37-7-1506. Providing prescription drug registry information. (1) Registry information is health care information as defined in 50-16-504 and is confidential. Except as provided in 37-7-1504, the board is authorized to provide data from the registry, upon request, only to the following:

(a) a person authorized to prescribe or dispense prescription drugs if the person certifies that the information is needed to provide medical or pharmaceutical treatment to a patient who is the subject of the request and who is under the person's care or has been referred to the person for care;

(b) a prescriber who requests information relating to the prescriber's own prescribing information if the prescriber certifies that the requested information is for a purpose in accordance with board rule;

(c) an individual requesting the individual's registry information if the individual provides evidence satisfactory to the board that the individual requesting the information is the person about whom the data entry was made;

(d) a designated representative of a government agency responsible for licensing, regulating, or disciplining licensed health care professionals who are authorized to prescribe, administer, or dispense drugs, in order to conduct investigations related to a health care professional who is the subject of an active investigation for drug misuse or diversion;

(e) in accordance with the requirements of subsection (3), a designated representative of the department of public health and human services making an inquiry in accordance with 53-21-1101;

(f) a county coroner or a peace officer employed by a federal, state, tribal, or local law enforcement agency if the county coroner or peace officer has obtained an investigative subpoena;

(g) an authorized individual under the direction of the department of public health and human services for the purpose of reviewing and enforcing that department's responsibilities under the public health, medicare, or medicaid laws; or

(h) a prescription drug registry in another state if the data is subject to limitations and restrictions similar to those provided in 37-7-1502 through 37-7-1513.

(2) The board shall maintain a record of each individual or entity that requests information from the registry and whether the request was granted pursuant to this section.

(3) (a) The board may release information in summary, statistical, or aggregate form for educational, research, or public information purposes. The information may not identify a person or entity.

(b) Without identifying the individual, the information released to the department of public health and human services for the purposes of subsection (1)(e) must include a list of all controlled substances dispensed to each person whose death was ruled to be a suicide.

(4) Information collected by or obtained from the registry may not be used:

(a) for commercial purposes; or

(b) as evidence in any civil or administrative action, except in an investigation and disciplinary proceeding by the department or the agency responsible for licensing, regulating, or disciplining licensed health care professionals who are authorized to prescribe, administer, or dispense prescription drugs.

(5) Information obtained from the registry in accordance with the requirements of this section may be used in the course of a criminal investigation and subsequent criminal proceedings.

(6) (a) Registry information may be integrated into a health information system if the system:

(i) limits access to the information to those individuals authorized under subsection (1) to receive registry information;

(ii) meets the privacy and security requirements of the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. 1320d, et seq.; and

(iii) meets other criteria established by the board by rule.

(b) Information integrated into a health information system remains subject to the confidentiality requirements of 37-7-1505.

(7) The board shall adopt rules to ensure that only authorized individuals have access to the registry and only to appropriate information from the registry. The rules must be consistent with:

(a) the privacy provisions of the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. 1320d, et seq.;

(b) administrative rules adopted in connection with that act;

(c) Article II, section 10, of the Montana constitution; and

(d) the privacy provisions of Title 50, chapter 16.

(8) The procedures established by the board under this section may not impede patient access to prescription drugs for legitimate medical purposes.