Current through Register Vol. 51, No. 6, March 22, 2024
A. Except when required by law or when approved by the Commissioner, personally identifiable employee medical information may not be:
(1) Transferred to an agency or office other than MOSH, except to an assistant attorney general assigned to MOSH; or
(2) Disclosed to the public, other than to the affected employee or the original record holder.
B. Except as provided in §C of this regulation, without the consent of the affected employee, the Commissioner or the Commissioner's authorized representative may not approve a request for an inter-agency transfer of personally identifiable employee medical information, unless the request is from a public health agency which:
(1) Needs the requested information in a personally identifiable form for a substantial public health purpose;
(2) Will not use the requested information to make individual determinations concerning an affected employee which could be to the employee's detriment;
(3) Has regulations or established written procedures providing protection for personally identifiable medical information substantially equivalent to that of this chapter; and
(4) Satisfies an exemption to the Maryland Public Information Act, State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland, to the extent that the Maryland Public Information Act applies to the requested information.
C. To the extent permitted by State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland, and upon the approval of the Commissioner or the Commissioner's authorized representative, personally identifiable employee medical information may be transferred to the:
(1) National Institute for Occupational Safety and Health (NIOSH); and
(2) When necessary with respect to a specific action under the Act, Office of the Maryland Attorney General, or the State's Attorney for Baltimore City or a Maryland county.
D. The Commissioner may not approve a request for public disclosure of employee medical information containing:
(1) Direct personal identifiers unless there are compelling circumstances affecting the health or safety of an individual; or
(2) Information which could reasonably be used indirectly to identify a specific employee when the disclosure would constitute a clearly unwarranted invasion of personal privacy.
E. Advance Notice.
(1) Except for an interagency transfer under §C of this regulation, when MOSH intends to release personally identifiable employee medical information to another agency or a member of the public other than an affected employee, the medical records officer shall ensure advance notice is provided to:
(a) A collective bargaining agent representing affected employees; and
(b) The employer.
(2) When the employee medical information to be transferred or disclosed contains direct personal identifiers, the medical records officer shall take reasonable steps to ensure that advance notice is provided to affected employees, when feasible.
(3) A release made under this section shall comply with State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland.
