AS 18.23.310: Confidentiality and security of information.

(a) The department shall ensure the designee establishes appropriate privacy and security standards to protect the disclosure, transmission, and receipt of individually identifiable information contained in the system established under AS 18.23.300. The standards must

(1) include controls over access to and collection, organization, and maintenance of records and data that protect the confidentiality of the individual who is the subject of the record in accordance with applicable state and federal law;

(2) include a secure and traceable electronic audit system for identifying access points and trails;

(3) meet the most stringent applicable federal or state privacy law governing the protection of the information contained in the system.

(b) A person may not release or publish individually identifying information from the system except for the following purposes:

(1) treatment of a patient who is the subject of the information;

(2) to facilitate payment for services received by a patient who is the subject of the information;

(3) limited health care operations of a participant;

(4) public health activities; or

(5) uses or disclosures authorized by the individual who is the subject of the information.

(c) The designee shall establish procedures for a patient who is the subject of a health record contained in the system

(1) to opt out of the system;

(2) to authorize the distribution of the patient's records contained in the system, if additional authorization is necessary under applicable privacy and security laws;

(3) to be notified of a violation of the confidentiality provisions required under this section;

(4) on request to the designee, to view an audit report created under this section for the purpose of monitoring access to the patient's records.