2016 -- S 2463

========

LC003186

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2016

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

     Introduced By: Senators Nesselbush, Miller, P Fogarty, Metts, and Walaska

     Date Introduced: February 11, 2016

     Referred To: Senate Health & Human Services

     It is enacted by the General Assembly as follows:

     SECTION 1. Sections 5-37.7-3, 5-37.7-4, 5-37.7-5 and 5-37.7-6 of the General Laws in

Chapter 5-37.7 entitled "Rhode Island Health Information Exchange Act of 2008" are hereby

amended to read as follows:

     5-37.7-3. Definitions. -- As used in this chapter:

      (a) "Agency" means the Rhode Island department of health.

      (b) "Authorized representative" means:

      (1) A person empowered by the patient participant to assert or to waive the

confidentiality, or to disclose or authorize the disclosure of confidential information, as

established by this chapter. That person is not, except by explicit authorization, empowered to

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

      (2) A person appointed by the patient participant to make health care decisions on his or

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

general laws § 23-4.10-2; or

      (3) A guardian or conservator, with authority to make health care decisions, if the patient

participant is decisionally impaired; or

      (4) Another legally appropriate medical decision maker temporarily if the patient

participant is decisionally impaired and no health care agent, guardian or conservator is available;

or

      (5) If the patient participant is deceased, his or her personal representative or, in the

absence of that representative, his or her heirs-at-law; or

      (6) A parent with the authority to make health care decisions for the parent's child.

      (c) "Authorization form" means the form described in § 5-37.7-7 of this chapter and by

which a patient participant provides authorization for the RHIO to allow access to, review of,

and/or disclosure of the patient participant's confidential health care information by electronic,

written or other means.

      (d) "Business associate" means a business associate as defined by HIPAA.

      (e) "Confidential health care information" means all information relating to a patient

participant's health care history, diagnosis, condition, treatment, or evaluation.

      (f) "Coordination of care" means the process of coordinating, planning, monitoring,

and/or sharing information relating to and assessing a care plan for treatment of a patient.

      (g) "Data submitting partner" means an individual, organization or entity that has entered

into a business associate agreement with the RHIO and submits patient participants' confidential

health care information through the HIE.

      (h) "Department of health" means the Rhode Island department of health.

      (i) "Disclosure report" means a report generated by the HIE relating to the record of

access to, review of and/or disclosure of a patient's confidential health care information received,

accessed or held by the HIE.

     (j) "Electronic health record (EHR)" means a digital version of a patient's medical record

that makes information available instantly and securely to authorized users and that is capable of

being shared with more than one health care provider.

      (j)(k) "Electronic mobilization" means the capability to move clinical information

electronically between disparate health care information systems while maintaining the accuracy

of the information being exchanged.

      (k)(l) "Emergency" means the sudden onset of a medical, mental or substance abuse or

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

or serious dysfunction of any bodily organ or part.

      (l)(m) "Health care provider" means any person or entity licensed by this state to provide

or lawfully providing health care services, including, but not limited to, a physician, hospital,

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

LC003186 - Page 2 of 7

employee, or agent of that provider acting in the course and scope of his or her employment or

agency related to or supportive of health care services.

      (m)(n) "Health care services" means acts of diagnosis, treatment, medical evaluation,

referral or counseling or any other acts that may be permissible under the health care licensing

statutes of this state.

      (n)(o) "Health Information Exchange" or "HIE" means the technical system operated, or

to be operated, by the RHIO under state authority allowing for the statewide electronic

mobilization of confidential health care information, pursuant to this chapter.

      (o)(p) "HIE Advisory Commission" means the advisory body established by the

department of health in order to provide community input and policy recommendations regarding

the use of the confidential health care information of the HIE.

      (p)(q) "HIPAA" means the health insurance portability and accountability act of 1996, as

amended.

     (r) "Interoperability" means the extent to which a health care provider's systems and

devices can exchange electronic health records with other health care providers. Interoperability

includes the creation of the infrastructure needed for such exchanges within the HIE, and the use

of uniform standards for interactions between applications, communication between systems, the

processing and management of information, and the integration of consumer devices with other

systems and applications.

      (q)(s) "Participant" means a patient participant, a patient participant's authorized

representative, a provider participant, a data submitting partner, the regional health information

organization and the department of health, that has agreed to authorize, submit, access and/or

disclose confidential health care information via the HIE in accordance with this chapter.

      (r)(t) "Participation" means a patient participant's authorization, submission, access

and/or disclosure of confidential health care information via the HIE in accordance with this

chapter.

      (s)(u) "Patient participant" means a person who receives health care services from a

provider participant and has agreed to participate in the HIE through the mechanisms established

in this chapter.

      (t)(v) "Provider participant" means a pharmacy, laboratory or health care provider who is

providing health care services to a patient participant and/or is submitting or accessing health care

information through the HIE and has executed an electronic and/or written agreement regarding

disclosure, access, receipt, retention or release of confidential health care information to the HIE;

      (u)(w) "Regional health information organization" or "RHIO" means the organization

LC003186 - Page 3 of 7

designated as the RHIO by the state to provide administrative and operational support to the HIE.

     (x) "Semantic interoperability" means the ability to intercalate inbound data from external

sources into an existing EHR.

     5-37.7-4. Participation in the health information exchange. -- (a) There shall be

established a statewide HIE under state authority to allow for the electronic mobilization of

confidential health care information in Rhode Island. Confidential health care information may

only be accessed, released or transferred from the HIE in accordance with this chapter.

      (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

all interested parties, including, but not limited to, health care providers, patients, entities

submitting information to the HIE, entities obtaining information from the HIE and the RHIO.

The Rhode Island department of health is also considered a participant for public health purposes.

     (c) Patients and health care providers shall have the choice to participate in the HIE, as

defined by regulations in accordance with § 5-37.7-3, provided, however, that provider

participants must continue to maintain their own medical record meeting the documentation and

other standards imposed by otherwise applicable law.

      (d) Participation in the HIE shall have no impact on the content of or use or disclosure of

confidential health care information of patient participants that is held in locations other than the

HIE. Nothing in this chapter shall be construed to limit, change or otherwise affect entities' rights

to exchange confidential health care information in accordance with other applicable laws.

      (e) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

associate agreements, including, without limitation, the obligations to use appropriate safeguards

to prevent use or disclosure of confidential health care information in accordance with HIPAA

and this chapter, not to use or disclose confidential health care information other than as

permitted by HIPAA and this chapter, or to make any amendment to a confidential health care

record that a provider participant so directs and to respond to a request by a patient participant to

make an amendment to the patient participant's confidential health care record.

     (f) In furtherance of the goal of participation by all interested parties, the HIE advisory

commission shall provide its feedback to the department of health and the RHIO regarding the

establishment of standards and infrastructure needed for statewide EHR interoperability. EHRs

should facilitate semantic interoperability across all health care provider venues, which means not

only allowing providers to export data, but also to properly incorporate external data from other

systems.

     5-37.7-5. Regulatory oversight. -- (a) The director of the department of health shall

LC003186 - Page 4 of 7

develop regulations regarding the confidentiality of patient participant information received,

accessed or held by the HIE and is authorized to promulgate such other regulations as the director

deems necessary or desirable to implement the provisions of this chapter, in accordance with the

provisions set forth in chapter 17 of title 23 and chapter 35 of title 42 of the general laws.

      (b) The department of health has exclusive jurisdiction over the HIE, except with respect

to the jurisdiction conferred upon the attorney general in § 5-37.7-13. This chapter shall not apply

to any other private and/or public health information systems utilized within a health care

provider or other organization that provides health care services.

      (c) The department of health shall promulgate rules and regulations for the establishment

of an HIE advisory commission that will be responsible for recommendations relating to the use

of, and appropriate confidentiality protections for, the confidential health care information of the

HIE, subject to regulatory oversight by the department of health. The HIE advisory commission

shall consider the interoperability strategic plan developed by the Rhode Island quality institute,

and present its review to the department of health and the RHIO regarding the implementation of

national interoperability standards statewide and the infrastructure required to support the

statewide electronic exchange and use of confidential health care information in a secure, private

and accurate manner across all EHR systems. Such strategic plan shall include provisions for

maintaining a reliable method of identity management across EHR systems, as well as the need

for semantic interoperability, and a detailed plan for protecting the systems from security

breaches. Said commission members shall be subject to the advice and consent of the senate. The

commission shall report annually to the department of health and the RHIO, and such report shall

be made public.

     5-37.7-6. Rhode Island health information organization. -- The RHIO shall, subject to

and consistent with department regulations and contractual obligations it has with the state of

Rhode Island, be responsible for implementing recognized national standards for interoperability

and all administrative, operational, and financial functions to support the HIE, including, but not

limited to, implementing and enforcing policies for receiving, retaining, safeguarding and

disclosing confidential health care information as required by this chapter. The RHIO is deemed

to be the steward of the confidential health care information for which it has administrative

responsibility. The HIE advisory commission shall be responsible for considering the strategic

plan regarding EHR interoperability developed by the Rhode Island quality institute and

presenting its review recommendations to the department of health, and in consultation with the

RHIO regarding consider the use of the confidential health care information and the needed

infrastructure and use of national standards for EHR interoperability across the state.

LC003186 - Page 5 of 7

     SECTION 2. This act shall take effect upon passage.

========

LC003186

========

LC003186 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

***

     This act would charge the health information exchange advisory commission with

developing a strategic plan and making recommendations to the department of health and the

regional health information organization regarding the standards and infrastructure needed for the

interoperability of electronic health record systems.

     This act would take effect upon passage.

========

LC003186

========

LC003186 - Page 7 of 7