Sec.19a-25-3. Disclosure of identifiable health data

(a) The department shall not disclose identifiable health data unless:

(1) The disclosure is to health care providers in a medical emergency as necessary to protect the health, life, or well-being of the person with a reportable disease or condition pursuant to section 19a-215 of the Connecticut General Statutes;

(2) The disclosure is to health care providers, the local director of health, the department, another state or public health agency, including those in other states and the federal government, or other persons when deemed necessary by the department in its sole discretion for disease prevention and control pursuant to section 19a-215 of the Connecticut General Statutes or for the purpose of reducing morbidity and mortality from any cause or condition, except that every effort shall be made to limit the disclosure of identifiable health data to the minimal amount necessary to accomplish the public health purpose;

(3) The disclosure is to an individual, organization, governmental entity in this or another state or to the federal government, provided the department determines that:

(A) Based upon a written application and such other information as required by the department to be submitted by the requesting individual, organization or governmental entity the data will be used solely for bona fide medical and scientific research;

(B) The disclosure of data to the requesting individual, organization or governmental entity is required for the medical or scientific research proposed;

(C) The requesting individual, organization, or governmental entity has entered into a written agreement satisfactory to the department agreeing to protect such data in accordance with the requirements of this section and not permit disclosure without prior approval of the department; and

(D) The requesting individual, organization or governmental entity, upon request of the department or after a specified date or event, returns or destroys all identifiable health data provided by the department and copies thereof in any form.

(4) The disclosure is to a governmental entity for the purpose of conducting an audit, evaluation, or investigation required by law of the department and such governmental entity agrees not to use such data for making any determination as to whom the health data relates.

(b) Any disclosure provided for in this section shall be made at the discretion of the department, provided the requirements for disclosure set forth in the applicable provisions of this section have been met. For disclosures under this section to governmental entities, the commissioner may waive the requirements of this section except for the requirements of subdivision (A) of subsection (3).

(c) Notwithstanding any other provisions of this section, no identifiable health data obtained in the course of activities undertaken or supported under this section shall be subject to subpoena or similar compulsory process in any civil or criminal, judicial, administrative, or legislative proceeding, nor shall any individual or organization with lawful access to identifiable health data under the provisions of this section be compelled to testify with regard to such health data.

(Adopted effective October 30, 1998)