A. A health care entity must keep records and information contained in records confidential and not as public records, except as provided in this section. Records and information contained in records may be disclosed only as authorized by state or federal law, including the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E), or as follows to:

1. 1. Physicians and providers of health, mental health or social and welfare services involved in caring for, treating or rehabilitating the patient.
2. 2. Individuals to whom the patient or the patient's health care decision maker has given authorization to have information disclosed.
3. 3. Persons authorized by a court order.
4. 4. Persons doing research only if the activity is conducted pursuant to applicable federal or state laws and regulations governing research.
5. 5. The state department of corrections in cases in which prisoners confined to the state prison are patients in the state hospital on authorized transfers either by voluntary admission or by order of the court.

6. 6. Governmental or law enforcement agencies if necessary to:

   1. (a) Secure the return of a patient who is on unauthorized absence from any agency where the patient was undergoing evaluation and treatment.
   2. (b) Report a crime on the premises.
   3. (c) Avert a serious and imminent threat to an individual or the public.

7. 7. Persons, including family members, other relatives, close personal friends or any other person identified by the patient, as otherwise authorized or required by state or federal law, including the health insurance portability and accountability act of 1996 privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E), or pursuant to one of the following:

   1. (a) If the patient is present or otherwise available and has the capacity to make health care decisions, the health care entity may disclose the information if one of the following applies:

      1. (i) The patient agrees verbally or agrees in writing by signing a consent form that permits disclosure.
      2. (ii) The patient is given an opportunity to object and does not express an objection.
      3. (iii) The health care entity reasonably infers from the circumstances, based on the exercise of professional judgment, that the patient does not object to the disclosure.

   2. (b) If the patient is not present or the opportunity to agree or object to the disclosure of information cannot practicably be provided because of the patient's incapacity or an emergency circumstance, the health care entity may disclose the information if the entity determines that the disclosure of the information is in the best interests of the patient. In determining whether the disclosure of information is in the best interests of the patient, in addition to all other relevant factors, the health care entity shall consider all of the following:

      1. (i) The patient's medical and treatment history, including the patient's history of compliance or noncompliance with an established treatment plan based on information in the patient's medical record and on reliable and relevant information received from the patient's family members, friends or others involved in the patient's care, treatment or supervision.
      2. (ii) Whether the information is necessary or, based on professional judgment, would be useful in assisting the patient in complying with the care, treatment or supervision prescribed in the patient's treatment plan.
      3. (iii) Whether the health care entity has reasonable grounds to believe that the release of the information may subject the patient to domestic violence, abuse or endangerment by family members, friends or other persons involved in the patient's care, treatment or supervision.
   3. (c) The health care entity believes the patient presents a serious and imminent threat to the health or safety of the patient or others, and the health care entity believes that family members, friends or others involved in the patient's care, treatment or supervision can help to prevent the threat.
   4. (d) In order for the health care entity to notify a family member, friend or other person involved in the patient's care, treatment or supervision of the patient's location, general condition or death.
8. 8. A state agency that licenses health professionals pursuant to title 32, chapter 13, 15, 17, 19.1 or 33 and that requires these records in the course of investigating complaints of professional negligence, incompetence or lack of clinical judgment.
9. 9. A state or federal agency that licenses health care providers.
10. 10. A governmental agency or a competent professional, as defined in section 36-3701, in order to comply with chapter 37 of this title.
11. 11. Independent oversight committees established pursuant to title 41, chapter 35. Any information released pursuant to this paragraph shall comply with the requirements of section 41-3804 and applicable federal law and shall be released without personally identifiable information unless the personally identifiable information is required for the official purposes of the independent oversight committee. Case information received by an independent oversight committee shall be maintained as confidential. For the purposes of this paragraph, "personally identifiable information" includes a person's name, address, date of birth, social security number, tribal enrollment number, telephone or telefacsimile number, driver license number, places of employment, school identification number and military identification number or any other distinguishing characteristic that tends to identify a particular person.
12. 12. A patient or the patient's health care decision maker.
13. 13. The department of public safety or another law enforcement agency by the court to comply with the requirements of section 36-540, subsections O and P.
14. 14. A third-party payor or the payor's contractor as permitted by the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 160 and part 164, subpart E.
15. 15. A private entity that accredits the health care provider and with whom the health care provider has an agreement requiring the agency to protect the confidentiality of patient information.
16. 16. The legal representative of a health care entity in possession of the record for the purpose of securing legal advice.
17. 17. A person or entity as otherwise required by state or federal law.
18. 18. A person or entity as permitted by the federal regulations on alcohol and drug abuse treatment (42 Code of Federal Regulations part 2).
19. 19. A person or entity to conduct utilization review, peer review and quality assurance pursuant to section 36-441, 36-445, 36-2402 or 36-2917.
20. 20. A person maintaining health statistics for public health purposes as authorized by law.
21. 21. A grand jury as directed by subpoena.
22. 22. A person or entity that provides services to the patient's health care provider, as defined in section 12-2291, and with whom the health care provider has a business associate agreement that requires the person or entity to protect the confidentiality of patient information as required by the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 164, subpart E).
23. 23. A county medical examiner or an alternate medical examiner directing an investigation into the circumstances surrounding a death pursuant to section 11-593.