Section 657.37.4. Access to database information.

All information contained in the PMP database, including prescription information submitted for inclusion in the PMP database and records of requests for PMP information, shall be privileged and strictly confidential and not subject to public or open records laws. The board, council, and PMP administrator shall maintain procedures to ensure the privacy and confidentiality of patients, prescribers, dispensers, practitioners, practitioners’ agents, and patient information collected, recorded, transmitted, and maintained in the PMP database and to ensure that program information is not disclosed to persons except as provided in this rule.

       37.4(1) Prescribers and pharmacists. A health care practitioner authorized to prescribe or dispense controlled substances may obtain PMP information regarding the practitioner’s patient, or a patient seeking treatment from the practitioner, for the purpose of providing patient health care. A practitioner may authorize no more than three health care professionals to act as the practitioner’s agents for the purpose of requesting PMP information regarding a practitioner’s patients.

        a.           Prior to being granted access to PMP information, a practitioner or a practitioner’s agent shall submit an individual request for registration and program access. A practitioner or a practitioner’s agent with Internet access may register via a secure Web site established by the board for that purpose. A practitioner without Internet access shall submit a written registration request on a form provided by the PMP administrator. A practitioner without Internet access shall not authorize a practitioner’s agent to register for or to access PMP information on behalf of the practitioner. The PMP administrator shall take reasonable steps to verify the identity of a practitioner or practitioner’s agent and to verify a practitioner’s credentials prior to providing a practitioner or practitioner’s agent with a secure login and initial password. Each practitioner or practitioner’s agent registered to access PMP information shall securely maintain and use the login and password assigned to the individual practitioner or practitioner’s agent. Except in an emergency when the patient would be placed in greater jeopardy by restricting PMP information access to the practitioner or practitioner’s agent, a registered practitioner shall not share the practitioner’s secure login and password information and shall not delegate PMP information access to another health care practitioner or to an unregistered agent. A registered practitioner’s agent shall not delegate PMP information access to another individual.

        b.           A practitioner or practitioner’s agent with Internet access may submit a request for PMP information via a secure Web site established by the board for that purpose. The requested information shall be provided to the requesting practitioner or practitioner’s agent in a format established by the board and shall be delivered via the secure Web site.

        c.           A practitioner without Internet access may submit to the PMP administrator a written request for PMP information via mail or facsimile transmission. The written request shall be in a format established by the board and shall be signed by the requesting practitioner. Prior to processing a written request for PMP information, the PMP administrator shall take reasonable steps to verify the request, which may include but not be limited to a telephone call to the practitioner at a telephone number known to be the number for the practitioner’s practice.

        d.           A practitioner or practitioner’s agent who requests and receives PMP information consistent with the requirements and intent of these rules may provide that information to another practitioner who is involved in the care of the patient who is the subject of the information. Information from the PMP database remains privileged and strictly confidential. Such disclosures among practitioners shall be consistent with these rules and federal and state laws regarding the confidentiality of patient information. The information shall be used for medical or pharmaceutical care purposes.

       37.4(2) Regulatory agencies and boards. Professional licensing boards and regulatory agencies that supervise or regulate a health care practitioner or that provide payment for health care services shall be able to access information from the PMP database only pursuant to an order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause.

        a.           A director of a licensing board with jurisdiction over a practitioner, or the director’s designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the director or the director’s designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.

        b.           A director of a regulatory agency with jurisdiction over a practitioner or with jurisdiction over a person receiving health care services pursuant to one or more programs provided by the agency, or the director’s designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the director or the director’s designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.

       37.4(3) Law enforcement agencies. Local, state, and federal law enforcement or prosecutorial officials engaged in the administration, investigation, or enforcement of any state or federal law relating to controlled substances shall be able to access information from the PMP database by order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause. A law enforcement officer shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the requesting officer or the officer’s superior. The request shall be accompanied by an order, subpoena, or warrant issued by a court or legal authority that requires a determination of probable cause and shall be processed by the PMP administrator. A report identifying PMP information relating to the specific individual identified by the order, subpoena, or warrant may be delivered to the law enforcement officer via mail or alternate secure delivery.

       37.4(4) Patients. A patient or the patient’s agent may request and receive PMP information regarding prescriptions reported to have been dispensed to the patient.

        a.           A patient may submit a signed, written request for records of the patient’s prescriptions dispensed during a specified period of time. The request shall identify the patient by name, including any aliases used by the patient, and shall include the patient’s date of birth and gender. The request shall also include any address where the patient resided during the time period of the request and the patient’s current address and daytime telephone number. A patient may personally deliver the request to the PMP administrator or authorized staff member at the offices of the board located at 400 S.W. Eighth Street, Suite E, Des Moines, Iowa 50309-4688. The patient will be required to present current government-issued photo identification at the time of delivery of the request. A copy of the patient’s identification shall be maintained in the records of the PMP.

        b.           A patient who is unable to personally deliver the request to the board offices may submit a request via mail or commercial delivery service. The request shall comply with all provisions of paragraph “a” above, and the signature of the requesting patient shall be witnessed and the patient’s identity shall be attested to by a currently registered notary public. In addition to the notary’s signature and assurance of the patient’s identity, the notary shall certify a copy of the patient’s government-issued photo identification and that certified copy shall be submitted with the written request. The request shall be submitted to the Iowa Board of Pharmacy at the address identified in paragraph “a.”

        c.           In the case of a patient whose health care decisions have been legally transferred to the patient’s agent, the patient’s agent may submit a request on behalf of the patient pursuant to the appropriate procedure in paragraph “a” or “b.” In addition to the patient’s information, the patient’s agent shall be identified by name, current address, and telephone number. In lieu of the patient’s signature and identification, the patient’s agent shall sign the request and the government-issued photo identification shall identify the patient’s agent. The patient’s agent shall include a certified copy of the legal document that transferred control over decisions regarding the patient’s health care to the patient’s agent.

       37.4(5) Court orders and subpoenas. The PMP administrator shall provide PMP information in response to court orders and county attorney or other subpoenas issued by a court upon a determination of probable cause.

       37.4(6) Statistical data. The PMP administrator, following review and approval by the patients rights committee, may provide summary, statistical, or aggregate data to public or private entities for statistical, research, or educational purposes. Prior to the release of any such data, the PMP administrator shall remove any information that could be used to identify an individual patient, prescriber, dispenser, practitioner, or other person who is the subject of the PMP information or data.

       37.4(7) PMP administrator access. Other than technical, error, and administrative function reports and information needed by PMP support staff to determine that records are received and maintained in good order or to review or resolve issues of reported or suspected erroneous data as provided in rule 657—37.7(124), any other reports concerning the information received from dispensers shall only be prepared at the direction of the board, the council, or the PMP administrator. The board and the council may compile statistical reports from PMP information for use in determining the advisability of continuing the PMP and for use in preparing required reports to the governor and the legislature. The reports shall not include information that would identify any patient, prescriber, dispenser, practitioner, practitioner’s agent, or other person who is the subject of the PMP information or data.

[ARC 7903B, IAB 7/1/09, effective 8/5/09; ARC 0056C, IAB 4/4/12, effective 7/1/12]