Vermont § 1881 - Disclosure of protected health information prohibited

§ 1881. Disclosure of protected health information prohibited

• (a) As used in this section: (1) “Business associate” has the same meaning as in 45 C.F.R. § 160.103. (2) “Covered entity” has the same meaning as in 45 C.F.R. § 160.103. (3) “Legally protected health care activity” has the same meaning as in 1 V.S.A. § 150. (4) “Protected health information” has the same meaning as in 45 C.F.R. § 160.103. (5) “Telehealth” has the same meaning as in 26 V.S.A. § 3052. (b) A covered entity or business associate shall not disclose protected health information
  unless the disclosure is permitted under the Health Insurance Portability and Accountability
  Act of 1996 (HIPAA). (c)(1) Notwithstanding any provision of subsection (b) of this section to the contrary, in
  order to protect patients and providers who engage in legally protected health care
  activity and except as set forth in subdivision (2) of this subsection, a covered
  entity or business associate shall not disclose protected health information that
  is identifiable or susceptible to reidentification and is related to a legally protected
  health care activity: (A) to any government entity other than the State of Vermont or its political subdivisions
  or instrumentalities if the covered entity or business associate has reason to believe
  that the information will be used: (i) to conduct a criminal, civil, administrative, or professional disciplinary investigation
  into any individual for the mere act of seeking, obtaining, providing, or facilitating
  a legally protected health care activity; (ii) to impose criminal, civil, or administrative liability or professional disciplinary
  action on any individual for the mere act of seeking, obtaining, providing, or facilitating
  a legally protected health care activity; or (iii) to identify any individual for any of the activities described in subdivision (i)
  or (ii) of this subdivision (A); or (B) for use in a civil or criminal action; a proceeding preliminary to a civil or criminal
  action; or a probate, legislative, or administrative proceeding. (2) Notwithstanding any provision of subdivision (1) of this subsection to the contrary,
  a covered entity or business associate may disclose protected health information that
  is identifiable or susceptible to reidentification and is related to a legally protected
  health care activity if the disclosure meets one or more of the following conditions: (A) The disclosure is authorized by the patient or the patient’s conservator, guardian,
  or other authorized legal representative. (B) The disclosure is ordered by a court of competent jurisdiction pursuant to federal
  law, Vermont law, or rules adopted by the Vermont Supreme Court. A State court order
  compelling disclosure under this subdivision (B) shall include the court’s determination
  that the information will not be used to impose criminal, civil, or administrative
  liability or professional disciplinary action on any individual based solely on the
  fact that the person sought, obtained, provided, or facilitated a legally protected
  health care activity. (C) The disclosure is to be made to a business associate designated by the covered entity
  or the covered entity’s business associate and will be used solely in the defense
  of the covered entity or the covered entity’s business associate against a claim that
  has been made, or there is a reasonable belief will be made, against the covered entity
  or the covered entity’s business associate in a civil or criminal action; a proceeding
  preliminary to a civil or criminal action; or a probate, legislative, or administrative
  proceeding. (D) The disclosure is to Vermont’s Board of Medical Practice or Office of Professional
  Regulation, as applicable, in connection with a bona fide investigation in Vermont
  of a licensed, certified, or registered health care provider or a bona fide investigation
  of whether an individual who is not licensed, certified, or registered to practice
  a health care profession in Vermont engaged in unauthorized practice in this State,
  whether in person or through telehealth. (E) The disclosure is to the Vermont Department of Health or the Vermont Department of
  Disabilities, Aging, and Independent Living, or both, in connection with a bona fide
  investigation of a licensed health care facility in Vermont. (F) Subject to the limitations set forth in 12 V.S.A. § 7306, the disclosure is required in the ordinary course of business of Vermont’s Medicaid
  program. (d) A covered entity or business associate shall not be subject to any civil, criminal,
  or administrative liability or professional disciplinary action for refusing to disclose
  protected health information that is identifiable or susceptible to reidentification
  and is related to a legally protected health care activity, in accordance with subsection
  (c) of this section. (Added 2015, No. 169 (Adj. Sess.), § 1, eff. Oct. 1, 2016; amended 2023, No. 15, § 14, eff. May 10, 2023; 2025, No. 20, § 6, eff. May 13, 2025.)