The Department may use or disclose PHI to the extent that such use or disclosure is required by law and the use or disclosure complies with, and is limited to, the relevant requirements of such law.   In such situations, the opportunity for the individual to agree or object is not required

The Commissioner or designee shall report this information accordingly.

Examples of the above situations include, but are not limited to, the following:

·           a public health authority that is authorized by law to receive such information for the purpose of preventing or controlling disease, injury or disability, including but not limited to, the reporting of disease, injury, vital events such as birth or death and the conduct of public health surveillance, public health investigations and public health interventions

·           a public or government entity authorized by law to receive reports of child abuse/neglect or domestic violence

·           a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation

·           a government authority, including social service agencies authorized to receive such reports

·           a health oversight agency for oversight activities such as audits, civil, administrative or criminal investigations or proceedings and inspections or licensure actions

·           a law enforcement official’s request

•  for the purpose of identifying or locating a suspect, fugitive,
  material witness or missing person

• bout an individual who is a victim of a crime, who is deceased as a result of a crime or if a crime has occurred in Department’s premises, or

•  for the purpose of identifying a deceased person and/or investigating the cause of death.

Generally, an individual’s authorization is required to allow the Department the use of his/her PHI for research purposes.

The Department may further use or disclose PHI collected for research purposes, regardless of the source of funding of the research, provided that the Department has obtained approval for an alteration or waiver, in whole or in part, of the individual’s initial authorization by the Department’s Institutional Review Board (IRB).

The Department shall obtain from the researcher representations (pertaining to living and deceased individuals) that

·          use or disclosure is sought solely to review PHI as necessary to prepare a research protocol or for similar purposes

·           the researcher shall not remove any PHI from the Department records in the course of the review, and

·           the PHI for which use or access is sought is necessary for the research purposes.

The Department may use or disclose PHI by utilizing a limited data set which excludes direct identifiers when referring to the individual or interested parties.

The Department shall, for purposes of research projects

·          de-identify, or remove information which helps to identify protected health information (PHI)

·           provide the minimum necessary information, and

·           verify the identity of a person requesting PHI and his/her authority to access the PHI.

The Department may use and disclose PHI of individuals for the purpose of specialized government functions which include, but are not limited to, communications with the following:

·           Armed Forces personnel as it pertains to national and foreign
 military actions

·           correctional institutions’ staff or law enforcement officials, and

·           administrators of government health plans that provide public
 benefits.