Pennsylvania § 5505 - Access to information.

§ 5505. Access to information.

(a) Voluntary disclosures.--Section 1307 of the act of April 17, 2016 (P.L.84, No.16), known as the Medical Marijuana Act, shall not prohibit the voluntary disclosure of any records or other information by a legitimate cannabis-related business, or a business associate to a financial institution or insurer, as necessary to obtain financial or insurance services to the extent not prohibited by and consistent with any applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 110 Stat. 1936) privacy regulation as promulgated by the United States Department of Health and Human Services under 45 CFR Pts. 160 (relating to general administrative requirements), 162 (relating to administrative requirements) and 164 (relating to security and privacy) and 16 CFR Pt. 313 (relating to privacy of consumer financial information).

(b) Restrictions on use of records.--A financial institution, or insurer receiving access to information under subsection (a), the distribution of which would otherwise be prohibited, may only use the information as necessary to satisfy due diligence obligations required to provide financial or insurance services to persons participating in the medical marijuana program established under the Medical Marijuana Act and may not disclose the information records to other persons except for information:

(1) required for the filing of suspicious activity reports with the United States Department of the Treasury or the investigation of related reports;

(2) requested by the institution's primary regulator, the Federal Deposit Insurance Corporation or the National Credit Union Administration for the purposes of conducting an examination of the institution;

(3) as necessary to respond to court orders or subpoenas after providing the person authorizing the release of the records and the institution's primary regulator the opportunity to object to the order or subpoena; or

(4) as authorized by a person who is the subject of the confidential information.