Section 6G Reporting and notice of unauthorized access to or disclosure of patient health information - Massachusetts Statutes

Section 6G. In the event of an unauthorized access to or disclosure of individually identifiable patient health information by or through the statewide health information network or by or through any technology grantees or implementing organizations funded in whole or in part from the E-Health Institute Fund established pursuant to section 6E, the operator of such network or grantee or contractor shall: (i) report the conditions of such unauthorized access or disclosure as required by the Massachusetts e-Health Institute; and (ii) provide notice, as defined in section 1 of chapter 93H, as soon as practicable, but not later than 10 business days after such unauthorized access or disclosure, to any person whose patient health information may have been compromised as a result of such unauthorized access or disclosure, and shall report the conditions of such unauthorized access or disclosure.