HAR §12-55-12. Removal of direct personal identifiers

Whenever employee medical information obtained pursuant to a written access order is taken off- site with direct personal identifiers included, the principal HIOSH investigator shall, unless otherwise authorized by the HIOSH medical records officer, promptly separate all direct personal identifiers from the medical information, and code the medical information and the list of direct identifiers with a unique identifying number for each employee. The medical information with its numerical code shall thereafter be used and kept secured as though still in a directly identifiable form. The principal HIOSH investigator shall also hand deliver or mail the list of direct personal identifiers with their corresponding numerical codes to the HIOSH medical records officer. The HIOSH medical records officer shall thereafter limit the use and distribution of the list of coded identifiers to those with a need to know its contents. [Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4) §12-55-13 Internal agency use of personal identifiable employee medical information. (a) The principal HIOSH investigator shall in each instance of §12-55 6 access be primarily responsible for ensuring that personally identifiable employee medical information is used and kept secured in accordance with this section. (b) The principal HIOSH investigator, the HIOSH medical records officer, the director, and any other authorized person listed on a written access order may permit the examination or use of personal identifiable employee medical information by HIOSH employees and contractors who have a need for access, and appropriate qualifications, for the purpose for which they are using the information. No HIOSH employee or contractor is authorized to examine or otherwise use personally identifiable employee medical information unless so permitted. (c) Where a need exists, access to personally identifiable employee medical information may be provided to the attorney general and to HIOSH contractors who are physicians or who have contractually agreed to abide by the requirements of this section, implementing HIOSH directives, and HIOSH instructions. (d) HIOSH employees and contractors are only authorized to use personal identifiable employee medical information for the purposes for which it was obtained, unless the specific written consent of an employee is obtained as to a secondary purpose, or the procedures of sections 12-55-6 through 12-55- 12 are repeated with respect to the secondary purpose. (e) Whenever practicable, the examination of personally identifiable employee medical information shall be performed on-site with a minimum of medical information taken off-site in a personal identifiable form. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)