Section He-C 401.15 - Confidentiality(a) The department shall maintain the confidentiality of all information about applicants, qualifying patients, designated caregivers, certifying providers, and ATCs that is contained in the department's registry, as provided by RSA 126-X, He-C 400, and the Health Insurance Portability and Accountability Act (HIPAA) at 45 CFR 160, 162 and 164, as applicable.(b) Notwithstanding (a) above, information in (a) above shall be used and disclosed by the department to: (1) Authorized employees of the department in the course of their official duties;(2) An individual or entity pursuant to an order from a court of competent jurisdiction;(3) Law enforcement personnel in accordance with RSA 126-:4, I(b)(1)-(3)X, but such information shall be limited to: a. The location associated with a qualifying patient, designated caregiver, or ATC; andb. Whether a person is a qualifying patient or a designated caregiver;(4) Law enforcement personnel in accordance with RSA 126-:4, I(b)(5)X, regarding information related to falsified or fraudulent information submitted to the department where counsel has made a legal determination that there is probable cause to believe the information is false or falsified;(5) The NH board of medicine, the NH board of nursing, or the appropriate regulatory entity in Maine, Massachusetts, or Vermont, pursuant to RSA 126-:4, VII(c)X, and RSA 126-:2, VIIIX, but such information shall be related to the conveyance of concerns regarding provider conduct;(6) The health and human services oversight committee established under RSA 126-:13X, to the NH board of medicine, and the NH board of nursing in the department's annual data report required by RSA 126-:10X, except that only deidentified, aggregate data required by RSA 126-:10, IVX, shall be released;(7) To a qualifying patient, a qualifying patient's certifying provider, or a qualifying patient's designated caregiver for the purposes of carrying out these rules;(8) To an individual or entity pursuant to a release signed by the qualifying patient, designated caregiver, certifying provider, or authorized ATC agent; and(9) Individuals or entities for the purposes of public health, health care operations, or research if such release is consistent with all applicable HIPAA standards, pursuant to RSA 126-:10, VIX.(c) In order for information to be disclosed to law enforcement personnel in accordance with (b)(3) above, the following shall have occurred: (1) Local or state law enforcement personnel shall have detained or arrested an individual who claims to be engaged in the therapeutic use of cannabis;(2) A local or state law enforcement officer shall have submitted a sworn affidavit to the department affirming that they have probable cause to believe cannabis is possessed at a specific address; or(3) A local or state law enforcement officer shall have submitted a sworn affidavit to the department affirming that they have probable cause to believe a specific individual possesses cannabis, and has also provided the person's name and address or name and date of birth.(d) In accordance with RSA 126-:4, II-aX, the department shall maintain the confidentiality of all criminal history records information received.N.H. Admin. Code § He-C 401.15
Adopted byVolume XXXIV Number 33, Filed August 14,2014, Proposed by #10646, Effective 8/1/2015.Amended by Volume XXXV Number 45, Filed November 12, 2015, Proposed by #10964, Effective 11/2/2015, Expires 11/2/2025.Amended by Volume XLI Number 32, Filed August 12, 2021, Proposed by #13220, Effective 7/1/2021, Expires 7/1/2031.