§ 1881. Disclosure of protected health information prohibited
(a) As used in this section:
(1) “Business associate” has the same meaning as in 45 C.F.R. § 160.103.
(2) “Covered entity” has the same meaning as in 45 C.F.R. § 160.103.
(3) “Legally protected health care activity” has the same meaning as in 1 V.S.A. § 150.
(4) “Protected health information” has the same meaning as in 45 C.F.R. § 160.103.
(5) “Telehealth” has the same meaning as in 26 V.S.A. § 3052.
(b) A covered entity or business associate shall not disclose protected health information
unless the disclosure is permitted under the Health Insurance Portability and Accountability
Act of 1996 (HIPAA).
(c)(1) Notwithstanding any provision of subsection (b) of this section to the contrary, in
order to protect patients and providers who engage in legally protected health care
activity and except as set forth in subdivision (2) of this subsection, a covered
entity or business associate shall not disclose protected health information that
is identifiable or susceptible to reidentification and is related to a legally protected
health care activity:
(A) to any government entity other than the State of Vermont or its political subdivisions
or instrumentalities if the covered entity or business associate has reason to believe
that the information will be used:
(i) to conduct a criminal, civil, administrative, or professional disciplinary investigation
into any individual for the mere act of seeking, obtaining, providing, or facilitating
a legally protected health care activity;
(ii) to impose criminal, civil, or administrative liability or professional disciplinary
action on any individual for the mere act of seeking, obtaining, providing, or facilitating
a legally protected health care activity; or
(iii) to identify any individual for any of the activities described in subdivision (i)
or (ii) of this subdivision (A); or
(B) for use in a civil or criminal action; a proceeding preliminary to a civil or criminal
action; or a probate, legislative, or administrative proceeding.
(2) Notwithstanding any provision of subdivision (1) of this subsection to the contrary,
a covered entity or business associate may disclose protected health information that
is identifiable or susceptible to reidentification and is related to a legally protected
health care activity if the disclosure meets one or more of the following conditions:
(A) The disclosure is authorized by the patient or the patient’s conservator, guardian,
or other authorized legal representative.
(B) The disclosure is ordered by a court of competent jurisdiction pursuant to federal
law, Vermont law, or rules adopted by the Vermont Supreme Court. A State court order
compelling disclosure under this subdivision (B) shall include the court’s determination
that the information will not be used to impose criminal, civil, or administrative
liability or professional disciplinary action on any individual based solely on the
fact that the person sought, obtained, provided, or facilitated a legally protected
health care activity.
(C) The disclosure is to be made to a business associate designated by the covered entity
or the covered entity’s business associate and will be used solely in the defense
of the covered entity or the covered entity’s business associate against a claim that
has been made, or there is a reasonable belief will be made, against the covered entity
or the covered entity’s business associate in a civil or criminal action; a proceeding
preliminary to a civil or criminal action; or a probate, legislative, or administrative
proceeding.
(D) The disclosure is to Vermont’s Board of Medical Practice or Office of Professional
Regulation, as applicable, in connection with a bona fide investigation in Vermont
of a licensed, certified, or registered health care provider or a bona fide investigation
of whether an individual who is not licensed, certified, or registered to practice
a health care profession in Vermont engaged in unauthorized practice in this State,
whether in person or through telehealth.
(E) The disclosure is to the Vermont Department of Health or the Vermont Department of
Disabilities, Aging, and Independent Living, or both, in connection with a bona fide
investigation of a licensed health care facility in Vermont.
(F) Subject to the limitations set forth in 12 V.S.A. § 7306, the disclosure is required in the ordinary course of business of Vermont’s Medicaid
program.
(d) A covered entity or business associate shall not be subject to any civil, criminal,
or administrative liability or professional disciplinary action for refusing to disclose
protected health information that is identifiable or susceptible to reidentification
and is related to a legally protected health care activity, in accordance with subsection
(c) of this section. (Added 2015, No. 169 (Adj. Sess.), § 1, eff. Oct. 1, 2016; amended 2023, No. 15, § 14, eff. May 10, 2023; 2025, No. 20, § 6, eff. May 13, 2025.)
§ 1882. Disclosures of protected health information to avert a serious risk of danger
(a) It is the intent of the General Assembly in this section to negate the Vermont Supreme
Court’s decision in Kuligoski v. Brattleboro Retreat and Northeast Kingdom Human Services, 2016 VT 54A, and limit mental health professionals’ duty to that as established in common law
by Peck v. Counseling Service of Addison County, Inc., 146 Vt. 61 (1985).
(b) A mental health professional’s duty is established in common law by Peck v. Counseling Service of Addison County, Inc. and requires that “a mental health professional who knows or, based upon the standards
of the mental health profession, should know that his or her patient poses a serious
risk of danger to an identifiable victim has a duty to exercise reasonable care to
protect him or her from that danger.” This duty shall be applied in accordance with
State and federal privacy and confidentiality laws.
(c) This section does not limit or restrict claims under State or federal law related
to safe patient care, including federal discharge planning regulations within the
Conditions of Participation for hospitals, patient care regulations for other federally
certified facilities, the Emergency Medical Treatment and Active Labor Act of 1986,
Pub. L. No. 99-272, professional licensing standards, or facility licensing standards.
(d) To the extent permitted under federal law, this section does not affect the requirements
for mental health professionals to communicate with individuals involved in a patient’s
care in a manner that is consistent with legal and professional standards, including
section 7103 of this title. (Added 2017, No. 51, § 2, eff. May 30, 2017.)
§ 1883. Disclosure of protected health information required
(a) When a law enforcement officer responds to an alleged crime committed by a patient
at a hospital:
(1) an authorized representative of the hospital shall disclose to the law enforcement
officer the following information before the officer removes the patient from the
hospital:
(A) information that is sufficient to confirm whether the patient is stabilized, has been
evaluated, or is awaiting inpatient care; and
(B) any other information that will be necessary for purposes of safely taking custody
of the patient; and
(2) the law enforcement officer shall not remove the patient from the hospital if an authorized
representative of the hospital informs the officer that the patient is not stabilized,
has not yet been evaluated, or is awaiting inpatient care.
(b) When a law enforcement officer responds to an alleged crime committed by a patient
at a scene where emergency medical treatment was or is being provided:
(1) a member of the emergency medical personnel who provided the treatment shall disclose
to the law enforcement officer the following information before the officer removes
the patient from the emergency medical treatment scene:
(A) information that is sufficient to confirm whether the patient is stabilized, has been
evaluated, or is awaiting transport for health care; and
(B) any other information that will be necessary for purposes of safely taking custody
of the patient; and
(2) the law enforcement officer shall not remove the patient from the emergency medical
treatment scene if a member of the emergency medical personnel who provided the treatment
informs the officer that the patient is not stabilized, has not yet been evaluated,
or is awaiting transport for health care.
(c) As used in this section:
(1) “Emergency medical personnel” has the same meaning as in 24 V.S.A. § 2651(6).
(2) “Emergency medical treatment” has the same meaning as in 24 V.S.A. § 2651(9).
(3) “Hospital” has the same meaning as in subdivision 1902(1) of this title.
(4) “Stabilized” means that no material deterioration of the patient’s medical condition
is likely, within reasonable medical probability, to result from or occur during the
transport of the patient from the hospital or the emergency medical treatment scene. (Added 2023, No. 24, § 3, eff. May 30, 2023.)