Regulations of Connecticut State Agencies
(a) Except as provided by section 21a-408-50 of the Regulations of Connecticut State Agencies, a dispensary facility employee, producer, production facility employee, or any other person associated with a dispensary facility or producer, shall not disclose patient-specific information received and records kept pursuant to sections 21a-408-1 to 21a-408-70, inclusive, of the Regulations of Connecticut State Agencies, except that such person shall disclose patient treatment or dispensing information to:
(1) The department or state and local law enforcement for purposes of investigating and enforcing the Act or sections 21a-408-1 to 21a-408-70, inclusive, of the Regulations of Connecticut State Agencies;
(2) Physicians, pharmacists or other dispensaries for the purpose of providing patient care and drug therapy management and monitoring controlled substances obtained by the qualifying patient;
(3) A qualifying patient but only with respect to information related to such patient;
(4) A primary caregiver, but only with respect to the qualifying patient of such primary caregiver;
(5) Third party payors who pay claims for dispensary services rendered to a qualifying patient or who have a formal agreement or contract to audit any records or information in connection with such claims;
(6) Any person, the state or federal government or any agency thereof pursuant to an order of a court of competent jurisdiction or pursuant to a search warrant; and
(7) Any person upon the express written consent of the patient and only with respect to information related to such patient. Such written consent shall clearly identify the specific person and purpose for which consent is being granted, but in no event shall such information be disclosed to an electronic data intermediary.
(b) An electronic data intermediary shall not have access to any data involving marijuana, qualifying patients, primary caregivers or other data from a dispensary facility or an agent of the dispensary facility.
(c) No electronic equipment utilized by a dispensary department shall collect patient-specific data for use outside the dispensary department, except that such data shall be disclosed to the commissioner or the commissioner’s authorized representative for purposes of an inspection or investigation.
(Effective September 6, 2013)