105 CMR 300.120
Confidentiality
(A) All confidential personally identifying information, whether kept in electronic system or
paper format including, but not limited to, reports of disease, clinical data, demographic data,
and epidemiological data, notes, and memoranda, about any individual that is reported to or
collected by the Department or local boards of health, or any individual or entity designated by
the Department in accordance with 105 CMR 300.050, pursuant to 105 CMR 300.000 shall,
unless disclosed as otherwise allowed in 105 CMR 300.120(A), be treated as confidential. Only
those employees of the Department, local boards of health, or any individual or entity designated
by the Department in accordance with 105 CMR 300.050, who have a specific need to review
personal data records for the purposes allowed herein or otherwise required by law shall be
entitled access to information contained in MAVEN and other such records. Any individual or
entity making or receiving a report of disease shall ensure all paper records and electronic data
systems related to information reported to or collected pursuant to 105 CMR 300.000 are treated
as confidential in the same manner as information contained within MAVEN, kept secure and
to the greatest extent possible kept in controlled access areas. Except when necessary for the
Commonwealth's or local jurisdiction's disease investigation, control, treatment and prevention
purposes, or for studies or research authorized by the commissioner pursuant to M.G.L. c. 111,
§ 24A, the Department and local boards of health or any individual or entity designated by the
Department in accordance with 105 CMR 300.050, shall not disclose any personally identifying
information without the individual's written consent.
(B) Notwithstanding 105 CMR 300.120(A), the Department shall not disclose to the federal
government, the Commonwealth or any of its political subdivisions or any agency, agent, or
contractor of said Commonwealth or federal government, the identity of any individual with HIV
or AIDS reported to the Department under 105 CMR 300.000.