68-11-1503. Confidentiality.
(a) The name and address and other identifying information of a patient shall not be divulged, except for:
(1) Any statutorily required reporting to health or government authorities;
(2) Access by an interested third-party payer or designee, for the purpose of utilization reviews, case management, peer reviews, or other administrative functions;
(3) Access by health care providers from whom the patient receives or seeks care;
(4) If the patient does not object, any directory information, including only the name of the patient, the patient's general health status and the patient's location and telephone number. Directory information shall be released to all inquirers, only if the patient has been notified, upon admission to the hospital, of the patient's right to object to the information that may be released and has not objected; or, if the patient is in a physical or mental condition such that the patient is incapable of making an objection and the next of kin or patient representative does not come forward and object; and
(5) Any request by the office of inspector general or the medicaid fraud control unit with respect to an ongoing investigation. No person or entity shall be subject to any civil or criminal liability for releasing patient information in response to a request from the office of inspector general or the medicaid fraud control unit.
(b) The name and address and other identifying information shall not be sold for any purpose.
(c) Any violation of this provision shall be an invasion of the patient's right to privacy.
(d) Notwithstanding the provisions of this part or any other law to the contrary, it shall not be unlawful to disclose, nor shall there be any liability for disclosing, medical information in response to a subpoena, court order, or request authorized by state or federal law.
[Acts 1996, ch. 873, § 4; 1997, ch. 366, § 1; 1998, ch. 791, § 1; 2005, ch. 113, § 2; 2005, ch. 474, § 14.]