2015 -- S 0231

========

LC001218

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2015

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

     

     Introduced By: Senators Miller, Crowley, Ottiano, Sheehan, and Sosnowski

     Date Introduced: February 11, 2015

     Referred To: Senate Health & Human Services

     It is enacted by the General Assembly as follows:

1

     SECTION 1. Sections 5-37.7-3, 5-37.7-4, 5-37.7-5 and 5-37.7-6 of the General Laws in

2

Chapter 5-37.7 entitled "Rhode Island Health Information Exchange Act of 2008" are hereby

3

amended to read as follows:

4

     5-37.7-3. Definitions. -- As used in this chapter:

5

      (a) "Agency" means the Rhode Island department of health.

6

      (b) "Authorized representative" means:

7

      (1) A person empowered by the patient participant to assert or to waive the

8

confidentiality, or to disclose or authorize the disclosure of confidential information, as

9

established by this chapter. That person is not, except by explicit authorization, empowered to

10

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

11

      (2) A person appointed by the patient participant to make health care decisions on his or

12

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

13

general laws § 23-4.10-2; or

14

      (3) A guardian or conservator, with authority to make health care decisions, if the patient

15

participant is decisionally impaired; or

16

      (4) Another legally appropriate medical decision maker temporarily if the patient

17

participant is decisionally impaired and no health care agent, guardian or conservator is available;

18

or

 

1

      (5) If the patient participant is deceased, his or her personal representative or, in the

2

absence of that representative, his or her heirs-at-law; or

3

      (6) A parent with the authority to make health care decisions for the parent's child.

4

      (c) "Authorization form" means the form described in § 5-37.7-7 of this chapter and by

5

which a patient participant provides authorization for the RHIO to allow access to, review of,

6

and/or disclosure of the patient participant's confidential health care information by electronic,

7

written or other means.

8

      (d) "Business associate" means a business associate as defined by HIPAA.

9

      (e) "Confidential health care information" means all information relating to a patient

10

participant's health care history, diagnosis, condition, treatment, or evaluation.

11

      (f) "Coordination of care" means the process of coordinating, planning, monitoring,

12

and/or sharing information relating to and assessing a care plan for treatment of a patient.

13

      (g) "Data submitting partner" means an individual, organization or entity that has entered

14

into a business associate agreement with the RHIO and submits patient participants' confidential

15

health care information through the HIE.

16

      (h) "Department of health" means the Rhode Island department of health.

17

      (i) "Disclosure report" means a report generated by the HIE relating to the record of

18

access to, review of and/or disclosure of a patient's confidential health care information received,

19

accessed or held by the HIE.

20

     (j) "Electronic health record (EHR)" means a digital version of a patient's medical record

21

that makes information available instantly and securely to authorized users and that is capable of

22

being shared with more than one health care provider.

23

      (j)(k) "Electronic mobilization" means the capability to move clinical information

24

electronically between disparate health care information systems while maintaining the accuracy

25

of the information being exchanged.

26

      (k)(l) "Emergency" means the sudden onset of a medical, mental or substance abuse or

27

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

28

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

29

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

30

or serious dysfunction of any bodily organ or part.

31

      (l)(m) "Health care provider" means any person or entity licensed by this state to provide

32

or lawfully providing health care services, including, but not limited to, a physician, hospital,

33

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

34

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

 

LC001218 - Page 2 of 7

1

employee, or agent of that provider acting in the course and scope of his or her employment or

2

agency related to or supportive of health care services.

3

      (m)(n) "Health care services" means acts of diagnosis, treatment, medical evaluation,

4

referral or counseling or any other acts that may be permissible under the health care licensing

5

statutes of this state.

6

      (n)(o) "Health Information Exchange" or "HIE" means the technical system operated, or

7

to be operated, by the RHIO under state authority allowing for the statewide electronic

8

mobilization of confidential health care information, pursuant to this chapter.

9

      (o)(p) "HIE Advisory Commission" means the advisory body established by the

10

department of health in order to provide community input and policy recommendations regarding

11

the use of the confidential health care information of the HIE.

12

      (p)(q) "HIPAA" means the health insurance portability and accountability act of 1996, as

13

amended.

14

     (r) "Interoperability" means the extent to which a health care provider's systems and

15

devices can exchange electronic health records with other health care providers. Interoperability

16

includes the creation of the infrastructure needed for such exchanges within the HIE, and the

17

establishment of uniform standards for interactions between applications, communication

18

between systems, the processing and management of information, and the integration of

19

consumer devices with other systems and applications.

20

      (q)(s) "Participant" means a patient participant, a patient participant's authorized

21

representative, a provider participant, a data submitting partner, the regional health information

22

organization and the department of health, that has agreed to authorize, submit, access and/or

23

disclose confidential health care information via the HIE in accordance with this chapter.

24

      (r)(t) "Participation" means a patient participant's authorization, submission, access

25

and/or disclosure of confidential health care information via the HIE in accordance with this

26

chapter.

27

      (s)(u) "Patient participant" means a person who receives health care services from a

28

provider participant and has agreed to participate in the HIE through the mechanisms established

29

in this chapter.

30

      (t)(v) "Provider participant" means a pharmacy, laboratory or health care provider who is

31

providing health care services to a patient participant and/or is submitting or accessing health care

32

information through the HIE and has executed an electronic and/or written agreement regarding

33

disclosure, access, receipt, retention or release of confidential health care information to the HIE;

34

      (u)(w) "Regional health information organization" or "RHIO" means the organization

 

LC001218 - Page 3 of 7

1

designated as the RHIO by the state to provide administrative and operational support to the HIE.

2

     (x) "Semantic interoperability" means the ability to intercalate inbound data from external

3

sources into an existing EHR.

4

     5-37.7-4. Participation in the health information exchange. -- (a) There shall be

5

established a statewide HIE under state authority to allow for the electronic mobilization of

6

confidential health care information in Rhode Island. Confidential health care information may

7

only be accessed, released or transferred from the HIE in accordance with this chapter.

8

      (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

9

all interested parties, including, but not limited to, health care providers, patients, entities

10

submitting information to the HIE, entities obtaining information from the HIE and the RHIO.

11

The Rhode Island department of health is also considered a participant for public health purposes.

12

     (c) In furtherance of the goal of participation by all interested parties, the HIE advisory

13

commission shall make recommendations to the department of health and the RHIO regarding the

14

establishment of standards and infrastructure needed for statewide EHR interoperability. EHRs

15

should facilitate semantic interoperability across all health care provider venues, which means not

16

only allowing providers to export data, but also to properly incorporate external data from other

17

systems.

18

      (c)(d) Patients and health care providers shall have the choice to participate in the HIE,

19

as defined by regulations in accordance with § 5-37.7-3, provided, however, that provider

20

participants must continue to maintain their own medical record meeting the documentation and

21

other standards imposed by otherwise applicable law.

22

      (d)(e) Participation in the HIE shall have no impact on the content of or use or disclosure

23

of confidential health care information of patient participants that is held in locations other than

24

the HIE. Nothing in this chapter shall be construed to limit, change or otherwise affect entities'

25

rights to exchange confidential health care information in accordance with other applicable laws.

26

      (e)(f) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

27

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

28

associate agreements, including, without limitation, the obligations to use appropriate safeguards

29

to prevent use or disclosure of confidential health care information in accordance with HIPAA

30

and this chapter, not to use or disclose confidential health care information other than as

31

permitted by HIPAA and this chapter, or to make any amendment to a confidential health care

32

record that a provider participant so directs and to respond to a request by a patient participant to

33

make an amendment to the patient participant's confidential health care record.

34

     5-37.7-5. Regulatory oversight. -- (a) The director of the department of health shall

 

LC001218 - Page 4 of 7

1

develop regulations regarding the confidentiality of patient participant information received,

2

accessed or held by the HIE and is authorized to promulgate such other regulations as the director

3

deems necessary or desirable to implement the provisions of this chapter, in accordance with the

4

provisions set forth in chapter 17 of title 23 and chapter 35 of title 42 of the general laws.

5

      (b) The department of health has exclusive jurisdiction over the HIE, except with respect

6

to the jurisdiction conferred upon the attorney general in § 5-37.7-13. This chapter shall not apply

7

to any other private and/or public health information systems utilized within a health care

8

provider or other organization that provides health care services.

9

      (c) The department of health shall promulgate rules and regulations for the establishment

10

of an HIE advisory commission that will be responsible for recommendations relating to the use

11

of, and appropriate confidentiality protections for, the confidential health care information of the

12

HIE, subject to regulatory oversight by the department of health. The HIE advisory commission

13

shall develop a strategic plan to be presented to the department of health and the RHIO regarding

14

the implementation of statewide interoperability standards and the infrastructure required to

15

support the statewide electronic exchange and use of confidential health care information in an

16

secure, private and accurate manner across all EHR systems. Such strategic plan shall include

17

provisions for establishing a reliable method of identity management across EHR systems, as well

18

as the need for semantic interoperability. Said commission members shall be subject to the advice

19

and consent of the senate. The commission shall report annually to the department of health and

20

the RHIO, and such report shall be made public.

21

     5-37.7-6. Rhode Island health information organization. -- The RHIO shall, subject to

22

and consistent with department regulations and contractual obligations it has with the state of

23

Rhode Island, be responsible for implementing recognized national standards for interoperability

24

and all administrative, operational, and financial functions to support the HIE, including, but not

25

limited to, implementing and enforcing policies for receiving, retaining, safeguarding and

26

disclosing confidential health care information as required by this chapter. The RHIO is deemed

27

to be the steward of the confidential health care information for which it has administrative

28

responsibility. The HIE advisory commission shall be responsible for developing a strategic plan

29

regarding EHR interoperability and making recommendations to the department of health, and in

30

consultation with the RHIO regarding the use of the confidential health care information and the

31

establishment of the standards and infrastructure needed for EHR interoperability across the

32

state.

 

LC001218 - Page 5 of 7

1

     SECTION 2. This act shall take effect upon passage.

========

LC001218

========

 

LC001218 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

***

1

     This act would charge the HIE advisory commission with developing a strategic plan and

2

making recommendations to the department of health and the regional health information

3

organization regarding the standards and infrastructure needed for the interoperability of EHR

4

systems.

5

     This act would take effect upon passage.

========

LC001218

========

 

LC001218 - Page 7 of 7