Ohio Admin. Code 4729:5-3-05 - Confidentiality of patient records

(A) Records relating to the practice of pharmacy, the administration of drugs, or any patient specific drug transaction are not a public record. A person having custody of, or access to, such records shall not divulge the contents thereof, or provide a copy thereof, to anyone except:

(1) The patient, or owner if the patient is an animal, for whom the prescription or medication order was issued.

(2) The prescriber who issued the prescription or medication order, or a subsequent treating prescriber.

(3) Licensed health care personnel who are responsible for the care of the patient.

(4) A member, inspector, agent, or investigator of the state board of pharmacy or any federal, state, county, or municipal officer whose duty is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug.

(5) An agent of an Ohio licensing agency that is responsible for the licensure or registration of a health professional authorized to prescribe drugs as defined in section 4729.01 of the Revised Code when enforcing that agency's chapter of the Revised Code.

(6) A state or federal agency charged with the responsibility of providing medical care (i.e. medicaid, medicare, workers' compensation, etc.) for the patient upon a written request by an authorized representative of the agency requesting such information.

(7) An agent of a medical insurance company who provides prescription insurance coverage to the patient upon authorization and proof of insurance by the patient or proof of payment by the insurance company for those medications whose information is requested.

(8) An agent who contracts with the terminal distributor of dangerous drugs as a "business associate" in accordance with the regulations promulgated by the secretary of the United States department of health and human services pursuant to the federal standards for privacy of individually identifiable health information.

(9) Any person, other than those listed in paragraphs (A)(1) to (A)(8) of this rule, only when the patient has given consent for such disclosure in writing. Any consent must be signed by the patient and dated. Any consent for disclosure is valid until rescinded by the patient.

In an emergency, the terminal distributor of dangerous drugs may disclose the information when, in the professional judgment of the pharmacist or healthcare provider, it is deemed to be in the best interest of the patient. A pharmacist or healthcare provider making an oral disclosure in an emergency situation must prepare a written memorandum showing the patient's name, the date and time the disclosure was made, the nature of the emergency, and the names of the individuals by whom and to whom the information was disclosed.

(B) Testimonial privilege is not waived for any communication between a prescriber, a pharmacist, and a patient pursuant to section 2317.02 of the Revised Code.

(C) Records relating to the practice of pharmacy, the administration of drugs, or any patient specific drug transaction which may be required as evidence of a violation shall be released, upon request, to a member, inspector, agent, or investigator of the state board of pharmacy or any state, county, or municipal officer whose duty is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug. Such person shall furnish a receipt to the person having legal custody of the records. If the record is a prescription, the receipt shall list the following information:

(1) Prescription identification number; or, if an order for medication, the name of the patient;

(2) The drugs prescribed or ordered;

(3) Quantity of drugs prescribed, dispensed, administered or personally furnished;

(4) Name of the prescriber;

(5) Date, name of agency, and signature of person removing the records.

(D) All such records, including consents, memoranda of emergency disclosures, and written requests pursuant to paragraph (A)(9) of this rule, shall be kept on file at the terminal distributor of dangerous drugs for a period of three years in a readily retrievable manner.

(E) All patient records maintained by a terminal distributor of dangerous drugs shall be maintained in accordance with the following:

(1) For human patients, the Health Insurance Portability and Accountability Act of 1996 (HIPAA); and

(2) All state and federal laws, rules, and regulations.

Notes

Ohio Admin. Code 4729:5-3-05

Effective: 7/1/2024
Five Year Review (FYR) Dates: 3/19/2024 and 07/01/2029
Promulgated Under: 119.03
Statutory Authority: 3719.28, 4729.26
Rule Amplifies: 3719.05, 3719.07, 3719.13, 3719.27, 4729.27, 4729.37, 4729.39
Prior Effective Dates: 10/01/1971, 03/19/1987, 03/21/1988, 01/17/1997, 03/01/1999, 02/01/2002, 04/27/2007, 01/01/2009,03/01/2017, 04/01/2018