105. Mass. Code Regs. 300.120. - Confidentiality

All information, such as disease reports, interviews, or electronic records, that identifies the patient, that was used to report to or collected by the Department of Community Health or local boards of health is protected from being disclosed.  The Department or local boards of health may disclose personally identifying information about an individual only for disease investigation, treatment, prevention, or control with the individual’s written consent.  Access to individually identifiable information should be restricted to those Department and health board members who have a specific need to review the personal data records.  The Department and local boards of health must ensure that the reports remain secure and are kept in controlled access areas.  

The Department and local boards of health cannot disclose the identity of an individual with HIV or AIDS reported to the Department to any federal or state entities, agencies, or contractors.