When can the owner of the health risk assessment participant information share the information with external parties (e.g., health plans, employers, providers, participants, etc.)?
RESPONSE: Information may only be shared with other external parties in compliance with federal and state laws as well as the terms of the arrangement and the conditions of disclosure authorized by the participants. Information that has been aggregated and/or otherwise de-identified generally will not require participant authorization. Information that includes identifying information should only be shared with participant authorization/agreement.
