Maine § 8717. - Covered entities' access to protected health information

(1) Quality assessment and improvement activities, including case management and care coordination;  

(2) Competency assurance activities, including provider or health plan performance evaluation, credentialing and accreditation;  

(3) Conducting or arranging for medical reviews, audits or legal services, including fraud and abuse detection and compliance programs;  

(4) Specified insurance functions, such as underwriting, risk rating and reinsuring risks;  

(5) Business planning, development, management and administration; and  

(6) Business management and general administrative activities of the covered entity, including but not limited to de-identifying protected health information, creating a limited data set and permissible fund-raising for the benefit of the covered entity;   [PL 2013, c. 528, §10 (NEW); PL 2013, c. 528, §12 (AFF).]

B. "Payment activities" means activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits and furnish or obtain reimbursement for health care delivered to an individual and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual; and   [PL 2013, c. 528, §10 (NEW); PL 2013, c. 528, §12 (AFF).]

C. "Treatment" means the provision, coordination or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding an individual and referral of an individual by one provider to another.   [PL 2013, c. 528, §10 (NEW); PL 2013, c. 528, §12 (AFF).]

2.  Minimum necessary.  The board shall develop policies and procedures that reasonably limit disclosures of, and requests for, protected health information for payment activities and health care operations to the minimum extent necessary.

3.  Choice regarding disclosure of information.  Before approving the release of any protected health information under this chapter, the organization shall implement a mechanism that allows an individual to choose to not allow the organization to disclose and use the individual's health information under this chapter.