101 CMR 22.00 — Requirement to Disclose COVID-19 Test Results to EOHHS

Final Adoption January 8, 2021 (effective October 5, 2020) 101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 22.00: REQUIREMENT TO DISCLOSE COVID-19 TEST RESULTS TO EOHHS

Section

22.01: Applicability 22.02: Purpose 22.03: Definitions 22.04: Requirement to Disclose COVID-19 Test Results to EOHHS 22.05: Use, Disclosure, and Safeguarding of COVID-19 Test Results 22.06: Implementation and Clarification 22.07: Severability

101 CMR 22.00 Requirement to Disclose COVID-19 Test Results to EOHHS

22.01 Applicability

22.01: Applicability

101 CMR 22.00 applies to COVID-19 Testing Vendors.

22.02 Purpose

22.02: Purpose

(1) The purpose of 101 CMR 22.00 is to require COVID-19 Testing Vendors to disclose COVID-19 Test Results to EOHHS to effectively manage and coordinate the health and safety of Agency Staff, Clients, and the Commonwealth.

(2) Nothing in 101 CMR 22.00 is intended to conflict, limit, or prohibit COVID-19 Testing Vendors from disclosing COVID-19 Test Results in any other manner authorized, permitted, or required by federal or state law.

(3) Nothing in 101 CMR 22.00 is intended to conflict, limit, or prohibit the Department of Public Health or any other public health entity from receiving, using, or disclosing COVID-19 information under separate or existing authority.

22.03 Definitions

22.03: Definitions

As used in 101 CMR 22.00, unless the context requires otherwise, terms have the meanings in 101 CMR 22.03.

Agency. The Executive Office of Health and Human Services (EOHHS) or any department, agency, commission, office, board, division, or any other body within EOHHS as set out in M.G.L. c. 6A, § 16, including the Executive Office of Elder Affairs.

Applicable Law. Any other applicable federal or state law or regulation pertaining to the use, disclosure, maintenance, privacy, security, or confidentiality of personally identifiable information.

Business Associate. A term defined in 45 CFR Part 160, § 103.

Covered Entity. An entity as defined in 45 CFR Part 160, § 103.

Final Adoption January 8, 2021 (effective October 5, 2020) 101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 22.00: REQUIREMENT TO DISCLOSE COVID-19 TEST RESULTS TO EOHHS

COVID-19. A contagious, sometimes fatal, respiratory disease caused by a newly discovered coronavirus that led to the declaration of a federal public health emergency and a state of emergency for the Commonwealth of Massachusetts.

COVID-19 Test Result. The result of a collection of a specimen from an individual for the purpose of determining the presence or absence of SARS-CoV-2 viral material in said specimen along with personally identifiable information that identifies the individual. Such result may be subject to HIPAA, FIPA, and/or Applicable Law.

COVID-19 Testing Vendor. A vendor, including a Covered Entity, Business Associate, Holder, or any other entity subject to HIPAA, FIPA, or Applicable Law, that provides COVID-19 Test Results.

FIPA. The Fair Information Practices Act, found at M.G.L. c. 66A, and its attendant regulations at 801 CMR 3.00: Privacy and Confidentiality.

HIPAA. The Health Insurance Portability and Accountability Act of 1996 and its attendant regulations at 45 CFR Parts 160, 162, and 164.

Holder. A term defined in M.G.L. c. 66A, § 1.

22.04 Requirement to Disclose COVID-19 Test Results to EOHHS

22.04: Requirement to Disclose COVID-19 Test Results to EOHHS

Upon the request of EOHHS, COVID-19 Testing Vendors must disclose COVID-19 Test Results to EOHHS. EOHHS may disclose such COVID-19 Test Results to its Agencies.

22.05 Use, Disclosure, and Safeguarding of COVID-19 Test Results

22.05: Use, Disclosure, and Safeguarding of COVID-19 Test Results

EOHHS or its Agencies may use, disclose, and safeguard COVID-19 Test Results pursuant to 101 CMR 16.00: Personal Data Use and Permitted Disclosures By and Among EOHHS and Its Agencies.

22.06 Implementation and Clarification

22.06: Implementation and Clarification

(1) Administrative Bulletins. EOHHS may issue administrative bulletins to clarify substantive provisions of 101 CMR 22.00.

(2) Implementation Guidance. EOHHS may develop policies, guidelines, or memoranda to implement 101 CMR 22.00, and which may include disclosure requirements, manner transmission, or security.

22.07 Severability

22.07: Severability

The provisions of 101 CMR 22.00 are severable. If any provisions of 101 CMR 22.00 or the applications of such provisions to any person or circumstance are held invalid or unconstitutional, the other provisions of 101 CMR 22.00, or the application of such provisions to any person or

Final Adoption January 8, 2021 (effective October 5, 2020) 101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 22.00: REQUIREMENT TO DISCLOSE COVID-19 TEST RESULTS TO EOHHS

circumstance other than that as to which it is held invalid or unconstitutional, will not be affected thereby.

REGULATORY AUTHORITY 101 CMR 22.00: M.G.L. c. 6A, § 16.