HAR §12-55-14. Security procedures

(a) HIOSH files containing personally identifiable employee medical information shall be segregated from other agency files. When not in active use, files containing this information shall be kept secured in a locked cabinet or vault. (b) The HIOSH medical records officer and the principal HIOSH investigator shall each maintain a log of uses and transfers of personal identifiable employee medical information and lists of coded direct personal identifiers, except for necessary uses by staff under their direct personal supervision. (c) The photocopying or other duplication of personally identifiable employee medical information shall be kept to the minimum necessary to accomplish the purposes for which the information was obtained. (d) The protective measures established by this section apply to all worksheets, duplicate copies, or other agency documents containing personally identifiable employee medical information. (e) Intra-agency transfers of personally identifiable employee medical information shall be by hand delivery, United States mail, or equally protective means. Inter-office mailing channels shall not be used. [Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)