significant exposure risk based on the best available medical evidence. The department
shall adopt rules that establish procedures for processing requests from good Samaritans
pursuant to this subsection. The rules shall provide that the disclosure to the good
Samaritan shall not reveal the protected person's name and shall be accompanied by a
written statement that warns the good Samaritan that the confidentiality of the
information is protected by state law.

F. An authorization to release communicable disease related information shall be
signed by the protected person or, if the protected person lacks capacity to consent, the
protected person's health care decision maker. An authorization shall be dated and shall
specify to whom disclosure is authorized, the purpose for disclosure and the time period
during which the release is effective. A general authorization for the release of
medical or other information, including communicable disease related information, is not
an authorization for the release of HIV-related information unless the authorization
specifically indicates its purpose as an authorization for the release of confidential
HIV-related information and complies with the requirements of this section.

G. A person to whom communicable disease related information is disclosed pursuant
to this section shall not disclose the information to another person except as authorized
by this section. This subsection does not apply to the protected person or a protected
person's health care decision maker.

H. If a disclosure of communicable disease related information is made pursuant to
an authorization under subsection F of this section, the disclosure shall be accompanied
by a statement in writing that warns that the information is from confidential records
protected by state law and that prohibits further disclosure of the information without
the specific written authorization of the person to whom it pertains or as otherwise
permitted by law.

I. This section does not prohibit the listing of communicable disease related
information, including acquired immune deficiency syndrome, HIV-related illness or HIV
infection, in a certificate of death, autopsy report or other related document that is
prepared pursuant to law to document the cause of death or that is prepared to release a
body to a funeral director. This section does not modify a law or rule relating to access
to death certificates, autopsy reports or other related documents.

J. If a person in possession of HIV-related information reasonably believes that an
identifiable third party is at risk of HIV infection, that person may report that risk to
the department. The report shall be in writing and include the name and address of the
identifiable third party and the name and address of the person making the report. The
department shall contact the person at risk pursuant to rules adopted by the department.
The department employee making the initial contact shall have expertise in counseling
persons who have been exposed to or tested positive for HIV or acquired immune deficiency
syndrome.

K. Except as otherwise provided pursuant to this article or subject to an order or
search warrant issued pursuant to section 36-665, a person who receives HIV-related
information in the course of providing a health service or pursuant to a release of
HIV-related information shall not disclose that information to another person or legal
entity or be compelled by subpoena, order, search warrant or other judicial process to
disclose that information to another person or legal entity.

L. This section and sections 36-663, 36-666, 36-667 and 36-668 do not apply to
persons or entities subject to regulation under title 20.