105. Mass. Code Regs. 302.070. - Confidentiality

Information to be reported for the Congenital Abnormalities Registry must be necessary to conduct epidemiological studies and develop treatment and control measures for congenital abnormalities.  The rule provides that social security numbers should not be used, but rather patient identifiers to reduce duplicate reporting.  Any information, including reports or records submitted to the Registry is not available to the public.  The Department of Public Health must maintain the confidentiality of the reports and must ensure that the information is de-identified.  In a report submitted to the Registry, information about the specific individual who is the subject of the report may be disclosed if other information relating to a third party other than the diagnosing physician is redacted if the specific individual submits a signed written request and if the particular individual is a minor, has a court appointed guardian or attorney, if his or her parents, guardian or attorney submit a signed written request.  All written requests for disclosure of information must be witnessed by a Department employee and be notarized.  Any person requesting disclosure must present proper identification.  Information from the Registry may be released to a principal investigator of a study or research to conduct an approved medical study to reduce morbidity and mortality.  For a pregnancy loss not a result of a fetal death, the Department cannot disclose the medical record of individually identifiable information without first obtaining the patient’s written informed consent.  Any study that is conducted cannot publish the name or any other identifying information.  The Department must maintain an audit trail to keep a record of all those who have access to the medical records and information obtained from the Registry.  Security procedures must be put in place to prevent the unauthorized access to information contained in the Registry.  The Department must comply with statewide standards for records and retention and destruction of records.