13 NCAC 07A .0903         SECURITY PROCEDURES; RETENTION AND DESTRUCTION OF RECORDS

(a)  All medical information obtained pursuant to an investigation that contains direct personal identifiers shall be separated from the rest of the investigation file and coded with a unique identifying number for each employee.  The medical information with its numerical code shall thereafter be secured in a locked cabinet or vault.

(b)  The photocopying or other duplication of personally identifiable medical information shall be limited to what is necessary to accomplish the purposes for which the information was obtained.

(c)  The protective measures established by the rules in this Section apply to all worksheets, duplicate copies, or other documents containing personally identifiable medical information.

(d)  Transfers of personally identifiable medical information shall be by hand delivery, certified mail, or other equally protective means.

(e)  In accordance with the Department records retention schedule, personally identifiable medical information and lists of coded direct personal identifiers shall be destroyed or returned to the original record holder when no longer needed for the purposes for which they were obtained or when the case file is closed.

History Note:        Authority G.S. 95-133;

Eff. March 1, 2010;

Pursuant to G.S. 150B-21.3A rule is necessary without substantive public interest Eff. March 1, 2016.