N.C.G.S.A. § 131E-214.4 - Statewide data processor

A statewide data processor must:

• Make available annually a report that includes the 35 most frequently reported charges of hospital and freestanding ambulatory surgical centers to the Division of Health Service Regulation of the Department of Health and Human Services.  The report is a public report to be made available to the public;
• Receive patient data from hospitals and ambulatory surgical centers;
• Compile and maintain a uniform set of data from submitted patient data;
• Analyze patient data;
• Compile reports from the patient data and make the reports available to an interested person at a reasonable charge;
• Ensure that adequate security measures are taken to protect the data received from hospitals and ambulatory surgical centers;
• Protect the confidentiality of patient records and ensure compliance with applicable state and federal confidentiality laws.  The data processor must not disclose patient identifying information unless: (i) the information was originally submitted by the party requesting disclosure or (ii) the State Health Director requests specific individual records for protection and promotion of the public health, and the disclosure is not otherwise prohibited by federal law or regulation. The records must be made available to the State Health Director at a reasonable charge.  The State Health Director must maintain the confidentiality of the records, but the law notes that they do not constitute public records.

The Department of Health and Human Services may take adverse action against any hospital or ambulatory surgical center that violates this law.