10-144 C.M.R. ch. 253, § 7 - CONDUCT OF INVESTIGATIONS AND CONFIDENTIALITY

A. Responsibilities of investigators

1 Department investigators and investigation staff/employees will sign a confidentiality agreement regarding study conduct and assurances of confidentiality when working with confidential data elements.

2 Appointed investigation personnel, those who are deemed necessary to the function of the study, who are not, however, Department employees, will need the approval of the oversight advisory body and their conduct shall be governed by these same Department rules and regulations and who will be required to abide by the same confidentiality assurances and restrictions as Department employees.

3 The Department investigator and investigation staff are to follow professional standards when using identifying information and conduct themselves in a manner to assure confidentiality.

4 Measures for assuring confidentiality and the integrity of the Maine chronic disease surveillance program databases as well as restricting access to case specific data by employees of the Department and others include:

(a) establishing a series of passwords and internal security codes for access to the Maine chronic disease surveillance databases;

(b) storing all completed hardcopy of confidential case-specific information in locked file cabinet, secure room, safe or similar container; or a locking valise when performing field investigations;

(c) disposing of all chronic disease program preliminary data listings, test retrievals and other sensitive information in a confidential manner, e.g., shredding of documents with identifying information;

(d) the use of system IDs and other intermediate codes to prevent case-specific identification.

5 Prior to requesting access to medical records Department investigators shall inform the hospital administrator, director of the Medical Record Department and President of the Medical Staff of the intentions of the investigator with a brief description of the purpose of the investigation/verification. If a full-scale follow-up epidemiologic study is involved, a copy of the study protocol with methodology shall be included. If the investigation/verification is of a general protocol nature as described in Section 8(A), a copy of the general study protocol with methodology and advisory body approval shall be provided to the aforementioned members of the hospitals participating in this project.

6 Discussion, transfer, and/or review of identifying information will be restricted to Department and advisory body approved and appointed investigation members, involved health practitioners and hospital personnel who have custody of such data.

7 Those persons participating in the investigation will not disclose medical information about an identified patient to any other person except a health care practitioner responsible for treating the patient and other responsible hospital personnel.

8 Department investigators and investigation staff shall not release, furnish, disclose, publish or otherwise disseminate any identifying information to any person except those specified above and those who have agreed in writing to comply with the confidentiality agreement after advisory body approval.

9 Investigators gaining access to medical information about an identified patient shall use that information to the minimum extent necessary to accomplish the purposes of the investigation.

10 The investigators and investigation staff shall make only such additional copies of the data as are required in the conduct of the research and, after the term of the research concludes, shall retain only one copy of the data for a period of time specified in the study protocol.

11 Additionally, unless specifically addressed in the study protocol or explicitly directed to do so by the advisory body, the investigators and investigation staff shall not use the data provided to take legal, administrative or other actions against individuals, nor shall the requesting party make contact with or assist others in making contact with any patients who may be indirectly identified in the data provided.

Notes

10-144 C.M.R. ch. 253, § 7