1. I. Any person allowed access to individually identifiable health information in program records shall sign a confidentiality agreement, in a form specified by the department, requiring adherence to privacy and security protections equivalent to or greater than the protections provided in this chapter.

2. II. The department shall maintain a list of any persons other than program staff given access to individually identifiable health information. The list shall include:

   1. (a) The name of the person authorizing access.
   2. (b) The name, title, and organizational affiliation of each person given access.
   3. (c) The date of access.
   4. (d) The specific purpose for which the information was used.
3. III. Individually identifiable health information in the records of the program may be retained for 18 years or, if the information relates to a minor, until the individual reaches the age of 18. Thereafter, the program may use and retain the information only in a form where an individual's identity cannot be discerned.

Source. 2008, 186:1, eff. June 11, 2008.