Section 14-138 - Disclosure of medical information.
§ 14-138. Disclosure of medical information.
(a) Prohibited.- Except as provided in subsection (b), (c), or (d) of this section, a nonprofit health service plan or Blue Cross or Blue Shield plan may not disclose specific medical information contained in a subscriber's or certificate holder's medical records.
(b) Exception - Disclosure to or authorized by subscriber or certificate holder.- A nonprofit health service plan or Blue Cross or Blue Shield plan may disclose specific medical information contained in a subscriber's or certificate holder's medical records:
(1) to the individual or individual's agent or representative; or
(2) if the individual authorizes the disclosure.
(c) Same - Disclosure without authorization of subscriber or certificate holder.- A nonprofit health service plan or Blue Cross or Blue Shield plan may disclose specific medical information contained in a subscriber's or certificate holder's medical records without the authorization of the subscriber or certificate holder:
(1) to a medical review committee, accreditation board, or commission, if the information is requested by or is in furtherance of the purpose of the committee, board, or commission;
(2) in response to legal process;
(3) to another nonprofit health service plan, Blue Cross or Blue Shield plan, or insurer to coordinate benefit payments under multiple sickness and accident, dental, or hospital medical contracts;
(4) to a government agency performing its lawful duties as authorized by an act of the General Assembly or United States Congress;
(5) to a researcher, on request, for medical and health care research in accordance with a protocol approved by an institutional review board;
(6) in accordance with a cost containment contractual obligation to verify that benefits paid by the nonprofit health service plan were proper contractually; or
(7) to a third party payor if:
(i) the third party payor does not further disclose the specific medical information; and
(ii) the information is required for an audit of the billing made by the plan to the payor.
(d) Same - Identity of subscriber or certificate holder not disclosed.- This section does not prohibit the use of medical records, data, or statistics if the use does not disclose the identity of a particular subscriber or certificate holder.
(e) Liability for damages.- A nonprofit health service plan that knowingly violates this section is liable to a plaintiff for any damages recoverable in a civil action, including reasonable attorney's fees.
[An. Code 1957, art. 48A, § 354-O; 1997, ch. 35, § 2; 1998, ch. 21, § 1.]