(a) Identifiable health information is not public information, and may not be disclosed without the written authorization of the individual (or legal representative) who is the subject of the information, except as provided in this act and other controlling law.
(b) Any written authorization shall be dated and shall specify to whom the disclosure is authorized, the general purpose for such disclosure, and the time period in which the authorization for the disclosure is effective.
(1) An individual may revoke a written authorization in writing at any time. The individual is responsible for informing the person who originally received the authorization that it has been revoked.
(2) If the authorization does not contain an expiration date or has not previously been revoked, it automatically expires six months after the date it is signed.
(3) A general authorization for the disclosure of health-related information shall not be construed as written for the disclosure of identifiable health information unless such authorization also complied with this act.
(4) When the individual is not competent or otherwise legally unable to provide written authorization, the written authorization may be provided by the individual’s legal representative. For the purposes of this act, a minor under the age of eighteen years is unable to give written authorization.
(c) Identifiable health information shall be disclosed with the written authorization of the individual who is the subject of the information to any person and for any purpose for which the disclosure is authorized.
(1) Disclosures shall be limited to the minimum amount of information that the person making the disclosure reasonably believes is necessary to accomplish the purpose of the disclosure.
(2) Disclosures shall be accompanied or followed by a statement in writing concerning the department’s disclosure policy, which shall include the following or substantially similar language: “This information has been disclosed to you from confidential public health records protected by American Samoa and federal law. Any further disclosure of this information in an identifiable form may be prohibited without the written authorization of the individual who is the subject of the information or as otherwise permitted by federal or American Samoa law. Unauthorized disclosure of this information may result in significant criminal or civil penalties.”
(d) Disclosures without written authorization. Identifiable health information may be disclosed without the written authorization of the individual who is the subject of the information where such disclosures are made:
(1) Directly to the individual;
(2) To appropriate federal or ASG agencies or authorities as required for authorized by federal or American Samoa law;
(3) To health care personnel to the extent necessary in a medical emergency to protect the health or life of the individual who is the subject of the information from serious, imminent harm;
(4) To report information in a certificate of death, autopsy report, or related documents prepared under applicable laws or regulations; or
(5) To identify a deceased individual or the individual’s manner of death, or provide necessary information about a deceased individual who is a donor or prospective donor of an anatomical gift.
(e) The rights of a deceased individual as provided by this act may be exercised for a period of two years after the date of death by one of the individuals in the following order or priority, subject to any written authorization for another person to act by the decedent:
(1) An executor or administrator of the estate of a deceased individual, or one soon to be appointed in accordance with a will or other legal instrument;
(2) A surviving spouse or domestic partner;
(3) An adult child; or
(4) A parent.
(f) No person to whom identifiable health information has been disclosed shall disclose the information to another person except as authorized by this act or other controlling law. This subsection shall not apply to:
(1) The individual who is the subject of the information;
(2) The individual’s legal representative where the individual is unable to give written authorization; or
(3) Any person who is specifically required by federal or American Samoa law to disclose the information.
(g) The department shall keep written or electronic record of any of its disclosures of identifiable health information authorized by this act. This record shall be treated as identifiable health information for the purposes of this act. This record shall be maintained by the department for a period of ten years, even if the identifiable health information disclosed is no longer in the department’s possession. The record of disclosures shall include the following information:
(1) The name, title, address, and institutional affiliation, if any, of the person whom identifiable health information is disclosed;
(2) The date and purpose of the disclosure;
(3) A brief description of the information disclosed; and
(4) The legal authority for the disclosure.History: 2007, PL 30-11.