Opinion ID: 787339
Heading Depth: 3
Heading Rank: 2

Heading: Release of Ultrasound Prints to APEX Employees

Text: 88 Ariz.Rev.Stat. § 36-2301.02(B), (C) requires licensees to submit ultrasound prints with patient identifying information on them to a private contractor, APEX, for review. DHS maintains that it intends to implement an anonymous coding system to eliminate the identifying information, but no binding policy exists yet in this regard. 89 The Scope of Work Solicitation describing APEX's contractual duties to DHS is alarmingly brief and lacking in safeguards to protect patients' private information. It requires APEX to store the prints for seven years, but only mandates even minimally secure storage for the first two years: The storage will be secure, for at least two years that shall be in the Apex offices where there is always a person on duty. After the first two years the prints may be stored off-site. No contractual terms limit the access of APEX employees, and there is no mandate that APEX employees with access be screened or trained in confidentiality procedures. Thus, a host of private APEX employees may presumably access the ultra-sound prints. 90 An analysis of section 36-2301.02(B), (C) under the five factors relevant to informational privacy burdens demonstrates that these statutory provisions violate informational privacy rights as well. The type of information requested is obviously very sensitive, and the potential for harm in any subsequent non-consensual disclosure is tremendous. However, the safeguards to prevent unauthorized disclosure are limited to a single provision, which simply states that [p]ersonally identifiable patient information shall not be released by the department or its contractor, and as explained above, the contract between APEX and DHS does not demonstrate that there are any more adequate and specific safeguards. While the need for access is high if the State is to stringently enforce the express statutory mandate that ultrasounds be taken after twelve weeks, the need for ultrasound prints to be trackable to the patient level is hard to fathom. Moreover, there is clearly no need for all APEX employees to have this sort of access in order to enforce the ultrasound requirement. 91 Because an assessment of these five factors indicates that section 36-2301.02(B), (C) violates patients' information privacy rights and is unconstitutional, we affirm the district court's grant of summary judgment to plaintiffs on this claim. 92