2016 -- S 2463

========

LC003186

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2016

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

     

     Introduced By: Senators Nesselbush, Miller, P Fogarty, Metts, and Walaska

     Date Introduced: February 11, 2016

     Referred To: Senate Health & Human Services

     It is enacted by the General Assembly as follows:

1

     SECTION 1. Sections 5-37.7-3, 5-37.7-4, 5-37.7-5 and 5-37.7-6 of the General Laws in

2

Chapter 5-37.7 entitled "Rhode Island Health Information Exchange Act of 2008" are hereby

3

amended to read as follows:

4

     5-37.7-3. Definitions. -- As used in this chapter:

5

      (a) "Agency" means the Rhode Island department of health.

6

      (b) "Authorized representative" means:

7

      (1) A person empowered by the patient participant to assert or to waive the

8

confidentiality, or to disclose or authorize the disclosure of confidential information, as

9

established by this chapter. That person is not, except by explicit authorization, empowered to

10

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

11

      (2) A person appointed by the patient participant to make health care decisions on his or

12

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

13

general laws § 23-4.10-2; or

14

      (3) A guardian or conservator, with authority to make health care decisions, if the patient

15

participant is decisionally impaired; or

16

      (4) Another legally appropriate medical decision maker temporarily if the patient

17

participant is decisionally impaired and no health care agent, guardian or conservator is available;

18

or

 

1

      (5) If the patient participant is deceased, his or her personal representative or, in the

2

absence of that representative, his or her heirs-at-law; or

3

      (6) A parent with the authority to make health care decisions for the parent's child.

4

      (c) "Authorization form" means the form described in § 5-37.7-7 of this chapter and by

5

which a patient participant provides authorization for the RHIO to allow access to, review of,

6

and/or disclosure of the patient participant's confidential health care information by electronic,

7

written or other means.

8

      (d) "Business associate" means a business associate as defined by HIPAA.

9

      (e) "Confidential health care information" means all information relating to a patient

10

participant's health care history, diagnosis, condition, treatment, or evaluation.

11

      (f) "Coordination of care" means the process of coordinating, planning, monitoring,

12

and/or sharing information relating to and assessing a care plan for treatment of a patient.

13

      (g) "Data submitting partner" means an individual, organization or entity that has entered

14

into a business associate agreement with the RHIO and submits patient participants' confidential

15

health care information through the HIE.

16

      (h) "Department of health" means the Rhode Island department of health.

17

      (i) "Disclosure report" means a report generated by the HIE relating to the record of

18

access to, review of and/or disclosure of a patient's confidential health care information received,

19

accessed or held by the HIE.

20

     (j) "Electronic health record (EHR)" means a digital version of a patient's medical record

21

that makes information available instantly and securely to authorized users and that is capable of

22

being shared with more than one health care provider.

23

      (j)(k) "Electronic mobilization" means the capability to move clinical information

24

electronically between disparate health care information systems while maintaining the accuracy

25

of the information being exchanged.

26

      (k)(l) "Emergency" means the sudden onset of a medical, mental or substance abuse or

27

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

28

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

29

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

30

or serious dysfunction of any bodily organ or part.

31

      (l)(m) "Health care provider" means any person or entity licensed by this state to provide

32

or lawfully providing health care services, including, but not limited to, a physician, hospital,

33

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

34

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

 

LC003186 - Page 2 of 7

1

employee, or agent of that provider acting in the course and scope of his or her employment or

2

agency related to or supportive of health care services.

3

      (m)(n) "Health care services" means acts of diagnosis, treatment, medical evaluation,

4

referral or counseling or any other acts that may be permissible under the health care licensing

5

statutes of this state.

6

      (n)(o) "Health Information Exchange" or "HIE" means the technical system operated, or

7

to be operated, by the RHIO under state authority allowing for the statewide electronic

8

mobilization of confidential health care information, pursuant to this chapter.

9

      (o)(p) "HIE Advisory Commission" means the advisory body established by the

10

department of health in order to provide community input and policy recommendations regarding

11

the use of the confidential health care information of the HIE.

12

      (p)(q) "HIPAA" means the health insurance portability and accountability act of 1996, as

13

amended.

14

     (r) "Interoperability" means the extent to which a health care provider's systems and

15

devices can exchange electronic health records with other health care providers. Interoperability

16

includes the creation of the infrastructure needed for such exchanges within the HIE, and the use

17

of uniform standards for interactions between applications, communication between systems, the

18

processing and management of information, and the integration of consumer devices with other

19

systems and applications.

20

      (q)(s) "Participant" means a patient participant, a patient participant's authorized

21

representative, a provider participant, a data submitting partner, the regional health information

22

organization and the department of health, that has agreed to authorize, submit, access and/or

23

disclose confidential health care information via the HIE in accordance with this chapter.

24

      (r)(t) "Participation" means a patient participant's authorization, submission, access

25

and/or disclosure of confidential health care information via the HIE in accordance with this

26

chapter.

27

      (s)(u) "Patient participant" means a person who receives health care services from a

28

provider participant and has agreed to participate in the HIE through the mechanisms established

29

in this chapter.

30

      (t)(v) "Provider participant" means a pharmacy, laboratory or health care provider who is

31

providing health care services to a patient participant and/or is submitting or accessing health care

32

information through the HIE and has executed an electronic and/or written agreement regarding

33

disclosure, access, receipt, retention or release of confidential health care information to the HIE;

34

      (u)(w) "Regional health information organization" or "RHIO" means the organization

 

LC003186 - Page 3 of 7

1

designated as the RHIO by the state to provide administrative and operational support to the HIE.

2

     (x) "Semantic interoperability" means the ability to intercalate inbound data from external

3

sources into an existing EHR.

4

     5-37.7-4. Participation in the health information exchange. -- (a) There shall be

5

established a statewide HIE under state authority to allow for the electronic mobilization of

6

confidential health care information in Rhode Island. Confidential health care information may

7

only be accessed, released or transferred from the HIE in accordance with this chapter.

8

      (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

9

all interested parties, including, but not limited to, health care providers, patients, entities

10

submitting information to the HIE, entities obtaining information from the HIE and the RHIO.

11

The Rhode Island department of health is also considered a participant for public health purposes.

12

     (c) Patients and health care providers shall have the choice to participate in the HIE, as

13

defined by regulations in accordance with § 5-37.7-3, provided, however, that provider

14

participants must continue to maintain their own medical record meeting the documentation and

15

other standards imposed by otherwise applicable law.

16

      (d) Participation in the HIE shall have no impact on the content of or use or disclosure of

17

confidential health care information of patient participants that is held in locations other than the

18

HIE. Nothing in this chapter shall be construed to limit, change or otherwise affect entities' rights

19

to exchange confidential health care information in accordance with other applicable laws.

20

      (e) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

21

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

22

associate agreements, including, without limitation, the obligations to use appropriate safeguards

23

to prevent use or disclosure of confidential health care information in accordance with HIPAA

24

and this chapter, not to use or disclose confidential health care information other than as

25

permitted by HIPAA and this chapter, or to make any amendment to a confidential health care

26

record that a provider participant so directs and to respond to a request by a patient participant to

27

make an amendment to the patient participant's confidential health care record.

28

     (f) In furtherance of the goal of participation by all interested parties, the HIE advisory

29

commission shall provide its feedback to the department of health and the RHIO regarding the

30

establishment of standards and infrastructure needed for statewide EHR interoperability. EHRs

31

should facilitate semantic interoperability across all health care provider venues, which means not

32

only allowing providers to export data, but also to properly incorporate external data from other

33

systems.

34

     5-37.7-5. Regulatory oversight. -- (a) The director of the department of health shall

 

LC003186 - Page 4 of 7

1

develop regulations regarding the confidentiality of patient participant information received,

2

accessed or held by the HIE and is authorized to promulgate such other regulations as the director

3

deems necessary or desirable to implement the provisions of this chapter, in accordance with the

4

provisions set forth in chapter 17 of title 23 and chapter 35 of title 42 of the general laws.

5

      (b) The department of health has exclusive jurisdiction over the HIE, except with respect

6

to the jurisdiction conferred upon the attorney general in § 5-37.7-13. This chapter shall not apply

7

to any other private and/or public health information systems utilized within a health care

8

provider or other organization that provides health care services.

9

      (c) The department of health shall promulgate rules and regulations for the establishment

10

of an HIE advisory commission that will be responsible for recommendations relating to the use

11

of, and appropriate confidentiality protections for, the confidential health care information of the

12

HIE, subject to regulatory oversight by the department of health. The HIE advisory commission

13

shall consider the interoperability strategic plan developed by the Rhode Island quality institute,

14

and present its review to the department of health and the RHIO regarding the implementation of

15

national interoperability standards statewide and the infrastructure required to support the

16

statewide electronic exchange and use of confidential health care information in a secure, private

17

and accurate manner across all EHR systems. Such strategic plan shall include provisions for

18

maintaining a reliable method of identity management across EHR systems, as well as the need

19

for semantic interoperability, and a detailed plan for protecting the systems from security

20

breaches. Said commission members shall be subject to the advice and consent of the senate. The

21

commission shall report annually to the department of health and the RHIO, and such report shall

22

be made public.

23

     5-37.7-6. Rhode Island health information organization. -- The RHIO shall, subject to

24

and consistent with department regulations and contractual obligations it has with the state of

25

Rhode Island, be responsible for implementing recognized national standards for interoperability

26

and all administrative, operational, and financial functions to support the HIE, including, but not

27

limited to, implementing and enforcing policies for receiving, retaining, safeguarding and

28

disclosing confidential health care information as required by this chapter. The RHIO is deemed

29

to be the steward of the confidential health care information for which it has administrative

30

responsibility. The HIE advisory commission shall be responsible for considering the strategic

31

plan regarding EHR interoperability developed by the Rhode Island quality institute and

32

presenting its review recommendations to the department of health, and in consultation with the

33

RHIO regarding consider the use of the confidential health care information and the needed

34

infrastructure and use of national standards for EHR interoperability across the state.

 

LC003186 - Page 5 of 7

1

     SECTION 2. This act shall take effect upon passage.

========

LC003186

========

 

LC003186 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

***

1

     This act would charge the health information exchange advisory commission with

2

developing a strategic plan and making recommendations to the department of health and the

3

regional health information organization regarding the standards and infrastructure needed for the

4

interoperability of electronic health record systems.

5

     This act would take effect upon passage.

========

LC003186

========

 

LC003186 - Page 7 of 7