Notwithstanding any other provision of law, data collected under RSA 126:25 shall be made available:
I. To the public upon request, provided that individual patients or health care practitioners shall not be directly or indirectly identifiable.
II. To individuals or entities for research, public health, or health care operations as defined by HIPAA, or any other individual or entity as allowable by law, demonstrating a legitimate need for such information, if such disclosure is consistent with all applicable HIPAA standards and approved by the commissioner, or designee, in accordance with rules adopted under RSA 126:27. Use of data disclosed shall not be for marketing or fundraising targeted to individuals except such use or disclosure shall be permissible for market analysis.
III. To the insurance department, the department of justice, or any other state or federal agency, and any agency’s contractors, for review of health care matters within the agency’s respective jurisdictional authority. An agency or contractor receiving health care data under this section shall comply with all state and federal confidentiality, privacy, and security protections.
Source. 1985, 378:2. 1994, 133:3. 1995, 310:182. 2012, 282:4, eff. June 30, 2015. 2019, 233:4, eff. July 12, 2019.