HAR §12-55-18. Inter-agency transfer and public disclosure

(a) Personal identifiable employee medical information shall not be transferred to another agency or office outside of HIOSH (other than to the attorney general) or disclosed to the public (other than to the affected employee or the original recordholder) except when required by law or when approved by the director. (b) Except as provided in subsection (c) below, the director shall not approve a request for an inter-agency transfer of personal identifiable employee medical information, for which the employees have not given their consent, unless the request is by a public health agency which: (1) Needs the requested information in a personally identifiable form for a substantial public health purpose; (2) Will not use the requested information to make individual determinations concerning affected employees which could be to their detriment; (3) Has regulations or established written procedures providing protection for personally identifiable medical information substantially equivalent to that of this chapter; and (4) Satisfies an exemption to the Privacy Act to the extent that the Privacy Act applies to the requested information. See 5 U.S.C. 552a(b); 29 CFR 70a.3. (c) Upon the approval of the director, personally identifiable employee medical information may be transferred to: (1) The National Institute for Occupational Safety and Health (NIOSH); and (2) The State attorney general, when necessary, with respect to a specification under chapter 396, HRS. (d) The director shall not approve a request for public disclosure of employee medical information containing direct personal identifiers unless there are compelling circumstances affecting the health or safety of an individual. §12-55 8 (e) The director shall not approve a request for public disclosure of employee medical information which contains information which could reasonably be used indirectly to identify specific employees when the disclosure would constitute a clearly unwarranted invasion of personal privacy. See, 5 U.S.C. 552(b)(6); 29 CFR 70.26. (f) Except as to inter-agency transfers to NIOSH or the Department of Justice, the HIOSH medical records officer shall ensure that advance notice is provided to any designated representative of the affected employees and to the employer on each occasion that HIOSH intends to either transfer personally identifiable employee medical information to another agency or disclose it to a member of the public other than to an affected employee. When feasible, the HIOSH medical records officer shall take reasonable steps to ensure that advance notice is provided to affected employees when the employee medical information to be transferred or disclosed contains direct personal identifiers. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)