Sec.54-124a-16. Disclosure of personal data

(a) Not later than four business days after receipt of a written request therefor, the Board shall mail, electronically transmit, or deliver to the requesting individual a written response in plain language, informing him or her as to whether or not the Board maintains personal data on that individual, the category and location of the personal data maintained on that individual, and procedures available to review the records.

(b) Except where nondisclosure is required or specifically permitted by law, the Board shall disclose to any individual upon written request all personal data concerning that individual which is maintained by the Board. The procedures for disclosure shall be in accordance with the Freedom of Information Act. If the personal data is maintained in coded form, the Board shall transcribe the data into a commonly understandable form before disclosure.

(c) The Board is responsible for verifying the identity of any individual requesting access to his or her own personal data.

(d) The Board is responsible for ensuring that disclosure made pursuant to the Personal Data Act is conducted so as not to disclose any personal data concerning individuals other than the individual requesting the information.

(e) The Board may refuse to disclose to an individual medical, psychiatric or psychological data on that individual if the Board determines that such disclosure would be detrimental to that individual.

(f) In any case where the Board refuses disclosure, it shall advise that individual of his or her right to seek judicial relief pursuant to the Personal Data Act.

(g) If the Board refuses to disclose medical, psychiatric or psychological data to an individual based on its determination that disclosure would be detrimental to that individual and nondisclosure is not mandated by law, the Board shall, at the written request of such individual, permit a qualified medical doctor to review the personal data contained in the individual’s records to determine if the personal data should be disclosed. If disclosure is recommended by the individual’s medical doctor, the Board shall disclose the personal data to such individual; if nondisclosure is recommended by such individual’s medical doctor, the Board shall not disclose the personal data and shall inform such individual of the judicial relief provided under the Personal Data Act.

(h) The Board shall maintain a complete log of each individual, agency, or organization who has obtained access to, or to whom disclosure has been made of personal data, under the Personal Data Act, together with the reason for each such disclosure or access. This log shall be maintained for not less than five years from the date of such disclosure or access or for the life of the personal data record, whichever is longer.

(Effective March 9, 2021)