(a) A provider, health care institution, health information exchange or health care group purchaser shall not use or disclose health care information in an individual's electronic health record to another person in violation of territorial or federal law and without the consent of the individual.
(b) A provider, health care institution or health care group purchaser may disclose demographic information and information about the location of an individual's electronic health records to a record locator service in accordance with territorial or federal law. A provider or health care institution participating in a health information exchange using a record locator service shall not have access to demographic information, information about the location of the individual's electronic health records or information in an individual's electronic health record except in connection with the treatment of the individual or as permitted by the consent of the individual or as otherwise permitted by territorial or federal law.
(c) A health information exchange maintaining a record locator service shall maintain an audit log of persons obtaining access to information in the record locator service, which audit log shall contain, at a minimum, information on:
(1) the identity of the person obtaining access to the information;
(2) the identity of the individual whose information was obtained;
(3) the location from which the information was obtained;
(4) the specific information obtained; and
(5) the date that the information was obtained.
(d) The audit log shall be made available by a health information exchange on the request of an individual whose health care information is the subject of the audit log; provided, however, that the audit log made available to the individual shall include only information related to that individual. The audit log shall be made available to the requesting individual annually for a reasonable fee as established by the V.I. Department of Health for access to health records for any purpose an individual wishes to receive the audit log information records.
(e) A person operating a record locator service or a health information exchange shall provide a mechanism under which individuals may exclude their demographic information and information about the location of their electronic health records from the record locator service. A person operating a record locator service or a health information exchange that receives an individual's request to exclude all of the individual's information from the record locator service is responsible for removing that information from the record locator service within thirty days; provided, however, that the request to exclude information shall not apply to a provider, a group of providers, a health care institution or an organization of providers that has provided health care to the individual and retains information about that health care. An individual's request for exclusion of information shall be in writing and shall include a waiver of liability for any harm caused by the exclusion of the individual's information.
(f) when information in an individual's electronic health record is requested using a record locator service or a health information exchange:
(1) the requesting provider or health care institution shall warrant that the request is for the treatment of the individual, is permitted by the individual's written authorization or is otherwise permitted by territorial or federal law; and
(2) the person disclosing the information may rely upon the warranty of the person making the request that the request is for the treatment of the individual, is permitted with the consent of the individual or is otherwise permitted by territorial or federal law.
(g) Notwithstanding any other provision of law, information in an individual's electronic health record may be disclosed to a provider that has a need for information about the individual to treat a condition that poses an immediate threat to the life of the individual and that requires immediate health attention.
(h) Notwithstanding any other provision of law, information in an individual's electronic health record may be disclosed to a person that uses non-patient-specific information to maintain or improve the health of the general public or to conduct research that has been sanctioned by a legally authorized health review board; provided, however, that the information disclosed does not include any data that could serve to identify specifically an individual patient and provided further that any individual whose data is disclosed for these purposes has provided written authorization for its use or is otherwise permitted by territorial or federal law.