Confidentiality; exceptions, A.R.S. § 36-664

Confidentiality; exceptions

A health care provider or other person who obtains communicable disease information in the course of providing health care services, or obtains that information from a health care provider must not disclose the information or be compelled to disclose the information except under the following circumstances:

• To the protected person or that person’s health care decision maker if that person lacks the mental capacity to consent;
• To the Department of Health or local public health department in order to notify a “good Samaritan” as explained further below;
• To an agent or employee of a health care facility or health care provider to provide health care services to the protected person or the person’s child, or for purposes of billing or reimbursement;
• To a health care facility or health care provider for procurement, processing, distribution, or use of human body or parts for medical education, research, therapy, or transplantation; 
• To a  health care facility or provider or other organization involved in the review of professional practices, including the quality, necessity, utilization of care, or a peer review organization or group;
• To a private entity that accredits a health care facility or provider and with whom the provider has an agreement to protect the confidentiality of health care information;
• To a federal, state, county or local health officer if disclosure is required by federal or state law;
• To a federal, state or local government agency authorized to receive such information, and is authorized to redisclose the information only based on relevant law; 
• To an authorized employee or agent of a federal, state or local government agency  that supervises or monitors the health care provider or facility or administers a relevant health care program;
• To a person, health care provider or facility  as ordered by  court order;
• To an industrial commission or parties to such  claim;
• Insurance entities and third party payors;
• To any person authorized by the protected person;
• To any person entity authorized by federal law;
• The legal representative of the person or entity holding the information;
• To a person or entity conducting research pursuant to federal and state laws governing research;
• To a person or entity with whom the provider or health care facility has a business associate agreement under HIPAA.

The Department of Economic Security may request and have disclosed communicable disease information, including HIV information, relevant to an adoption, child placement or pursuant to a court ordered arrangement. 

A state, county or local health official may disclose communicable disease information if the disclosure is any of the following:

• Specifically required or authorized pursuant to state or federal law;
• Made pursuant to an authorization signed by the protected person or person’s representative;
• Made to a contact of the protected person, as long as it does not identify the patient;
• Made for research purposes in accordance with state and federal law.

The director of the Department may authorize the disclosure of identifying information to the national center on health statistics in order to conduct a search of the national death index. 

A good Samaritan who requests information on communicable disease information may receive that information from the Department, pursuant to a request that includes the nature of the accident or emergency and the nature of the significant exposure risk.  The Department must adopt rules that ensure that the name of the protected person is not disclosed to the good Samaritan and that the good Samaritan is made aware of the confidentiality requirements of state law. 

The patient or the patient’s representative must sign a written authorization before communicable disease information is disclosed.  The authorization must be signed, dated, include to whom disclosure is authorized, the purpose of the disclosure, and the time period it is valid for.  An authorization for general medical information or communicable disease information cannot be used for disclosure of HIV information, which requires its own authorization.  A person to whom communicable disease information is disclosed must not redislose the information.  This law does not prohibit the listing of the communicable disease or HIV in a death certificate, autopsy report, or other document to display the cause of death. 

If a person holding HIV related information reasonably believes a third party is at risk of HIV, the person may report that risk to the Department.  The report must be in writing and include the name and address of the identifiable third party and the name and address of the person writing the report.  The Department must contact the person at risk in accordance with the Department’s rules. Except as provided in this law or pursuant to a search warrant, a person who comes across HIV related information in the course of providing a health care service may not disclose this information to another person or be compelled by a subpoena, court order, or other judicial instrument.