§ 4284. Protection and disclosure of information
(a) The data collected pursuant to this chapter and all related information and records
shall be confidential, except as provided in this chapter, and shall not be subject
to the Public Records Act. The Department shall maintain procedures to protect patient
privacy; ensure the confidentiality of patient information collected, recorded, transmitted,
and maintained; and ensure that information is not disclosed to any person except
as provided in this section.
(b)(1) The Department shall provide only the following persons with access to query the VPMS:
(A) a health care provider, dispenser, or delegate who is registered with the VPMS and
certifies that the requested information is for the purpose of providing medical or
pharmaceutical treatment to a bona fide current patient;
(B) personnel or contractors, as necessary for establishing and maintaining the VPMS;
(C) the Medical Director of the Department of Vermont Health Access and the Director’s
designee, for the purposes of Medicaid quality assurance, utilization, and federal
monitoring requirements with respect to Medicaid recipients for whom a Medicaid claim
for a Schedule II, III, or IV controlled substance has been submitted;
(D) a medical examiner or delegate from the Office of the Chief Medical Examiner, for
the purpose of conducting an investigation or inquiry into the cause, manner, and
circumstances of an individual’s death; and
(E) a health care provider or medical examiner licensed to practice in another state,
to the extent necessary to provide appropriate medical care to a Vermont resident
or to investigate the death of a Vermont resident.
(2) The Department shall provide reports of data available to the Department through the
VPMS only to the following persons:
(A) A patient or that person’s health care provider, or both, when VPMS reveals that a
patient may be receiving more than a therapeutic amount of one or more controlled
substances.
(B) A designated representative of a board responsible for the licensure, regulation,
or discipline of health care providers or dispensers pursuant to a bona fide specific
investigation.
(C) A patient for whom a prescription is written, insofar as the information relates to
that patient.
(D) The relevant occupational licensing or certification authority if the Commissioner
reasonably suspects fraudulent or illegal activity by a health care provider. The
licensing or certification authority may report the data that are the evidence for
the suspected fraudulent or illegal activity to a drug diversion investigator.
(E)(i) The Commissioner of Public Safety, personally, or the Deputy Commissioner of Public
Safety, personally, if the Commissioner of Health, personally, or a Deputy Commissioner
of Health, personally, makes the disclosure and has consulted with at least one of
the patient’s health care providers, when the disclosure is necessary to avert a serious
and imminent threat to a person or the public.
(ii) The Commissioner of Public Safety, personally, or the Deputy Commissioner of Public
Safety, personally, when he or she requests data from the Commissioner of Health,
and the Commissioner of Health believes, after consultation with at least one of the
patient’s health care providers, that disclosure is necessary to avert a serious and
imminent threat to a person or the public.
(iii) The Commissioner or Deputy Commissioner of Public Safety may disclose such data received
pursuant to this subdivision (E) as is necessary, in his or her discretion, to avert
the serious and imminent threat.
(F) A prescription monitoring system or similar entity in another state pursuant to a
reciprocal agreement to share prescription monitoring information with the Vermont
Department of Health as described in section 4288 of this title.
(G) The Commissioner of Health or the Commissioner’s designee in order to identify patients
who filled prescriptions written pursuant to chapter 113 of this title.
(c) A person who receives data or a report from VPMS or from the Department shall not
share that data or report with any other person or entity not eligible to receive
that data pursuant to subsection (b) of this section, except as necessary and consistent
with the purpose of the disclosure and in the normal course of business. Nothing shall
restrict the right of a patient to share his or her own data.
(d) The Commissioner shall offer health care providers and dispensers training in the
proper use of information they may receive from VPMS. Training may be provided in
collaboration with professional associations representing health care providers and
dispensers.
(e) A drug diversion investigator who may receive information pursuant to this section
shall not have access to VPMS except for information provided to the officer by the
licensing or certification authority.
(f) The Department is authorized to use information from VPMS for research, trend analysis,
and other public health promotion purposes, provided that data are aggregated or otherwise
de-identified. The Department shall post the results of trend analyses on its website
for use by health care providers, dispensers, and the general public. When appropriate,
the Department shall send alerts relating to identified trends to health care providers
and dispensers by electronic mail.
(g) Following consultation with the Vermont Prescription Drug Advisory Council and an
opportunity for input from stakeholders, the Department shall develop a policy that
will enable it to use information from VPMS to determine if individual prescribers
and dispensers are using VPMS appropriately.
(h) Following consultation with the Vermont Prescription Drug Advisory Council and an
opportunity for input from stakeholders, the Department shall develop a policy that
will enable it to evaluate the prescription of regulated drugs by prescribers.
(i) Knowing disclosure of transmitted data to a person not authorized by subsection (b)
of this section, or obtaining information under this section not relating to a bona
fide specific investigation, shall be punishable by imprisonment for not more than
one year or a fine of not more than $1,000.00, or both, in addition to any penalties
under federal law.
(j) All information and correspondence relating to the disclosure of information by the
Commissioner to a patient’s health care provider pursuant to subdivision (b)(2)(A)
of this section shall be confidential and privileged, exempt from public inspection
and copying under the Public Records Act, immune from subpoena or other disclosure,
and not subject to discovery or introduction into evidence.
(k) Each request for disclosure of data pursuant to subdivision (b)(2)(B) of this section
shall document a bona fide specific investigation and shall specify the case number
of the investigation. (Added 2005, No. 205 (Adj. Sess.), § 1; amended 2013, No. 75, § 8, eff. Oct. 1, 2013; 2015, No. 27, § 3, eff. May 20, 2015; 2015, No. 173 (Adj. Sess.), § 1; 2019, No. 82, § 7; 2023, No. 6, § 148, eff. July 1, 2023; 2023, No. 51, § 3, eff. July 1, 2023.)