(b) Limitations on access to controlled substances database.

1. (1) The controlled substances database and all information contained in the controlled substances database and any records maintained by the Department of Health or by an entity contracting with the Department of Health that is submitted to, maintained, or stored as a part of the controlled substances database is privileged and confidential, is not a public record, and is not subject to subpoena or discovery in a civil proceeding.

2. (2) Information in the controlled substances database may be accessed by:

   1. (A) A certified law enforcement officer pursuant to a criminal investigation but only after the law enforcement officer obtains a search warrant signed by a judge that demonstrates probable cause to believe that a violation of federal or state criminal law has occurred, that specified information contained in the database would assist in the investigation of the crime, and that the specified information should be released to the certified law enforcement officer;
   2. (B) A regulatory body engaged in the supervision of activities of licensing or regulatory boards of practitioners authorized to prescribe or dispense controlled substances;
   3. (C) A person or entity investigating a case involving breaches of privacy involving the database or its records;
   4. (D) A certified law enforcement prescription drug diversion investigator of a qualified law enforcement agency;
   5. (E) A practitioner within the Arkansas Medicaid prescription drug program;
   6. (F) The Department of Human Services or the Crimes Against Children Division of the Division of Arkansas State Police, if:

(i) The purpose of the database access is related to an investigation under the Child Maltreatment Act, Arkansas Code § 12-18-101 et seq., and not pursuant to a criminal investigation by a certified law enforcement officer; and

1. (ii) The Department of Human Services has obtained a court order to access the database under Arkansas Code § 12-18-622;

   1. (G) The Office of Medicaid Inspector General for review and investigation of fraud, waste, and abuse within the Arkansas Medicaid prescription drug program if access is limited to beneficiaries of the Arkansas Medicaid prescription drug program; and

   2. (H) The State Medical Examiner as authorized by law to investigate causes of deaths for cases under investigation pursuant to his or her official duties and responsibilities.

      1. (c) This section does not apply to information, documents, or records created or maintained in the regular course of business of a pharmacy, medical, dental, optometric, or veterinary practitioner, or other entity covered by Arkansas Code §§ 20-7-601 – 20-7-615 and this part, and all information, documents, or records otherwise available from original sources are not immune from discovery or use in a civil proceeding merely because the information contained in the records was reported to the controlled substances database under Arkansas Code §§ 20-7-601 – 20-7-615 and this part.
      2. (d)
2. (1) The Department of Health shall establish and enforce policies and procedures to ensure that the privacy and confidentiality of patients are maintained and that patient information collected, recorded, transmitted, and stored is protected and not disclosed to persons except as listed in 20 CAR § 200-106, Providing Prescription Monitoring Information.
3. (2) The Department of Health’s policies shall comply with Sections 261 through 264 of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (the Administrative Simplification provisions) and regulations 45 C.F.R. pts. 160 and 164 (the HIPAA Security and Privacy Rule) and the Health Information Technology for Economic and Clinical Health Act, as enacted by the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, pursuant to Title XIII of Division A and Title IV of Division B.

(e)

1. (1) The Prescription Drug Monitoring Program shall establish and maintain a process for verifying the credentials and authorizing the use of prescription information by individuals and agencies listed in 20 CAR § 200-106, providing prescription monitoring information.
2. (2) The application to access prescription information shall include information as needed by the Department of Health to verify the applicant’s authority to use prescription information in compliance with 20 CAR § 200-106.