<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".04" citation="COMAR 09.12.22.04" title_num="09" subtitle_num="12" chapter_num="22" heading="Responsible Individuals.">
  <paragraph num="A.">
    <text>The Commissioner or the Commissioner's authorized representative is responsible for the overall administration and implementation of the procedures contained in this chapter, including making a final determination concerning:</text>
    <paragraph num="(1)">
      <text>Access to personally identifiable employee medical information; and</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Interagency transfer or public disclosure of personally identifiable employee medical information.</text>
    </paragraph>
  </paragraph>
  <paragraph num="B.">
    <text>Medical Records Officer.</text>
    <paragraph num="(1)">
      <text>The Commissioner or the Commissioner's authorized representative shall designate a medical records officer with experience or training in the evaluation, use, and privacy protection of medical records.</text>
    </paragraph>
    <paragraph num="(2)">
      <text>The medical records officer shall:</text>
      <paragraph num="(a)">
        <text>Report directly to the Commissioner or the Commissioner's authorized representative on matters concerning this chapter; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Be responsible for:</text>
        <paragraph num="(i)">
          <text>Making a recommendation to the Commissioner or the Commissioner's authorized representative regarding the approval or denial of a written access order,</text>
        </paragraph>
        <paragraph num="(ii)">
          <text>Assuring that a written access order meets the requirements of Regulation .05B and C of this chapter,</text>
        </paragraph>
        <paragraph num="(iii)">
          <text>Responding to an objection from an employee, collective bargaining agent, or employer concerning a written access order,</text>
        </paragraph>
        <paragraph num="(iv)">
          <text>Regulating the use of direct personal identifiers,</text>
        </paragraph>
        <paragraph num="(v)">
          <text>Regulating internal agency use and security of personally identifiable employee medical information,</text>
        </paragraph>
        <paragraph num="(vi)">
          <text>Assuring that the results of an analysis of personally identifiable medical information are, when appropriate, communicated to employees,</text>
        </paragraph>
        <paragraph num="(vii)">
          <text>Preparing an annual report of experience under Regulation .10 of this chapter, and</text>
        </paragraph>
        <paragraph num="(viii)">
          <text>Assuring that advance notice is given of intended interagency transfer or public disclosure of personally identifiable employee medical information.</text>
        </paragraph>
      </paragraph>
    </paragraph>
  </paragraph>
  <paragraph num="C.">
    <text>Principal Investigator.</text>
    <paragraph num="(1)">
      <text>The principal investigator is the MOSH representative who, in each instance of access to personally identifiable employee medical information, is made primarily responsible for assuring that the examination and use of the information is performed in the manner prescribed by:</text>
      <paragraph num="(a)">
        <text>A written access order; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>The requirements of this chapter.</text>
      </paragraph>
    </paragraph>
    <paragraph num="(2)">
      <text>When access is under a written access order, the principal investigator shall be professionally trained in medicine, public health, or allied fields such as epidemiology, toxicology, industrial hygiene, biostatistics, or environmental health.</text>
    </paragraph>
  </paragraph>
</regulation>