2013 North Dakota Century Code Title 23 Health and Safety Chapter 23-01.3 Health Information Protection
Download as PDF
CHAPTER 23-01.3
HEALTH INFORMATION PROTECTION
23-01.3-01. Definitions.
As used in this chapter:
1. "Confidential information" includes any confidential record as defined in subsection 3
of section 44-04-17.1, any protected health information, and any other information
declared confidential by law.
2. "Disclose" means to disclose, transfer, permit access to, or otherwise divulge
protected health information to any person other than the individual who is the subject
of that information and includes the initial disclosure and any subsequent redisclosures
of individually identifiable health care information.
3. "Institutional review board" means any board, committee, or other group formally
designated by an institution or public health authority or authorized under federal or
state law to review, approve the initiation of, or conduct a periodic review of research
programs to assure the protection of the rights and welfare of human research
subjects.
4. "Law enforcement inquiry" means any executive branch investigation or official
proceeding inquiring into a violation of, or failure to comply with, any criminal or civil
statute or any regulation, rule, or order issued pursuant to such a statute.
5. "Nonidentifiable health information" means any information that would otherwise be
protected health information except that it does not reveal the identity of the individual
whose health or health care is the subject of the information and there is no
reasonable basis to believe that the information could be used to identify that
individual.
6. "Person" means a government, governmental subdivision of an executive branch
agency or authority, corporation, company, association, firm, partnership, society,
estate, trust, joint venture, individual, individual representative, tribal government, and
any other legal entity.
7. "Protected health information" means any information, including genetic information,
demographic information, and fluid or tissue samples collected from an individual,
diagnostic and test results, whether oral or recorded in any form or medium, which:
a. Is created or received by a health care provider, health researcher, health plan,
health oversight authority, public health authority, employer, health or life insurer,
school or university; and
b. (1) Relates to the past, present, or future physical or mental health or condition
of an individual, including individual cells and their components; the
provision of health care to an individual; or the past, present, or future
payment for the provision of health care to an individual; and
(2) (a) Identifies an individual; or
(b) With respect to which there is a reasonable basis to believe that the
information can be used to identify an individual.
8. "Public health authority" means the state department of health, a local public health
unit, and any authority or instrumentality of the United States, a tribal government, a
state, or a political subdivision of a state, a foreign nation, or a political subdivision of a
foreign nation, which is:
a. Primarily responsible for public health matters; and
b. Primarily engaged in activities such as injury reporting, public health surveillance,
and public health investigation or intervention.
9. "School or university" means an institution or place for instruction or education,
including an elementary school, secondary school, or institution of higher learning, a
college, or an assemblage of colleges united under one corporate organization or
government.
10. "State" includes the District of Columbia, Puerto Rico, the Virgin Islands, Guam,
American Samoa, and the Northern Mariana Islands.
Page No. 1
11.
"Writing" or "written" means writing in either a paper-based or computer-based form,
including electronic signatures.
23-01.3-02. Disclosure of protected health information - In general.
Protected health information in possession of a public health authority may be disclosed
only as authorized by this chapter or another law of this state explicitly authorizing the
disclosure of that information, except that protected health information received or maintained
under chapter 23-01.1 may be disclosed only as authorized by that chapter. Subject to section
23-01-15, subsection 1 of section 23-07-02.2, and any other requirements of this title, this
chapter does not prohibit a public health authority from disclosing protected health information
for use in a biomedical research project approved by an institutional review board or a privacy
board or protected health information that has been transformed to protect the identity of the
patient through coding or encryption if the information is disclosed for use in an epidemiological
or statistical study.
23-01.3-03. Disclosure of a patient's own record.
Repealed by S.L. 2003, ch. 211, ยง 27.
23-01.3-04. Nonpublic disclosure to a public health authority.
1. A health care provider, public health authority, law enforcement official, school or
university, or the agent of any such individual or entity, may disclose protected health
information concerning an individual to a public health authority if:
a. There is a specific nexus between the individual's identity and a threat of a
specific disease, death, or injury to any individual or to the public health; and
b. The individual's identity would allow that public health authority to prevent or
significantly reduce the possibility of disease, injury, or death to any individual or
the public health.
2. An entity described in subsection 1 is not liable for the disclosure of protected health
information:
a. To a public health authority based upon a good-faith belief and credible
representation made by that authority that this information is required to protect
an individual or the public health from a threat of a specific disease, injury, or
death; or
b. If that disclosure is made pursuant to a federal or state law that is designed to
protect the public health or safety.
3. Except for the failure to report information required by chapter 23-07, 23-07.1, 23-07.3,
or 23-07.4, or any other law requiring disclosure of information regarding a disease or
condition, an entity described in subsection 1 is not liable for the failure to disclose
protected health information to a public health authority.
4. Any disclosure of protected health information under this section must be limited to the
minimum amount of information necessary to achieve the purposes of this section.
5. A recipient of information pursuant to this section may use or disclose that information
solely to achieve the purposes of this section.
6. Nothing in this section permitting the disclosure of protected health information may be
construed to require that disclosure, unless disclosure is otherwise required by law.
7. Protected health information disclosed under this section must be clearly identified as
protected health information that is subject to this chapter.
23-01.3-05. Nonpublic disclosure in emergency circumstances.
1. In the event of a threat of imminent physical or mental harm to the subject of protected
health information, a public health authority, in order to allay or remedy that threat, may
disclose protected health information about that subject to a health care practitioner,
health care facility, law enforcement authority, or emergency medical personnel to
protect the health or safety of that subject.
Page No. 2
2.
3.
4.
5.
In the event of a threat of harm to an individual other than the subject of protected
health information, a public health authority may disclose protected health information
about that subject if:
a. There is an identifiable threat of serious disease, injury, or death to an identifiable
individual or group of individuals;
b. The subject of the protected health information has the ability to carry out that
threat; and
c. The disclosure of that information is necessary to prevent or significantly reduce
the possibility of that threat.
Any disclosure of protected health information under this section must be limited to the
minimum amount of information necessary to achieve the purposes of this section.
A recipient of information pursuant to this section may use or disclose that information
solely to carry out the purposes of this section.
Protected health information disclosed under this section must be clearly identified as
protected health information that is subject to this section.
23-01.3-06. Disclosure for law enforcement purposes.
1. Notwithstanding any other law, a public health authority, or the agent of any such
entity, may disclose protected health information to a law enforcement authority if the
state health officer determines that:
a. The protected health information is necessary to a legitimate law enforcement
inquiry that has begun or may be initiated into a particular violation of a criminal
law or public health law being conducted by the authority; and
b. The investigative or evidentiary needs of the law enforcement authority cannot be
satisfied by nonidentifiable health information or by any other information.
2. If a public health authority discloses protected health information under this section,
that authority shall impose appropriate written safeguards to ensure the confidentiality
of the information and to protect against unauthorized or improper use or disclosure.
3. Protected health information about an individual that is disclosed under this section
may not be used in, or disclosed to any person for use in, any administrative, civil, or
criminal action or investigation directed against the individual, unless the action or
investigation arises out of, or is directly related to, the law enforcement inquiry for
which the information was obtained.
4. When the matter or need for which protected health information was disclosed to a law
enforcement authority or grand jury has concluded, including any derivative matters
arising from that matter or need, the law enforcement authority or grand jury must
either destroy the protected health information or return it to the person from whom it
was obtained.
5. To the extent practicable, and consistent with the requirements of due process, a law
enforcement authority shall redact personally identifying information from protected
health information prior to the public disclosure of that protected information in a
judicial or administrative proceeding.
6. Any disclosure of protected health information under this section must be limited to the
minimum amount of information necessary to fulfill the purposes of this section.
7. A recipient of information pursuant to this section may use or disclose that information
solely to fulfill the purposes of this section.
8. Protected health information disclosed under this section must be clearly identified as
protected health information that is subject to this chapter.
9. This section may not be construed to limit or restrict the ability of law enforcement
authorities to gain information while in hot pursuit of a suspect or if other exigent
circumstances exist.
23-01.3-07. Disclosure of a public health incident.
1. Notwithstanding any other law, the state health officer may disclose confidential
information or protected health information to a health care provider or the public if the
state health officer determines that:
Page No. 3
a.
b.
c.
2.
Disclosure of information is required to prevent the spread of disease;
Disclosure of information is required to identify the cause or source of disease; or
Disclosure of information is required to allay fear and aid the public in
understanding the risk of its exposure to disease.
The state health officer may disclose protected health information only to the extent
necessary to accomplish the purposes of this section, and may require any health care
provider receiving confidential or protected health information under this section to
keep that information confidential under written terms.
23-01.3-08. Status of information in possession of a local public health authority.
Any protected health information that is created or received by a local public health
authority, and that is submitted or is required to be submitted to the state department of health,
is confidential and subject to the protection of, and may be disclosed only as authorized by, this
chapter.
23-01.3-09. Penalty for unauthorized disclosure.
A person who knowingly discloses protected health information in violation of this chapter is
guilty of a class A misdemeanor.
Page No. 4
Disclaimer: These codes may not be the most recent version. North Dakota may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
