Section 3: Maintenance of database; confidentiality of records and communications
Section 3. (a) The commission shall maintain a confidential, interoperable database including, but not limited to: (i) the qualifying patients issued a registration card for medical use of marijuana; (ii) the healthcare professionals registered to issue written certifications; (iii) the name of any medical marijuana treatment center; (iv) the quantity of medical use marijuana dispensed to a card holder; and (v) any other pertinent information. Individual names and other identifying information shall be exempt from section 10 of chapter 66, and not subject to disclosure, except to employees of the commission in the course of their official duties, medical marijuana treatment centers to facilitate dispensing of medical use marijuana and to state or local law enforcement officials for the purposes of conducting an investigation pursuant this chapter.
(b) Every registered qualifying patient shall have the right to confidentiality of all records and communications related to their care provided by a medical use marijuana licensee or establishment or by a registered healthcare professional to the extent provided by law. Such records shall not be deemed public records as defined by clause Twenty-sixth of section 7 of chapter 4. No provision of this subsection relating to confidentiality of records shall be construed to prevent access to any such records by the commission or its agents, a healthcare professional who has a bona fide healthcare professional-patient relationship with the patient, a medical marijuana treatment center or any state or local law enforcement official for the purposes of conducting an investigation pursuant this chapter.