SENATE BILL No. 1245

 

 

November 29, 2018, Introduced by Senator SHIRKEY and referred to the Committee on Michigan Competitiveness.

 

 

 

     A bill to provide for the establishment of policies and

 

promulgation of rules governing access to and use of certain

 

controlled substances data from the department of state police; to

 

provide for the powers and duties of certain state and local

 

governmental officers and entities; and to provide for penalties.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 1. This act shall be known and may be cited as the "law

 

enforcement access to Michigan automated prescription system data

 

act".

 

     Sec. 3. As used in this act:

 

     (a) "Application program interface" means the application

 


program interface described in section 7333a of the public health

 

code, 1978 PA 368, MCL 333.7333a.

 

     (b) "Data" means data submitted for purposes of the electronic

 

system for monitoring schedule 2, 3, 4, and 5 controlled substances

 

under section 7333a of the public health code, 1978 PA 368, MCL

 

333.7333a.

 

     (c) "Department" means the department of state police.

 

     (d) "Law enforcement official" means a federal, state, or

 

municipal law enforcement officer or a prosecuting attorney.

 

     Sec. 5. (1) Upon receiving data from the department of

 

licensing and regulatory affairs through the application program

 

interface, the department shall do all of the following:

 

     (a) Ensure that the data are used only by or on behalf of law

 

enforcement officials and only for the purposes described in

 

subsection (2).

 

     (b) Establish policies and promulgate rules governing the

 

security of the data. The policies and rules must include, but are

 

not limited to, all of the following:

 

     (i) Ensure that direct access to the application program

 

interface is made available only to individuals employed by the

 

department who are responsible for maintaining the data and

 

responsible for responding to requests for data from law

 

enforcement officials.

 

     (ii) Establish a procedure to address inappropriate use of

 

data by the individuals described in subparagraph (i).

 

     (c) Not use, sell, divulge, or repurpose the data for any

 

purpose other than those described in this act.


     (d) Provide to the department of licensing and regulatory

 

affairs notice of a security breach of the data within 24 hours

 

after discovering the breach and, within 5 days of discovering the

 

security breach, provide the department of licensing and regulatory

 

affairs with a written description of the source of the security

 

breach and how the department resolved the security breach.

 

     (2) The department may provide data obtained through the

 

application program interface to all of the following:

 

     (a) A law enforcement official if the data is requested for

 

drug-related criminal investigatory or evidentiary purposes to

 

assist in the enforcement of the laws of this state or the United

 

States relating to drugs.

 

     (b) To a law enforcement official who is the holder of a

 

search warrant or subpoena properly issued for the data.

 

     (3) The attorney general or his or her designee, a prosecuting

 

attorney, or the court, in a criminal case, may disclose to the

 

defendant or the defendant's attorney data pertaining to the

 

defendant that was obtained under this act.

 

     (4) The department, all law enforcement officials, and all

 

officers of the court, in using the data obtained under this act

 

for investigative or prosecution purposes, shall consider the

 

nature of the prescriber's and dispenser's practice and the

 

condition for which the patient is being treated.

 

     (5) The data and any report containing any patient identifiers

 

obtained from the data obtained under this act are not public

 

records and are not subject to disclosure under the freedom of

 

information act, 1976 PA 442, MCL 15.231 to 15.246.


     Sec. 7. (1) A person shall not do any of the following:

 

     (a) Access, use, or disclose data obtained under this act for

 

personal use or gain.

 

     (b) Disclose data obtained under this act in a manner that is

 

not authorized by law or rule.

 

     (2) A person who intentionally violates this section is guilty

 

of a crime as follows:

 

     (a) For a first offense, the person is guilty of a misdemeanor

 

punishable by imprisonment for not more than 93 days or a fine of

 

not more than $500.00, or both.

 

     (b) For a second or subsequent offense, the person is guilty

 

of a felony punishable by imprisonment for not more than 4 years or

 

a fine of not more than $2,000.00, or both.

 

     Sec. 9. The department may promulgate rules to implement this

 

act.

 

     Enacting section 1. This act takes effect 90 days after the

 

date it is enacted into law.

 

     Enacting section 2. This act does not take effect unless

 

Senate Bill No._1247                                             of

 

the 99th Legislature is enacted into law.