Sec. 10.10.11.13. BAR Information Confidentiality and Release of BAR Information

A. Except as otherwise provided in this chapter, a person shall keep information prepared for or maintained in the BAR, including biological agent incident response plans required by Regulation .12 of this chapter:

(1) Confidential; and

(2) Protected from unauthorized access and use.

B. BAR information is not subject to State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland.

C. Release or sharing of BAR information as authorized in this chapter does not render the BAR information released or shared a public record.

D. Except as provided in §§G-I of this regulation, a person to whom BAR information has been released may not release the information to another person unless the release is approved by the BAR Program.

E. The BAR Program may release BAR information only to:

(1) State and federal law enforcement agencies;

(2) CDC;

(3) BAR information custodians of trusted partners;

(4) The Secretary or designee; and

(5) The health officer of any affected jurisdiction.

F. Before the BAR Program releases BAR information to a person, except State and federal law enforcement agencies, the CDC, and the Department, the person shall:

(1) Enter into and maintain a trusted partner agreement;

(2) Conduct a BAR information security self-assessment; and

(3) Submit the results of a BAR information security self-assessment to the BAR Program for approval.

G. Mutual Aid Response. When multiple local jurisdictions respond to an emergency or biological agent incident, the Emergency Management Director of one responding jurisdiction may share BAR information with an Emergency Management Director from another local jurisdiction, and the health officer of one jurisdiction may share BAR information with the health officer of another jurisdiction that is providing mutual aid by assisting with the emergency response.

H. Emergency Release Activation Process.

(1) A trusted partner may release on an emergency basis BAR information about the nature and location of a biological agent to another trusted partner or emergency public safety personnel when:

(a) An on-site alarm goes off at a person's facility where a biological agent is located and an individual at the site is required to place a telephone call to a 9-1-1 center;

(b) A 9-1-1 center dispatches emergency public safety personnel to a site where a biological agent is known to be located; or

(c) There is a reported breach of containment or imminent threat of a breach of containment of a biological agent that poses an immediate threat to the health and safety of the public or emergency public safety first responders.

(2) MIEMSS may release on an emergency basis the nature and location of a biological agent to a:

(a) Police officer, as defined in Public Safety Article, §3-201(e), Annotated Code of Maryland, who is responding to an emergency; and

(b) Fire, rescue, or emergency medical services entity, as defined in Public Safety Article, §7-101, Annotated Code of Maryland, when responding to an emergency.

I. 24/7 Access to BAR Information.

(1) MDE, MEMA, and MIEMSS may act as a back-up to the BAR Program by maintaining:

(a) 24/7 (24 hours a day, 7 days a week) access to BAR information; and

(b) Access to BAR information when a trusted partner does not have access to BAR information.

(2) MDE, MEMA, or MIEMSS may release BAR information regarding the nature and location of a biological agent to each other or another BAR Program trusted partner if the trusted partner is unable to obtain access to BAR information.

J. Emergency Release of Name or Identity of a Biological Agent. MDE, MEMA, or MIEMSS may release by any necessary means of communication the name or identity of the specific biological agent located at the site of an emergency response to protect the health and safety of the public and emergency response personnel if:

(1) There is:

(a) A breach in containment of a biological agent;

(b) An imminent threat of a breach of containment; or

(c) An exposure or potential exposure;

(2) The breach or imminent threat of a breach, exposure, or potential exposure is confirmed by the:

(a) Responsible official; or

(b) Emergency public safety personnel at the scene of the emergency response;

(c) Occupational Health; and

(3) The release is approved by the Department's physician on-call.

K. Departmental Authorization to Release Name or Identity of Biological Agent.

(1) The Department's physician on-call may release the name or identity of a biological agent as required to mitigate the risk and treat those exposed based on the potential threat to the health and safety of the public.

(2) The Department's physician on-call shall decide when, how, and to whom to release the name or identity of the biological agent.

L. Notification Protocol.

(1) When there is a breach or imminent threat of a breach in containment of a biological agent, exposure, or potential exposure as described in §J of this regulation, the:

(a) Responsible official or other designated person shall immediately notify the Emergency Management Director and health officer of any affected jurisdiction;

(b) Public safety personnel responding to an emergency shall contact the public safety personnel's 9-1-1 center; and

(c) 9-1-1 center personnel shall notify MIEMSS and each of the following individuals in the jurisdiction where the breach, exposure, or potential exposure occurred:

(i) The Emergency Management Director; and

(ii) The health officer.

(2) When MIEMSS receives notice of a breach or an imminent threat of a breach of containment of a biological agent, exposure, or potential exposure, MIEMSS shall notify:

(a) The Department's:

(i) Physician on-call; and

(ii) BAR Program within the Office of Laboratory Emergency Preparedness and Response;

(b) MDE;

(c) MEMA;and

(d) The health officer of any affected jurisdiction.

(3) Immediately after the health officer is notified by 9-1-1 center personnel, the health officer shall contact the Department’s physician on-call to:

(a) Verify the BAR information release; and

(b) Confirm a plan of action regarding:

(i) Release of BAR information; and

(ii) Measures to be taken to protect the health and safety of the public.

M. Using a form provided by the BAR Program, a trusted partner shall notify the BAR Program within 72 hours after the:

(1) Trusted partner's BAR information custodian releases or shares BAR information; or

(2) Trusted partner releases or shares BAR information with another trusted partner.