(a) The Secretary, in consultation with the Board, shall adopt regulations to carry out this subtitle.
(b) The regulations adopted by the Secretary shall:
(1) Specify the prescription monitoring data and naloxone medication data required to be submitted under § 21–2A–03 of this subtitle;
(2) Specify the electronic or other means by which information is to be submitted:
(i) Without unduly increasing the workload and expense on dispensers; and
(ii) In a manner as compatible as possible with existing data submission practices of dispensers;
(3) Specify that the information be submitted by dispensers once every 24 hours;
(4) Specify that the Program:
(i) Shall provide the information technology software to dispensers necessary to upload prescription drug monitoring data and naloxone medication data to the Program; and
(ii) May not impose any fees or other assessments on prescribers or dispensers to support the operation of the Program;
(5) Identify the mechanism by which:
(i) Prescription monitoring data are disclosed to a person, in accordance with § 21–2A–06 of this subtitle; and
(ii) Naloxone medication data are disclosed to a person, in accordance with § 21–2A–06.1 of this subtitle;
(6) Identify the circumstances under which a person may disclose prescription monitoring data or naloxone medication data received under the Program;
(7) Specify the process for the Program’s review of prescription monitoring data and naloxone medication data and reporting of:
(i) Possible misuse or abuse of a monitored prescription drug under § 21–2A–06(c) of this subtitle; or
(ii) A possible violation of law or possible breach of professional standards under § 21–2A–06(d) of this subtitle;
(8) Establish requirements for Program retention of prescription monitoring data and naloxone medication data for 3 years; and
(9) Require that:
(i) Confidential or privileged patient information be kept confidential; and
(ii) Records or information protected by a privilege between a health care provider and a patient, or otherwise required by law to be held confidential, be filed in a manner that, except as otherwise provided in §§ 21–2A–06 and 21–2A–06.1 of this subtitle, does not disclose the identity of the person protected.