2017 -- S 0149

========

LC000997

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2017

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

     Introduced By: Senators Nesselbush, P Fogarty, Lombardi, Quezada, and Crowley

     Date Introduced: February 01, 2017

     Referred To: Senate Health & Human Services

     It is enacted by the General Assembly as follows:

     SECTION 1. Sections 5-37.7-3, 5-37.7-4, 5-37.7-5 and 5-37.7-6 of the General Laws in

Chapter 5-37.7 entitled "Rhode Island Health Information Exchange Act of 2008" are hereby

amended to read as follows:

     5-37.7-3. Definitions.

     As used in this chapter:

     (a) "Agency" means the Rhode Island department of health.

     (b) "Authorized representative" means:

     (1) A person empowered by the patient participant to assert or to waive the

confidentiality, or to disclose or authorize the disclosure of confidential information, as

established by this chapter. That person is not, except by explicit authorization, empowered to

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

     (2) A person appointed by the patient participant to make health care decisions on his or

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

general laws § 23-4.10-2; or

     (3) A guardian or conservator, with authority to make health care decisions, if the patient

participant is decisionally impaired; or

     (4) Another legally appropriate medical decision maker temporarily if the patient

participant is decisionally impaired and no health care agent, guardian or conservator is available;

or

     (5) If the patient participant is deceased, his or her personal representative or, in the

absence of that representative, his or her heirs-at-law; or

     (6) A parent with the authority to make health care decisions for the parent's child; or

     (7) A person authorized by the patient participant or their authorized representative to

access their confidential health care information from the HIE, including family members or other

proxies as designated by the patient, to assist patient participant with the coordination of their

care.

     (c) "Authorization form" means the form described in § 5-37.7-7 of this chapter and by

which a patient participant provides authorization for the RHIO to allow access to, review of,

and/or disclosure of the patient participant's confidential health care information by electronic,

written, or other means.

     (d) "Business associate" means a business associate as defined by HIPAA.

     (e) "Confidential health care information" means all information relating to a patient

participant's health care history, diagnosis, condition, treatment, or evaluation.

     (f) "Coordination of care" means the process of coordinating, planning, monitoring,

and/or sharing information relating to, and assessing a care plan for, treatment of a patient.

     (g) "Data-submitting partner" means an individual, organization, or entity that has entered

into a business associate agreement with the RHIO and submits patient participants' confidential

health care information through the HIE.

     (h) "Department of health" means the Rhode Island department of health.

     (i) "Disclosure report" means a report generated by the HIE relating to the record of

access to, review of, and/or disclosure of a patient's confidential health care information received,

accessed, or held by the HIE.

     (j) "Electronic health record (EHR)" means a digital version of a patient's medical record

that makes information available instantly and securely to authorized users and that is capable of

being shared with more than one health care provider.

     (j)(k) "Electronic mobilization" means the capability to move clinical information

electronically between disparate health care information systems while maintaining the accuracy

of the information being exchanged.

     (k)(l) "Emergency" means the sudden onset of a medical, mental or substance abuse, or

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

LC000997 - Page 2 of 7

or serious dysfunction of any bodily organ or part.

     (l)(m) "Health care provider" means any person or entity licensed by this state to provide

or lawfully providing health care services, including, but not limited to, a physician, hospital,

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

employee, or agent of that provider acting in the course and scope of his or her employment or

agency related to or supportive of health care services.

     (m)(n) "Health care services" means acts of diagnosis, treatment, medical evaluation,

referral or counseling or any other acts that may be permissible under the health care licensing

statutes of this state.

     (n)(o) "Health Information Exchange" or "HIE" means the technical system operated, or

to be operated, by the RHIO under state authority allowing for the statewide electronic

mobilization of confidential health care information, pursuant to this chapter.

     (o)(p) "Health plan" means an individual plan or a group plan that provides, or pays the

cost of, health care services for patient participants.

     (p)(q) "HIE Advisory Commission" means the advisory body established by the

department of health in order to provide community input and policy recommendations regarding

the use of the confidential health care information of the HIE.

     (q)(r) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996,

as amended.

     (s) "Interoperability" means the extent to which a health care provider's systems and

devices can exchange electronic health records with other health care providers. Interoperability

includes the creation of the infrastructure needed for such exchanges within the HIE, and the use

of uniform standards for interactions between applications, communication between systems, the

processing and management of information, and the integration of consumer devices with other

systems and applications.

     (r)(t) "Participant" means a patient participant, a patient participant's authorized

representative, a provider participant, a data submitting partner, the regional health information

organization, and the department of health, that has agreed to authorize, submit, access, and/or

disclose confidential health care information via the HIE in accordance with this chapter.

     (s)(u) "Participation" means a patient participant's authorization, submission, access,

and/or disclosure of confidential health care information via the HIE in accordance with this

chapter.

     (t)(v) "Patient participant" means a person who receives health care services from a

LC000997 - Page 3 of 7

provider participant and has agreed to participate in the HIE through the mechanisms established

in this chapter.

     (u)(w) "Provider participant" means a pharmacy, laboratory, health care provider, or

health plan who is providing health care services or pays for the cost of health care services for a

patient participant and/or is submitting or accessing health care information through the HIE and

has executed an electronic and/or written agreement regarding disclosure, access, receipt,

retention, or release of confidential health care information to the HIE;

     (v)(x) "Regional health information organization" or "RHIO" means the organization

designated as the RHIO by the state to provide administrative and operational support to the HIE.

     (y) "Semantic interoperability" means the ability to intercalate inbound data from external

sources into an existing EHR.

     5-37.7-4. Participation in the health information exchange.

     (a) There shall be established a statewide HIE under state authority to allow for the

electronic mobilization of confidential health care information in Rhode Island. Confidential

health care information may only be accessed, released, or transferred from the HIE in

accordance with this chapter.

     (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

all interested parties, including, but not limited to, health care providers, patients, health plans,

entities submitting information to the HIE, entities obtaining information from the HIE, and the

RHIO. The Rhode Island department of health is also considered a participant for public health

purposes.

     (c) Patients and health care providers shall have the choice to participate in the HIE, as

defined by regulations in accordance with § 5-37.7-3; provided, however, that provider

participants must continue to maintain their own medical record meeting the documentation and

other standards imposed by otherwise applicable law.

     (d) Participation in the HIE shall have no impact on the content of, or use or disclosure

of, confidential health care information of patient participants that is held in locations other than

the HIE. Nothing in this chapter shall be construed to limit, change, or otherwise affect entities'

rights to exchange confidential health care information in accordance with other applicable laws.

     (e) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

associate agreements, including, without limitation, the obligations to use appropriate safeguards

to prevent use or disclosure of confidential health care information in accordance with HIPAA

and this chapter; not to use or disclose confidential health care information other than as

LC000997 - Page 4 of 7

permitted by HIPAA and this chapter; or to make any amendment to a confidential health care

record that a provider participant so directs; and to respond to a request by a patient participant to

make an amendment to the patient participant's confidential health care record.

     (f) In furtherance of the goal of participation by all interested parties, the HIE advisory

commission shall provide its feedback to the department of health and the RHIO regarding the

establishment of standards and infrastructure needed for statewide EHR interoperability. EHRs

should facilitate semantic interoperability across all health care provider venues, which means not

only allowing providers to export data, but also to properly incorporate external data from other

systems.

     5-37.7-5. Regulatory oversight.

     (a) The director of the department of health shall develop regulations regarding the

confidentiality of patient participant information received, accessed or held by the HIE and is

authorized to promulgate such other regulations as the director deems necessary or desirable to

implement the provisions of this chapter, in accordance with the provisions set forth in chapter 17

of title 23 and chapter 35 of title 42 of the general laws.

     (b) The department of health has exclusive jurisdiction over the HIE, except with respect

to the jurisdiction conferred upon the attorney general in § 5-37.7-13. This chapter shall not apply

to any other private and/or public health information systems utilized within a health care

provider or other organization that provides health care services.

     (c) The department of health shall promulgate rules and regulations for the establishment

of an HIE advisory commission that will be responsible for recommendations relating to the use

of, and appropriate confidentiality protections for, the confidential health care information of the

HIE, subject to regulatory oversight by the department of health. The HIE advisory commission

shall consider the interoperability strategic plan developed by the Rhode Island quality institute,

and present its review to the department of health and the RHIO regarding the implementation of

national interoperability standards statewide and the infrastructure required to support the

statewide electronic exchange and use of confidential health care information in a secure, private

and accurate manner across all EHR systems. Such strategic plan shall include provisions for

maintaining a reliable method of identity management across EHR systems, as well as the need

for semantic interoperability, and a detailed plan for protecting the systems from security

breaches. Said commission members shall be subject to the advice and consent of the senate. The

commission shall report annually to the department of health and the RHIO, and such report shall

be made public.

     5-37.7-6. Rhode Island health information organization.

LC000997 - Page 5 of 7

     The RHIO shall, subject to and consistent with department regulations and contractual

obligations it has with the state of Rhode Island, be responsible for implementing recognized

national standards for interoperability and all administrative, operational, and financial functions

to support the HIE, including, but not limited to, implementing and enforcing policies for

receiving, retaining, safeguarding and disclosing confidential health care information as required

by this chapter. The RHIO is deemed to be the steward of the confidential health care information

for which it has administrative responsibility. The HIE advisory commission shall be responsible

for considering the strategic plan regarding EHR interoperability developed by the Rhode Island

quality institute and presenting its review recommendations to the department of health, and in

consultation with the RHIO regarding consider the use of the confidential health care information

and the needed infrastructure and use of national standards for EHR interoperability across the

state.

     SECTION 2. This act shall take effect upon passage.

========

LC000997

========

LC000997 - Page 6 of 7

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS -- RHODE ISLAND INFORMATION

EXCHANGE ACT OF 2008

***

     This act would charge the health information exchange advisory commission with

developing a strategic plan and making recommendations to the department of health and the

regional health information organization regarding the standards and infrastructure needed for the

interoperability of electronic health record systems.

     This act would take effect upon passage.

========

LC000997

========

LC000997 - Page 7 of 7