Privacy & Confidentiality

Connecticut generally requires government agencies to keep personal information obtained while administering certain programs confidential unless disclosure is otherwise authorized.1

Connecticut provides additional protection for personal information by:

· Classifying individualized service plans, created by assisted living agencies in coordination with a resident, as confidential and only permitting access by the resident and the Department of Public Health.2

· Requiring local health directors to maintain the confidentiality of medical records of persons that receive treatment at a “communicable disease control clinic.”3

· Requiring minors to consent before a mental health provider may disclose treatment information to the minor’s parent or guardian.4 Health care providers must keep confidential their treatment of a minor for venereal disease.5

· Classifying notices from clinical laboratories to patients regarding a medical error as confidential.6

· Exempting adverse event information reported by hospitals and outpatient surgical facilities from the Freedom of Information Act and prohibiting its discovery or admission into evidence in a legal proceeding.7

· Requiring Patient Safety Organizations to ensure the security and confidentiality of patient safety information.8

· Prohibiting hospitals from releasing a patient’s name when notifying emergency responders of their potential exposure to an infectious disease.9

· Allowing pharmacists to disclose patient information only upon receiving the consent of the patient or their agent.10

· Prohibiting Managed Care Organizations from selling information that identifies enrollees and otherwise mandating their compliance with federal and state confidentiality laws.11

· Prohibiting the sale of individually identifiable medical information, though such information may be disclosed for marketing purposes so long as the individual consents.12 Disclosure of identifiable information from medical records with the malicious intent to harm the individual carries is punishable by fine and/or imprisonment.13

· Requiring Insurers to implement policies, standards and procedures for managing, transferring, and securing medical record information.14

· Prohibiting the use of the Freedom of Information Act to obtain identifiable information held by the Connecticut Health Insurance Exchange.15

· Requiring the Commissioner of Public Health to establish guidelines for ensuring the confidentiality of patient and physicians identities when reviewing complaints against physicians.16

· Requiring the Office of Health Care Access must maintain the confidentiality of patient and physician data they receive while carrying out their duties.17

Connecticut permits access and disclosure of personal information as follows:

· Connecticut authorizes state agencies to disclose personally identifiable information pursuant to their participation in the Connecticut Health Information Network.18

· The Long-Term Care Ombudsman may access resident medical records with the resident’s consent or, without the resident’s consent in limited circumstances.19 Connecticut tasks the Division of Elderly Services with ensuring that Ombudsman program records are properly disclosed and that resident identities are not released absent a resident’s consent or court order.20

· Connecticut allows the Department of Public Health to access information from health records in order to administer the birth defect surveillance program;21 accessed identifying information must be kept confidential.22 The Department may also access health records to verify tumor registry reports.23

· Hospitals must release medical records to health plans upon receipt of a patient authorization or audit request.24

· Providers must furnish a copy of a patient’s health record to another provider upon written request of the patient.25

· The Department of Public Health may release morbidity and mortality data for research purposes, but must otherwise keep the information confidential.26