2016 -- S 2898

========

LC005180

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2016

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- THE RHODE ISLAND HEALTH

INFORMATION EXCHANGE ACT OF 2008

     

     Introduced By: Senator Joshua Miller

     Date Introduced: April 07, 2016

     Referred To: Senate Health & Human Services

     (Health & Human Services)

It is enacted by the General Assembly as follows:

1

     SECTION 1. Sections 5-37.7-3, 5-37.7-4, 5-37.7-7 and 5-37.7-10 of the General Laws in

2

Chapter 5-37.7 entitled "Rhode Island Health Information Exchange Act of 2008" are hereby

3

amended to read as follows:

4

     5-37.7-3. Definitions. -- As used in this chapter:

5

      (a) "Agency" means the Rhode Island department of health.

6

      (b) "Authorized representative" means:

7

      (1) A person empowered by the patient participant to assert or to waive the

8

confidentiality, or to disclose or authorize the disclosure of confidential information, as

9

established by this chapter. That person is not, except by explicit authorization, empowered to

10

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

11

      (2) A person appointed by the patient participant to make health care decisions on his or

12

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

13

general laws § 23-4.10-2; or

14

      (3) A guardian or conservator, with authority to make health care decisions, if the patient

15

participant is decisionally impaired; or

16

      (4) Another legally appropriate medical decision maker temporarily if the patient

17

participant is decisionally impaired and no health care agent, guardian or conservator is available;

18

or

 

1

      (5) If the patient participant is deceased, his or her personal representative or, in the

2

absence of that representative, his or her heirs-at-law; or

3

      (6) A parent with the authority to make health care decisions for the parent's child; or

4

     (7) A person authorized by the patient participant or their authorized representative to

5

access their confidential health care information form the HIE, including family members or other

6

proxies as designated by the patient, to assist patient participant with the coordination of their

7

care.

8

      (c) "Authorization form" means the form described in § 5-37.7-7 of this chapter and by

9

which a patient participant provides authorization for the RHIO to allow access to, review of,

10

and/or disclosure of the patient participant's confidential health care information by electronic,

11

written or other means.

12

      (d) "Business associate" means a business associate as defined by HIPAA.

13

      (e) "Confidential health care information" means all information relating to a patient

14

participant's health care history, diagnosis, condition, treatment, or evaluation.

15

      (f) "Coordination of care" means the process of coordinating, planning, monitoring,

16

and/or sharing information relating to and assessing a care plan for treatment of a patient.

17

      (g) "Data submitting partner" means an individual, organization or entity that has entered

18

into a business associate agreement with the RHIO and submits patient participants' confidential

19

health care information through the HIE.

20

      (h) "Department of health" means the Rhode Island department of health.

21

      (i) "Disclosure report" means a report generated by the HIE relating to the record of

22

access to, review of and/or disclosure of a patient's confidential health care information received,

23

accessed or held by the HIE.

24

      (j) "Electronic mobilization" means the capability to move clinical information

25

electronically between disparate health care information systems while maintaining the accuracy

26

of the information being exchanged.

27

      (k) "Emergency" means the sudden onset of a medical, mental or substance abuse or

28

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

29

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

30

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

31

or serious dysfunction of any bodily organ or part.

32

      (l) "Health care provider" means any person or entity licensed by this state to provide or

33

lawfully providing health care services, including, but not limited to, a physician, hospital,

34

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

 

LC005180 - Page 2 of 7

1

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

2

employee, or agent of that provider acting in the course and scope of his or her employment or

3

agency related to or supportive of health care services.

4

      (m) "Health care services" means acts of diagnosis, treatment, medical evaluation,

5

referral or counseling or any other acts that may be permissible under the health care licensing

6

statutes of this state.

7

      (n) "Health Information Exchange" or "HIE" means the technical system operated, or to

8

be operated, by the RHIO under state authority allowing for the statewide electronic mobilization

9

of confidential health care information, pursuant to this chapter.

10

     (o) "Health plan" means an individual plan or a group plan that provides, or pays the cost

11

of, health care services for patient participants.

12

      (o)(p) "HIE Advisory Commission" means the advisory body established by the

13

department of health in order to provide community input and policy recommendations regarding

14

the use of the confidential health care information of the HIE.

15

      (p)(q) "HIPAA" means the health insurance portability and accountability act of 1996, as

16

amended.

17

      (q)(r) "Participant" means a patient participant, a patient participant's authorized

18

representative, a provider participant, a data submitting partner, the regional health information

19

organization and the department of health, that has agreed to authorize, submit, access and/or

20

disclose confidential health care information via the HIE in accordance with this chapter.

21

      (r)(s) "Participation" means a patient participant's authorization, submission, access

22

and/or disclosure of confidential health care information via the HIE in accordance with this

23

chapter.

24

      (s)(t) "Patient participant" means a person who receives health care services from a

25

provider participant and has agreed to participate in the HIE through the mechanisms established

26

in this chapter.

27

      (t)(u) "Provider participant" means a pharmacy, laboratory, or health care provider, or

28

health plan who is providing health care services to or pays for the cost of health care services for

29

a patient participant and/or is submitting or accessing health care information through the HIE

30

and has executed an electronic and/or written agreement regarding disclosure, access, receipt,

31

retention or release of confidential health care information to the HIE;

32

      (u)(v) "Regional health information organization" or "RHIO" means the organization

33

designated as the RHIO by the state to provide administrative and operational support to the HIE.

34

     5-37.7-4. Participation in the health information exchange. -- (a) There shall be

 

LC005180 - Page 3 of 7

1

established a statewide HIE under state authority to allow for the electronic mobilization of

2

confidential health care information in Rhode Island. Confidential health care information may

3

only be accessed, released or transferred from the HIE in accordance with this chapter.

4

      (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

5

all interested parties, including, but not limited to, health care providers, patients, health plans,

6

entities submitting information to the HIE, entities obtaining information from the HIE and the

7

RHIO. The Rhode Island department of health is also considered a participant for public health

8

purposes.

9

      (c) Patients and health care providers shall have the choice to participate in the HIE, as

10

defined by regulations in accordance with § 5-37.7-3, provided, however, that provider

11

participants must continue to maintain their own medical record meeting the documentation and

12

other standards imposed by otherwise applicable law.

13

      (d) Participation in the HIE shall have no impact on the content of or use or disclosure of

14

confidential health care information of patient participants that is held in locations other than the

15

HIE. Nothing in this chapter shall be construed to limit, change or otherwise affect entities' rights

16

to exchange confidential health care information in accordance with other applicable laws.

17

      (e) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

18

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

19

associate agreements, including, without limitation, the obligations to use appropriate safeguards

20

to prevent use or disclosure of confidential health care information in accordance with HIPAA

21

and this chapter, not to use or disclose confidential health care information other than as

22

permitted by HIPAA and this chapter, or to make any amendment to a confidential health care

23

record that a provider participant so directs and to respond to a request by a patient participant to

24

make an amendment to the patient participant's confidential health care record.

25

     5-37.7-7. Disclosure. -- (a) (1) Except as provided in subsection (b) of this section, a

26

patient participant's confidential health care information may only be accessed, released or

27

transferred from the HIE in accordance with an authorization form signed by the patient

28

participant or the patient's authorized representative.

29

      (b) No authorization for release or transfer of confidential health care information from

30

the HIE shall be required in the following situations:

31

      (1) To a health care provider who believes, in good faith, that the information is

32

necessary for diagnosis or treatment of that individual in an emergency; or

33

      (2) To public health authorities in order to carry out their functions as described in this

34

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

 

LC005180 - Page 4 of 7

1

are not restricted to, investigations into the causes of disease, the control of public health hazards,

2

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

3

health professionals and facilities, review of health care such as that required by the federal

4

government and other governmental agencies, and mandatory reporting laws set forth in Rhode

5

Island general laws; and or

6

      (3) To the RHIO in order for it to effectuate the operation and administrative oversight of

7

the HIE. ; and

8

     (4) To a health plan if the information is necessary for care management of its plan

9

members, or for quality and performance measure reporting.

10

      (c) The content of the authorization form for access to, or the disclosure, release or

11

transfer of confidential health care information from the HIE shall be prescribed by the RHIO in

12

accordance with applicable department of health regulations, but at a minimum shall contain the

13

following information in a clear and conspicuous manner:

14

      (1) A statement of the need for and proposed uses of that information; and

15

      (2) A statement that the authorization for access to, disclosure of and/or release of

16

information may be withdrawn at any future time and is subject to revocation.

17

      (3) That the patient has the right not to participate in the HIE; and

18

      (4) The patient's right to choose to: (i) enroll in and participate fully in the HIE; or (ii)

19

designate only specific health care providers that may access the patient participant's confidential

20

health care information.

21

      (d) Except as specifically provided by law or this chapter, or use for clinical care, a

22

patient participant's confidential health care information shall not be accessed by, given, sold,

23

transferred, or in any way relayed from the HIE to any other person or entity not specified in the

24

patient participant authorization form meeting the requirements of subsection (c) of this section

25

without first obtaining additional authorization.

26

      (e) Nothing contained in this chapter shall be construed to limit the permitted access to

27

or the release, transfer, access or disclosure of confidential health care information described in

28

subsection (b) of this section or under other applicable law.

29

      (f) Confidential health care information received, disclosed or held by the HIE shall not

30

be subject to subpoena directed to the HIE or RHIO unless the following procedures have been

31

completed: (i) the person seeking the confidential health care information has already requested

32

and received the confidential health care information from the health care provider that was the

33

original source of the information; and (ii) a determination has been made by the superior court

34

upon motion and notice to the HIE or RHIO and the parties to the litigation in which the

 

LC005180 - Page 5 of 7

1

subpoena is served that the confidential health care information sought from the HIE is not

2

available from another source and is either relevant to the subject matter involved in the pending

3

action or is reasonably calculated to lead to the discovery of admissible evidence in such pending

4

action. Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify

5

that such measures have been completed prior to the issuance of the subpoena.

6

      (g) Nothing contained herein shall interfere with or impact upon any rights or obligations

7

imposed by the Workers Compensation Act as contained in title 28, chapters 29 -- 38, of the

8

general laws.

9

     (h) Nothing contained herein shall prohibit a health plan from becoming a data

10

submitting partner. A data submitting partner is not considered a managed care entity or a

11

managed care contractor and the HIE is not considered a regional or local medical information

12

database pursuant to §5-37.3-4.

13

     5-37.7-10. Patient's rights. -- Pursuant to this chapter, a patient participant who has his

14

or her confidential health care information transferred through the HIE shall have the following

15

rights:

16

      (1) To obtain a copy of his or her confidential health care information from the HIE;

17

      (2) To obtain a copy of the disclosure report pertaining to his or her confidential health

18

care information;

19

      (3) To be notified as required by chapter 49.2 of title 11, the Rhode Island identity theft

20

protection act, of a breach of the security system of the HIE;

21

      (4) To terminate his or her participation in the HIE in accordance with rules and

22

regulations promulgated by the agency; and

23

      (5) To request to amend his or her own information through the provider participant. ;

24

     (6) To request their confidential health care information from the HIE be disclosed to an

25

authorized representative; and

26

     (7) To request their confidential health care information from the HIE be disclosed to

27

health care providers who are not provider participants as defined by this chapter.

28

     SECTION 2. This act shall take effect upon passage.

========

LC005180

========

 

LC005180 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- THE RHODE ISLAND HEALTH

INFORMATION EXCHANGE ACT OF 2008

***

1

     This act would allow persons authorized by a patient to gain access to that patient's

2

confidential health care information from the health information exchange. This act would also

3

allow health plans: (1) To send information to the health information exchange; and (2) To

4

receive information to which they are already legally entitled from the health information

5

exchange for care coordination and management.

6

     This act would take effect upon passage.

========

LC005180

========

 

LC005180 - Page 7 of 7