Ohio Administrative Code|Rule 4729:5-3-05 | Confidentiality of patient records.

                                                
(A) Records relating to the practice of
		  pharmacy, the administration of drugs, or any patient specific drug transaction
		  are not a public record. A person having custody of, or access to, such records
		  shall not divulge the contents thereof, or provide a copy thereof, to anyone
		  except:
(1) The patient, or owner
			 if the patient is an animal, for whom the prescription or medication order was
			 issued.
(2) The prescriber who
			 issued the prescription or medication order, or a subsequent treating
			 prescriber.
(3) Licensed health care
			 personnel who are responsible for the care of the patient.
(4) A member, inspector,
			 agent, or investigator of the state board of pharmacy or any federal, state,
			 county, or municipal officer whose duty is to enforce the laws of this state or
			 the United States relating to drugs and who is engaged in a specific
			 investigation involving a designated person or drug.
(5) An agent of an Ohio
			 licensing agency that is responsible for the licensure or registration of a
			 health professional authorized to prescribe drugs as defined in section 4729.01
			 of the Revised Code when enforcing that agency's chapter of the Revised
			 Code.
(6) A state or federal
			 agency charged with the responsibility of providing medical care (i.e.
			 medicaid, medicare, workers' compensation, etc.) for the patient upon a
			 written request by an authorized representative of the agency requesting such
			 information.
(7) An agent of a medical
			 insurance company who provides prescription insurance coverage to the patient
			 upon authorization and proof of insurance by the patient or proof of payment by
			 the insurance company for those medications whose information is
			 requested.
(8) An agent who
			 contracts with the terminal distributor of dangerous drugs as a "business
			 associate" in accordance with the regulations promulgated by the secretary
			 of the United States department of health and human services pursuant to the
			 federal standards for privacy of individually identifiable health
			 information.
(9) Any person, other
			 than those listed in paragraphs (A)(1) to (A)(8) of this rule, only when the
			 patient has given consent for such disclosure in writing. Any consent must be
			 signed by the patient and dated. Any consent for disclosure is valid until
			 rescinded by the patient.
In an emergency, the terminal distributor of dangerous drugs may
			 disclose the information when, in the professional judgment of the pharmacist
			 or healthcare provider, it is deemed to be in the best interest of the patient.
			 A pharmacist or healthcare provider making an oral disclosure in an emergency
			 situation must prepare a written memorandum showing the patient's name,
			 the date and time the disclosure was made, the nature of the emergency, and the
			 names of the individuals by whom and to whom the information was
			 disclosed.
(B) Testimonial privilege is not waived
		  for any communication between a prescriber, a pharmacist, and a patient
		  pursuant to section 2317.02 of the Revised Code.
(C) Records relating to the practice of
		  pharmacy, the administration of drugs, or any patient specific drug transaction
		  which may be required as evidence of a violation shall be released, upon
		  request, to a member, inspector, agent, or investigator of the state board of
		  pharmacy or any state, county, or municipal officer whose duty is to enforce
		  the laws of this state or the United States relating to drugs and who is
		  engaged in a specific investigation involving a designated person or drug. Such
		  person shall furnish a receipt to the person having legal custody of the
		  records. If the record is a prescription, the receipt shall list the following
		  information:
(1) Prescription
			 identification number; or, if an order for medication, the name of the
			 patient;
(2) The drugs prescribed
			 or ordered;
(3) Quantity of drugs
			 prescribed, dispensed, administered or personally furnished;
(4) Name of the
			 prescriber;
(5) Date, name of agency,
			 and signature of person removing the records.
(D) All such records, including consents,
		  memoranda of emergency disclosures, and written requests pursuant to paragraph
		  (A)(9) of this rule, shall be kept on file at the terminal distributor of
		  dangerous drugs for a period of three years in a readily retrievable
		  manner.
(E) All patient records maintained by a
		  terminal distributor of dangerous drugs shall be maintained in accordance with
		  the following:
(1) For human patients,
			 the Health Insurance Portability and Accountability Act of 1996 (HIPAA);
			 and
(2) All state and federal
			 laws, rules and regulations.