Current through Register Vol. 51, No. 19, September 20, 2024
A. Except when required by law or when
approved by the Commissioner, personally identifiable employee medical
information may not be:
(1) Transferred to an
agency or office other than MOSH, except to an assistant attorney general
assigned to MOSH; or
(2) Disclosed
to the public, other than to the affected employee or the original record
holder.
B. Except as
provided in §C of this regulation, without the consent of the affected
employee, the Commissioner or the Commissioner's authorized representative may
not approve a request for an inter-agency transfer of personally identifiable
employee medical information, unless the request is from a public health agency
which:
(1) Needs the requested information in
a personally identifiable form for a substantial public health
purpose;
(2) Will not use the
requested information to make individual determinations concerning an affected
employee which could be to the employee's detriment;
(3) Has regulations or established written
procedures providing protection for personally identifiable medical information
substantially equivalent to that of this chapter; and
(4) Satisfies an exemption to the Maryland
Public Information Act, State Government Article, Title 10, Subtitle 6,
Annotated Code of Maryland, to the extent that the Maryland Public Information
Act applies to the requested information.
C. To the extent permitted by State
Government Article, Title 10, Subtitle 6, Annotated Code of Maryland, and upon
the approval of the Commissioner or the Commissioner's authorized
representative, personally identifiable employee medical information may be
transferred to the:
(1) National Institute
for Occupational Safety and Health (NIOSH); and
(2) When necessary with respect to a specific
action under the Act, Office of the Maryland Attorney General, or the State's
Attorney for Baltimore City or a Maryland county.
D. The Commissioner may not approve a request
for public disclosure of employee medical information containing:
(1) Direct personal identifiers unless there
are compelling circumstances affecting the health or safety of an individual;
or
(2) Information which could
reasonably be used indirectly to identify a specific employee when the
disclosure would constitute a clearly unwarranted invasion of personal
privacy.
E. Advance
Notice.
(1) Except for an interagency
transfer under §C of this regulation, when MOSH intends to release
personally identifiable employee medical information to another agency or a
member of the public other than an affected employee, the medical records
officer shall ensure advance notice is provided to:
(a) A collective bargaining agent
representing affected employees; and
(b) The employer.
(2) When the employee medical information to
be transferred or disclosed contains direct personal identifiers, the medical
records officer shall take reasonable steps to ensure that advance notice is
provided to affected employees, when feasible.
(3) A release made under this section shall
comply with State Government Article, Title 10, Subtitle 6, Annotated Code of
Maryland.
