[§323C-39] Disclosure for civil or administrative law enforcement purposes. (a) For the purposes of this [section] only, "entity" means a health care provider, health plan, health oversight agency, employer, insurer, and educational institution.

(b) Except as to disclosures to a health oversight agency, which are governed by section 323C-35, an entity or person who receives protected health information pursuant to sections 323C-23 and 323C-31 through 323C-37, may disclose protected health information under this section, if the disclosure is pursuant to:

(c) A subpoena or summons for a disclosure under subsection (b)(1) shall only be issued if the civil or administrative law enforcement agency involved shows that there is probable cause to believe that the information is relevant to a legitimate law enforcement inquiry.

(d) When the matter or need for which protected health information was disclosed to a civil or administrative law enforcement agency under subsection (b) has concluded, including any derivative matters arising from the matter or need, the civil or administrative law enforcement agency shall either destroy the protected health information, or return all of the protected health information to the person from whom it was obtained.

(e) To the extent practicable, and consistent with the requirements of due process, a civil or administrative law enforcement agency shall redact personally identifying information from protected health information prior to the public disclosure of the protected information in a judicial or administrative proceeding.

(f) Protected health information obtained by a civil or administrative law enforcement agency pursuant to this section may only be used for purposes of a legitimate law enforcement activity.

(g) If protected health information is obtained without meeting the requirements of subsection (b)(1), (2), or (3), any information that is unlawfully obtained shall be excluded from court proceedings unless the defendant requests otherwise. [L 1999, c 87, pt of §2]