(1) All records made or received by the
Commission shall be public records and shall be available for disclosure on
request pursuant to 935 CMR 501.820, and
950 CMR
32.00: Public Records Access, except
the following, which shall be exempt from disclosure to the extent permitted by
law:
(a) All records exempt from disclosure
pursuant to M.G.L. c. 4, § 7, cl. 26;
(b) All records to the extent that they
contain "personal data" pursuant to M.G.L. c. 66, § 1;
(c) All records to the extent that they
contain "personal information" pursuant to M.G.L. c. 93H, § 1;
(d) All records which contain CORI as defined
by
803 CMR 2.02:
Definitions;
(e)
All records which contain CHRI as defined by
803 CMR 7.02:
Definitions; and
(f) All Confidential Records as defined in
935 CMR
501.002.
(2) The Commission shall maintain the
confidentiality of all medical records including, but not limited to:
(a) All Confidential Records and information
contained in the Confidential Database, including applicants for registration
as a Qualifying Patient, Personal Caregiver, Institutional Caregiver,
Certifying Healthcare Provider, Card Holder; or Registered Qualifying Patients,
Personal Caregivers, Institutional Caregivers, Certifying Healthcare Providers,
Card Holders; and
(b) Other
identifying patient information.
(3) All records protected from disclosure
under 935 CMR 501.820(1) or pursuant to the laws of an Other Jurisdiction may
be disclosed by the Commission:
(a) If
disclosure is required pursuant to a state or federal law;
(b) To the individual or the individual's
authorized representative, if the individual executes a written release in a
form and manner determined by the Commission;
(c) To the Commission staff for the purpose
of carrying out their official duties;
(d) To the Commission Delegee(s) as
authorized by the Commission;
(e)
To other government officials and agencies acting within their lawful
jurisdiction, which includes, but is not limited to:
1. Law enforcement personnel for the sole
purpose of verifying a cardholder's registration and certification;
and
2. The Board of Registration in
Medicine when necessary in connection with referrals to said Board concerning
violations of
935 CMR
501.000.
(f) To a healthcare professional who has a
Bona Fide Healthcare Professional Patient Relationship with
the Qualifying Patient to facilitate dispensing of Medical-use Marijuana;
(g) To an MTC or any state agency
to facilitate dispensing of medical-use Marijuana;
(h) To the Commission staff if required in
the course of an administrative or a judicial proceeding; or
(i) If an individual or entity obtains an
order from a court of competent jurisdiction.
(4) Nothing in 935 CMR 501.820 shall prevent
the Commission from acting in accordance with its authority.