A. "Authorized representative of an individual" or "authorized representative" means an individual's legal guardian; agent pursuant to Title 18‑C, section 5‑803; agent pursuant to Title 18‑C, Article 5, Part 9; or other authorized representative or, after death, that person's personal representative or a person identified in subsection 3‑B. For a minor who has not consented to health care treatment in accordance with the provisions of state law, "authorized representative" means the minor's parent, legal guardian or guardian ad litem.   [PL 2017, c. 402, Pt. C, §44 (AMD); PL 2019, c. 417, Pt. B, §14 (AFF).]

A-1. "Authorization to disclose" means authorization to disclose health care information in accordance with subsection 3, 3‑A or 3‑B.   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF).]

A-2. "Aiding and assisting legally protected health care activity" has the same meaning as in Title 14, section 9002, subsection 1.   [PL 2023, c. 648, Pt. F, §1 (NEW).]

B. "Disclosure" means the release, transfer of or provision of access to health care information in any manner obtained as a result of a professional health care relationship between the individual and the health care practitioner or facility to a person or entity other than the individual.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

B-1. "Gender-affirming health care services" has the same meaning as in Title 14, section 9002, subsection 4.   [PL 2023, c. 648, Pt. F, §2 (NEW).]

C. "Health care" means preventative, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, services, treatment, procedures or counseling, including appropriate assistance with disease or symptom management and maintenance, that affects an individual's physical, mental or behavioral condition, including individual cells or their components or genetic information, or the structure or function of the human body or any part of the human body. Health care includes prescribing, dispensing or furnishing to an individual drugs, biologicals, medical devices or health care equipment and supplies; providing hospice services to an individual; and the banking of blood, sperm, organs or any other tissue.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

D. "Health care facility" or "facility" means a facility, institution or entity licensed pursuant to this Title that offers health care to persons in this State, including a home health care provider, hospice program and a pharmacy licensed pursuant to Title 32. For the purposes of this section, "health care facility" does not include a state mental health institute, the Elizabeth Levinson Center, the Aroostook Residential Center or Freeport Towne Square.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

E. "Health care information" means information that directly identifies the individual and that relates to an individual's physical, mental or behavioral condition, personal or family medical history or medical treatment or the health care provided to that individual. "Health care information" does not include information that protects the anonymity of the individual by means of encryption or encoding of individual identifiers or information pertaining to or derived from federally sponsored, authorized or regulated research governed by 21 Code of Federal Regulations, Parts 50 and 56 and 45 Code of Federal Regulations, Part 46, to the extent that such information is used in a manner that protects the identification of individuals. The Board of Directors of the Maine Health Data Organization shall adopt rules to define health care information that directly identifies an individual. Rules adopted pursuant to this paragraph are routine technical rules as defined in Title 5, chapter 375, subchapter II‑A.  

F. "Health care practitioner" means a person licensed by this State to provide or otherwise lawfully providing health care or a partnership or corporation made up of those persons or an officer, employee, agent or contractor of that person acting in the course and scope of employment, agency or contract related to or supportive of the provision of health care to individuals.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

G. "Individual" means a natural person who is the subject of the health care information under consideration and, in the context of disclosure of health care information, includes the individual's authorized representative.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

G-1. "Legally protected health care activity" has the same meaning as in Title 14, section 9002, subsection 8.   [PL 2023, c. 648, Pt. F, §3 (NEW).]

G-2. "Reproductive health care services" has the same meaning as in Title 14, section 9002, subsection 9.   [PL 2023, c. 648, Pt. F, §4 (NEW).]

H. "Third party" or "3rd party" means a person other than the individual to whom the health care information relates.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

A. The name and signature of the individual and the date of signature. If the authorization is in electronic form, a unique identifier of the individual and the date the individual authenticated the electronic authorization must be stated in place of the individual's signature and date of signature;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

B. The types of persons authorized to disclose health care information and the nature of the health care information to be disclosed;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

C. The identity or description of the 3rd party to whom the information is to be disclosed;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

D. The specific purpose or purposes of the disclosure and whether any subsequent disclosures may be made pursuant to the same authorization. An authorization to disclose health care information related to substance use disorder treatment or care subject to the requirements of 42 United States Code, Section 290dd‑2 (Supplement 1998) is governed by the provisions of that law;   [PL 2017, c. 407, Pt. A, §72 (AMD).]

E. The duration of the authorization;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

F. A statement that the individual may refuse authorization to disclose all or some health care information but that refusal may result in improper diagnosis or treatment, denial of coverage or a claim for health benefits or other insurance or other adverse consequences;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

G. A statement that the authorization may be revoked at any time by the individual by executing a written revocation, subject to the right of any person who acted in reliance on the authorization prior to receiving notice of revocation, instructions on how to revoke an authorization and a statement that revocation may be the basis for denial of health benefits or other insurance coverage or benefits; and   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

H. A statement that the individual is entitled to a copy of the authorization form.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

A. The spouse of the individual;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

B. A parent of the individual;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

C. An adult who is a child, grandchild or sibling of the individual;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

D. An adult who is a sibling of the individual's parent or that sibling's spouse or a child of a sibling of the individual or a child of a sibling of the individual's spouse, related by blood or adoption;   [RR 2021, c. 2, Pt. B, §106 (COR).]

E. An adult related to the individual, by blood or adoption, who is familiar with the individual's personal values; and   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

F. An adult who has exhibited special concern for the individual and who is familiar with the individual's personal values.   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

A. To another health care practitioner or facility for diagnosis, treatment or care of individuals or to complete the responsibilities of a health care practitioner or facility that provided diagnosis, treatment or care of individuals, as provided in this paragraph.  

B. To an agent, employee, independent contractor or successor in interest of the health care practitioner or facility including a state-designated statewide health information exchange that makes health care information available electronically to health care practitioners and facilities or to a member of a quality assurance, utilization review or peer review team to the extent necessary to carry out the usual and customary activities relating to the delivery of health care and for the practitioner's or facility's lawful purposes in diagnosing, treating or caring for individuals, including billing and collection, risk management, quality assurance, utilization review and peer review. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales;   [PL 2011, c. 347, §7 (AMD).]

C. To a family or household member unless expressly prohibited by the individual or a person acting pursuant to subsection 3‑B;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

D. To appropriate persons when a health care practitioner or facility that is providing or has provided diagnosis, treatment or care to the individual in good faith believes that disclosure is made to avert a serious threat to health or safety and meets the conditions, as applicable, described in 45 Code of Federal Regulations, Section 164.512(j) (2012). A disclosure pursuant to this paragraph must protect the confidentiality of the health care information consistent with sound professional judgment;   [PL 2013, c. 289, §1 (AMD).]

E. To federal, state or local governmental entities in order to protect the public health and welfare when reporting is required or authorized by law, to report a suspected crime against the health care practitioner or facility or to report information that the health care facility's officials or health care practitioner in good faith believes constitutes evidence of criminal conduct that occurred on the premises of the health care facility or health care practitioner;   [PL 2011, c. 572, §1 (AMD).]

E-1. To federal, state or local governmental entities if the health care practitioner or facility that is providing diagnosis, treatment or care to an individual has determined in the exercise of sound professional judgment that the following requirements, as applicable, are satisfied:  

E-2. To federal, state or local governmental entities if the health care practitioner or facility that is providing diagnosis, treatment or care to an individual has determined in the exercise of sound professional judgment that the disclosure is required by section 1727;   [RR 2015, c. 1, §17 (COR).]

F.   [PL 1999, c. 512, Pt. A, §5 (RP); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

F-1. As directed by order of a court or as authorized or required by statute;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

F-2. To a governmental entity pursuant to a lawful subpoena requesting health care information to which the governmental entity is entitled according to statute or rules of court;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

F-3. (TEXT EFFECTIVE ON CONTINGENCY: See PL 2013, c. 528, §12) To the Maine Health Data Organization as required by and for use in accordance with chapter 1683. Health care information, including protected health information, as defined in 45 Code of Federal Regulations, Section 160.103 (2013), submitted to the Maine Health Data Organization must be protected by means of encryption;   [PL 2013, c. 528, §1 (NEW); PL 2013, c. 528, §12 (AFF).]

G. To a person when necessary to conduct scientific research approved by an institutional review board or by the board of a nonprofit health research organization or when necessary for a clinical trial sponsored, authorized or regulated by the federal Food and Drug Administration. A person conducting research or a clinical trial may not identify any individual patient in any report arising from the research or clinical trial. For the purposes of this paragraph, "institutional review board" means any board, committee or other group formally designated by a health care facility and authorized under federal law to review, approve or conduct periodic review of research programs. Health care information disclosed pursuant to this paragraph that identifies an individual must be returned to the health care practitioner or facility from which it was obtained or must be destroyed when it is no longer required for the research or clinical trial. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

H. To a person engaged in the assessment, evaluation or investigation of the provision of or payment for health care or the practices of a health care practitioner or facility or to an agent, employee or contractor of such a person, pursuant to statutory or professional standards or requirements. Disclosure for a purpose listed in this paragraph is not a disclosure for the purpose of marketing or sales;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

I. To a person engaged in the regulation, accreditation, licensure or certification of a health care practitioner or facility or to an agent, employee or contractor of such a person, pursuant to standards or requirements for regulation, accreditation, licensure or certification;   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

J. To a person engaged in the review of the provision of health care by a health care practitioner or facility or payment for such health care under Title 24, 24‑A or 39‑A or under a public program for the payment of health care or professional liability insurance for a health care practitioner or facility or to an agent, employee or contractor of such a person;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

K. To attorneys for the health care practitioner or facility that is disclosing the health care information or to a person as required in the context of legal proceedings or in disclosure to a court or governmental entity, as determined by the practitioner or facility to be required for the practitioner's or facility's own legal representation;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

L. To a person outside the office of the health care practitioner or facility engaged in payment activities, including but not limited to submission to payors for the purposes of billing, payment, claims management, medical data processing, determination of coverage or adjudication of health benefit or subrogation claims, review of health care services with respect to coverage or justification of charges or other administrative services. Payment activities also include but are not limited to:  

M. To schools, educational institutions, youth camps licensed under section 2495, correctional facilities, health care practitioners and facilities, providers of emergency services or a branch of federal or state military forces, information regarding immunization of an individual;   [PL 2009, c. 211, Pt. B, §17 (AMD).]

N. To a person when disclosure is needed to set or confirm the date and time of an appointment or test or to make arrangements for the individual to receive those services;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

O. To a person when disclosure is needed to obtain or convey information about prescription medication or supplies or to provide medication or supplies under a prescription;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

P. To a person representing emergency services, health care and relief agencies, corrections facilities or a branch of federal or state military forces, of brief confirmation of general health status;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

Q. To a member of the clergy, of information about the presence of an individual in a health care facility, including the person's room number, place of residence and religious affiliation unless expressly prohibited by the individual or a person acting pursuant to subsection 3‑B;   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

R. To a member of the media who asks a health care facility about an individual by name, of brief confirmation of general health status unless expressly prohibited by the individual or a person acting pursuant to subsection 3‑B;   [PL 2015, c. 370, §4 (AMD).]

S. To a member of the public who asks a health care facility about an individual by name, of the room number of the individual and brief confirmation of general health status unless expressly prohibited by the individual or a person acting pursuant to subsection 3‑B;   [PL 2017, c. 203, §2 (AMD).]

T. To a lay caregiver designated by an individual pursuant to section 1711‑G;   [PL 2021, c. 398, Pt. MMMM, §3 (AMD).]

U. To a panel coordinator of the maternal, fetal and infant mortality review panel pursuant to section 261, subsection 4, paragraph B‑1 for the purposes of reviewing health care information of a deceased person and a mother of a child who died within one year of birth, including fetal deaths after 28 weeks of gestation. For purposes of this paragraph, "panel coordinator" has the same meaning as in section 261, subsection 1, paragraph E and "deceased person" has the same meaning as in section 261, subsection 1, paragraph B; and   [PL 2021, c. 398, Pt. MMMM, §4 (AMD).]

V. To a panel coordinator of the Aging and Disability Mortality Review Panel pursuant to section 264, subsection 5, paragraph B, subparagraph (4) for the purposes of reviewing health care information of an adult receiving services who is deceased, in accordance with section 264, subsection 5, paragraph A. For purposes of this paragraph, "panel coordinator" has the same meaning as in section 264, subsection 2, paragraph B.   [PL 2021, c. 398, Pt. MMMM, §5 (NEW).]

A. A health care practitioner, facility or state-designated statewide health information exchange may not disclose health care information for the purpose of marketing or sales without written or oral authorization for the disclosure.   [PL 2023, c. 648, Pt. F, §5 (NEW).]

B. Notwithstanding any provision of this section to the contrary and except as provided in paragraph C, a health care practitioner, facility or state-designated statewide health information exchange may not disclose any of the following in a civil or administrative action or proceeding or in response to a subpoena issued in a civil or administrative action or proceeding unless authorized in writing by the individual or the individual's authorized representative or pursuant to a court order issued by a court of competent jurisdiction in this State upon a showing of good cause, as long as the court order limits the use and disclosure of records and includes sanctions for misuse of records or sets forth other methods to ensure confidentiality:  

C. Paragraph B does not apply if:  

D. This subsection may not be construed to impede the lawful disclosure of information to another health care practitioner or facility for diagnosis, treatment or care of individuals or to complete the responsibilities of a health care practitioner or facility that provides diagnosis, treatment or care of individuals or to impede the lawful disclosure of information to an insurer or payor related to the treatment provided by a health care practitioner or facility or to the payment or operations of a health care practitioner or facility.   [PL 2023, c. 648, Pt. F, §5 (NEW).]

A. The health care practitioner or facility provided a copy of the original health care record to the 3rd party on or after February 1, 2000;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

B. The correction or clarification was submitted by the individual pursuant to section 1711 or 1711‑B and relates to diagnosis, treatment or care;   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

C. The individual requests that a copy be sent to the 3rd party and provides an authorization that meets the requirements of subsection 3, 3‑A or 3‑B; and   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

D. If requested by the health care practitioner or facility, the individual pays to the health care practitioner or facility all reasonable costs requested by that practitioner or facility.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

A. A health care practitioner or facility that discloses health care information pursuant to subsection 3, 3‑A or 3‑B may not disclose information in excess of the information requested in the authorization.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

B. A health care practitioner or facility that discloses health care information pursuant to subsections 3, 3‑A, 3‑B or 6 may not disclose information in excess of the information reasonably required for the purpose for which it is disclosed.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

C. If a health care practitioner or facility believes that release of health care information to the individual would be detrimental to the health of the individual, the health care practitioner or facility shall advise the individual and make copies of the records available to the individual's authorized representative upon receipt of a written authorization.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

D. If a health care practitioner or facility discloses partial or incomplete health care information, as compared to the request or directive to disclose under subsection 3, 3‑A, 3‑B or 6, the disclosure must expressly indicate that the information disclosed is partial or incomplete.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

A. When the Attorney General has reason to believe that a person has intentionally violated a provision of this section, the Attorney General may bring an action to enjoin unlawful disclosure of health care information.   [PL 1997, c. 793, Pt. A, §8 (NEW); PL 1997, c. 793, Pt. A, §10 (AFF).]

B. An individual who is aggrieved by conduct in violation of this section may bring a civil action against a person who has intentionally unlawfully disclosed health care information in the Superior Court in the county in which the individual resides or the disclosure occurred. The action may seek to enjoin unlawful disclosure and may seek costs and a forfeiture or penalty under paragraph C. An applicant for injunctive relief under this paragraph may not be required to give security as a condition of the issuance of the injunction.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

C. A person who intentionally violates this section is subject to a civil penalty not to exceed $5,000, payable to the State, plus costs. If a court finds that intentional violations of this section have occurred after due notice of the violating conduct with sufficient frequency to constitute a general business practice, the person is subject to a civil penalty not to exceed $10,000 for health care practitioners and $50,000 for health care facilities, payable to the State. A civil penalty under this subsection is recoverable in a civil action.   [PL 1999, c. 512, Pt. A, §5 (AMD); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

D. Nothing in this section may be construed to prohibit a person aggrieved by conduct in violation of this section from pursuing all available common law remedies, including but not limited to an action based on negligence.   [PL 1999, c. 512, Pt. A, §5 (NEW); PL 1999, c. 512, Pt. A, §7 (AFF); PL 1999, c. 790, Pt. A, §§58, 60 (AFF).]

A. A health care practitioner may not deny a patient health care treatment and a health insurer may not deny a patient a health insurance benefit based solely on the provider's or patient's decision not to participate in a state-designated statewide health information exchange. Except when otherwise required by federal law, a payor of health care benefits may not require participation in a state-designated statewide health information exchange as a condition of participating in the payor's provider network.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

B. Recovery for professional negligence is not allowed against any health care practitioner or health care facility on the grounds of a health care practitioner's or a health care facility's nonparticipation in a state-designated statewide health information exchange arising out of or in connection with the provision of or failure to provide health care services. In any civil action for professional negligence or in any proceeding related to such a civil action or in any arbitration, proof of a health care practitioner's, a health care facility's or a patient's participation or nonparticipation in a state-designated statewide health information exchange is inadmissible as evidence of liability or nonliability arising out of or in connection with the provision of or failure to provide health care services. This paragraph does not prohibit recovery or the admission of evidence of reliance on information in a state-designated statewide electronic health information exchange when there was participation by both the patient and the patient's health care practitioner.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

C. A state-designated statewide health information exchange to which health care information is disclosed under this section shall provide an individual protection mechanism by which an individual may opt out from participation to prohibit the state-designated statewide health information exchange from disclosing the individual's health care information to a health care practitioner or health care facility.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

D. At point of initial contact, a health care practitioner, health care facility or other entity participating in a state-designated statewide health information exchange shall provide to each patient, on a separate form, at minimum:  

E. A health care practitioner, health care facility or other entity participating in a state-designated statewide health information exchange shall communicate to the exchange the decision of each patient who has declined participation and shall do so within a reasonable time frame, but not more than 2 business days following the receipt of a signed form, as described in paragraph D, from the patient, or shall establish a mechanism by which the patient may decline participation in the state-designated statewide health information exchange at no cost to the patient.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

F. A state-designated statewide health information exchange shall process the request of a patient who has decided not to participate in the state-designated statewide health information exchange within 2 business days of receiving the patient's decision to decline, unless additional time is needed to verify the identity of the patient. A signed authorization from the patient is required before a patient is newly entered or reentered into the system if the patient chooses to begin participation at a later date.  

G. A state-designated statewide health information exchange shall establish a secure website accessible to patients. This website must:  

H. A state-designated statewide health information exchange shall establish for patients an alternate procedure to that provided for in paragraph F that does not require Internet access. A health care practitioner, health care facility or other entity participating in the state-designated statewide health information exchange shall provide information about this alternate procedure to all patients. The information must be included on the form identified in paragraph D.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

I. A state-designated statewide health information exchange shall maintain records regarding all disclosures of health care information by and through the state-designated statewide health information exchange, including the requesting party and the dates and times of the requests and disclosures.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

J. A state-designated statewide health information exchange may not charge a patient or an authorized representative of a patient any fee for access or communication as provided in this subsection.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

K. Notwithstanding any provision of this subsection to the contrary, a health care practitioner, health care facility or other entity shall provide the form and communication required by paragraphs D and F to all existing patients following the effective date of this subsection.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

L. A state-designated statewide health information exchange shall meet or exceed all applicable federal laws and regulations pertaining to privacy, security and breach notification regarding personally identifiable protected health information, as defined in 45 Code of Federal Regulations, Part 160. If a breach occurs, the state-designated statewide health information exchange shall arrange with its participants for notification of each individual whose protected health information has been, or is reasonably believed by the exchange to have been, breached. For purposes of this paragraph, "breach" has the same meaning as in 45 Code of Federal Regulations, Part 164, as amended.   [PL 2011, c. 691, Pt. A, §20 (RPR).]

M. The state-designated statewide health information exchange shall develop a quality management plan, including auditing mechanisms, in consultation with the office of the state coordinator for health information technology within the department, who shall review the plan and results.   [PL 2011, c. 691, Pt. A, §20 (RPR).]