2008 -- S 2679 SUBSTITUTE A AS AMENDED

=======

LC01827/SUB A/2

=======

STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2008

____________

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - THE RHODE ISLAND HEALTH

INFORMATION EXCHANGE ACT OF 2008

     Introduced By: Senators Paiva-Weed, Perry, C Levesque, Blais, and Bates

     Date Introduced: February 26, 2008

     Referred To: Senate Health & Human Services

It is enacted by the General Assembly as follows:

1-1

     SECTION 1. Legislative findings:

1-2

     WHEREAS, the people of Rhode Island expect health care services to be high quality,

1-3

safe and of high value; and

1-4

     WHEREAS, the implementation of health information technology including electronic

1-5

medical records and the use of electronic prescribing increases the quality of health care delivery

1-6

and the prevention of medication errors; and

1-7

     WHEREAS, the implementation of health information technology will support a

1-8

transformed health care system in Rhode Island that is safe, effective, patient-centered, timely,

1-9

efficient and equitable; and

1-10

     WHEREAS, the General Assembly has endorsed the adoption of an electronic medical

1-11

records and health information exchange system in Rhode Island to improve the quality, safety

1-12

and value of health care through a Resolution adopted in 2007; and

1-13

     WHEREAS, the State of Rhode Island has an interest in encouraging the implementation

1-14

of a statewide health information exchange system to allow the widespread utilization of

1-15

electronic health records by health care providers; and

1-16

     WHEREAS, the State of Rhode Island has an interest in popularizing the use of a

1-17

statewide Health Information Exchange system ("HIE") in order to improve the quality, safety

1-18

and value of health care, keep confidential health information secure and confidential and use the

2-1

HIE system to progress toward meeting public health goals; and

2-2

     WHEREAS, the State of Rhode Island desires to establish the authority for the

2-3

Department of Health to regulate the statewide HIE system.

2-4

     SECTION 2. Title 5 of the General Laws entitled "BUSINESSES AND PROFESSIONS"

2-5

is hereby amended by adding thereto the following chapter:

2-6

     CHAPTER 37.7

2-7

RHODE ISLAND HEALTH INFORMATION EXCHANGE ACT OF 2008

2-8

     5-37.7-1. Short title. -- This chapter shall be known and may be cited as the "Rhode

2-9

Island Health Information Exchange Act of 2008."

2-10

     5-37.7-2. Statement of purpose. -- The purpose of this chapter is to establish safeguards

2-11

and confidentiality protections for the HIE in order to improve the quality, safety and value of

2-12

health care, keep confidential health information secure and confidential and use the HIE to

2-13

progress toward meeting public health goals.

2-14

     5-37.7-3. Definitions. -- As used in this chapter:

2-15

     (a) "Agency" means the Rhode Island department of health.

2-16

     (b) "Authorized representative" means:

2-17

     (1) A person empowered by the patient participant to assert or to waive the

2-18

confidentiality, or to disclose or authorize the disclosure of confidential information, as

2-19

established by this chapter. That person is not, except by explicit authorization, empowered to

2-20

waive confidentiality or to disclose or consent to the disclosure of confidential information; or

2-21

     (2) A person appointed by the patient participant to make health care decisions on his or

2-22

her behalf through a valid durable power of attorney for health care as set forth in Rhode Island

2-23

general laws section 23-4.10-2; or

2-24

     (3) A guardian or conservator, with authority to make health care decisions, if the patient

2-25

participant is decisionally impaired; or

2-26

     (4) Another legally appropriate medical decision maker temporarily if the patient

2-27

participant is decisionally impaired and no health care agent, guardian or conservator is available;

2-28

or

2-29

     (5) If the patient participant is deceased, his or her personal representative or, in the

2-30

absence of that representative, his or her heirs-at-law; or

2-31

     (6) A parent with the authority to make health care decisions for the parent's child.

2-32

     (c) "Authorization form" means the form described in section 5-37.7-7 of this chapter and

2-33

by which a patient participant provides authorization for the RHIO to allow access to, review of,

2-34

and/or disclosure of the patient participant's confidential health care information by electronic,

3-1

written or other means.

3-2

     (d) "Business associate" means a business associate as defined by HIPAA.

3-3

     (e) "Confidential health care information" means all information relating to a patient

3-4

participant's health care history, diagnosis, condition, treatment, or evaluation.

3-5

     (f) "Coordination of care" means the process of coordinating, planning, monitoring,

3-6

and/or sharing information relating to and assessing a care plan for treatment of a patient.

3-7

     (g) "Data submitting partner" means an individual, organization or entity that has entered

3-8

into a business associate agreement with the RHIO and submits patient participants' confidential

3-9

health care information through the HIE.

3-10

     (h) "Department of health" means the Rhode Island department of health.

3-11

     (i) "Disclosure report" means a report generated by the HIE relating to the record of

3-12

access to, review of and/or disclosure of a patient's confidential health care information received,

3-13

accessed or held by the HIE.

3-14

     (j) "Electronic mobilization" means the capability to move clinical information

3-15

electronically between disparate health care information systems while maintaining the accuracy

3-16

of the information being exchanged.

3-17

     (k) "Emergency" means the sudden onset of a medical, mental or substance abuse or

3-18

other condition manifesting itself by acute symptoms of severity (e.g. severe pain) where the

3-19

absence of medical attention could reasonably be expected, by a prudent lay person, to result in

3-20

placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions,

3-21

or serious dysfunction of any bodily organ or part.

3-22

     (l) "Health care provider" means any person or entity licensed by this state to provide or

3-23

lawfully providing health care services, including, but not limited to, a physician, hospital,

3-24

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

3-25

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

3-26

employee, or agent of that provider acting in the course and scope of his or her employment or

3-27

agency related to or supportive of health care services.

3-28

     (m) "Health care services" means acts of diagnosis, treatment, medical evaluation,

3-29

referral or counseling or any other acts that may be permissible under the health care licensing

3-30

statutes of this state.

3-31

     (n) "Health Information Exchange" or "HIE" means the technical system operated, or to

3-32

be operated, by the RHIO under state authority allowing for the statewide electronic mobilization

3-33

of confidential health care information, pursuant to this chapter.

3-34

     (o) "HIE Advisory Commission" means the advisory body established by the department

4-1

of health in order to provide community input and policy recommendations regarding the use of

4-2

the confidential health care information of the HIE.

4-3

     (p) "HIPAA" means the health insurance portability and accountability act of 1996, as

4-4

amended.

4-5

     (q) "Participant" means a patient participant, a patient participant's authorized

4-6

representative, a provider participant, a data submitting partner, the regional health information

4-7

organization and the department of health, that has agreed to authorize, submit, access and/or

4-8

disclose confidential health care information via the HIE in accordance with this chapter.

4-9

     (r) "Participation" means a participant's authorization, submission, access and/or

4-10

disclosure of confidential health care information in accordance with this chapter.

4-11

     (s) "Patient participant" means a person who receives health care services from a provider

4-12

participant and has agreed to participate in the HIE through the mechanisms established in this

4-13

chapter.

4-14

     (t) "Provider participant" means a pharmacy, laboratory or health care provider who is

4-15

providing health care services to a patient participant and/or is submitting or accessing health care

4-16

information through the HIE and has executed an electronic and/or written agreement regarding

4-17

disclosure, access, receipt, retention or release of confidential health care information to the HIE;

4-18

     (u) "Regional health information organization" or "RHIO" means the organization

4-19

designated as the RHIO by the state to provide administrative and operational support to the HIE.

4-20

     5-37.7-4. Participation in the health information exchange. -- (a) There shall be

4-21

established a statewide HIE under state authority to allow for the electronic mobilization of

4-22

confidential health care information in Rhode Island. Confidential health care information may

4-23

only be accessed, released or transferred from the HIE in accordance with this chapter.

4-24

     (b) The state of Rhode Island has an interest in encouraging participation in the HIE by

4-25

all interested parties, including, but not limited to, health care providers, patients, entities

4-26

submitting information to the HIE, entities obtaining information from the HIE and the RHIO.

4-27

The Rhode Island department of health is also considered a participant for public health purposes.

4-28

     (c) Patients and health care providers shall have the choice to participate in the HIE, as

4-29

defined by regulations in accordance with section 5-37.7-3 provided however that provider

4-30

participants must continue to maintain their own medical record meeting the documentation and

4-31

other standards imposed by otherwise applicable law.

4-32

     (d) Participation in the HIE shall have no impact on the content of or use or disclosure of

4-33

confidential health care information of patient participants that is held in locations other than the

4-34

HIE. Nothing in this chapter shall be construed to limit, change or otherwise affect entities' rights

5-1

or obligations to exchange confidential health care information in accordance with other

5-2

applicable laws.

5-3

     (e) The state of Rhode Island hereby imposes on the HIE and the RHIO as a matter of

5-4

state law, the obligation to maintain, and abide by the terms of, HIPAA complaint business

5-5

associate agreements, including, without limitation, the obligations to use appropriate safeguards

5-6

to prevent use or disclosure of confidential health care information in accordance with HIPAA

5-7

and this chapter, not to use or disclose confidential health care information other than as

5-8

permitted by HIPAA and this chapter, or to make any amendment to a confidential health care

5-9

record that a provider participant so directs and to respond to a request by a patient participant to

5-10

make an amendment to the patient participant's confidential health care record.

5-11

     5-37.7-5. Regulatory oversight. -- (a) The director of the department of health shall

5-12

develop regulations regarding the confidentiality of patient participant information received,

5-13

accessed or held by the HIE and is authorized to promulgate such other regulations as the director

5-14

deems necessary or desirable to implement the provisions of this chapter, in accordance with the

5-15

provisions set forth in chapter 17 of title 23 and chapter 35 of title 42 of the general laws.

5-16

     (b) The department of health has exclusive jurisdiction over the HIE, except with respect

5-17

to the jurisdiction conferred upon the attorney general in section 5-37.7-13. This chapter shall not

5-18

apply to any other private and/or public health information systems utilized within a health care

5-19

provider or other organization that provides health care services.

5-20

     (c) The department of health shall promulgate rules and regulations for the establishment

5-21

of an HIE advisory commission that will be responsible for recommendations relating to the use

5-22

of, and appropriate confidentiality protections for, the confidential health care information of the

5-23

HIE, subject to regulatory oversight by the department of health. Said commission members shall

5-24

be subject to the advice and consent of the senate. The commission shall report annually to the

5-25

department of health and the RHIO, and such report shall be made public.

5-26

     5-37.7-6. Rhode Island health information organization. -- The RHIO shall, subject to

5-27

and consistent with department regulations and contractual obligations it has with the state of

5-28

Rhode Island, be responsible for all administrative, operational, and financial functions to support

5-29

the HIE, including, but not limited to, implementing and enforcing policies for receiving,

5-30

retaining, safeguarding and disclosing confidential health care information as required by this

5-31

chapter. The RHIO is deemed to be the steward of the confidential health care information for

5-32

which it has administrative responsibility. The HIE advisory commission shall be responsible for

5-33

recommendations to the department of health, and in consultation with the RHIO regarding the

5-34

use of the confidential health care information.

6-1

     5-37.7-7. Disclosure. -- (a)(1) Except as provided in subsection (b) of this section, a

6-2

patient participant's confidential health care information may only be accessed, released or

6-3

transferred from the HIE in accordance with an authorization form signed by the patient

6-4

participant or the patient's authorized representative.

6-5

     (b) No authorization for release or transfer of confidential health care information from

6-6

the HIE shall be required in the following situations:

6-7

     (1) To a health care provider who believes, in good faith, that the information is

6-8

necessary for diagnosis or treatment of that individual in an emergency; or

6-9

     (2) To public health authorities in order to carry out their functions as described in this

6-10

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

6-11

are not restricted to, investigations into the causes of disease, the control of public health hazards,

6-12

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

6-13

health professionals and facilities, review of health care such as that required by the federal

6-14

government and other governmental agencies, and mandatory reporting laws set forth in Rhode

6-15

Island general laws; and

6-16

     (3) To the RHIO in order for it to effectuate the operation and administrative oversight of

6-17

the HIE.

6-18

     (c) The content of the authorization form for access to, or the disclosure, release or

6-19

transfer of confidential health care information from the HIE shall be prescribed by the RHIO in

6-20

accordance with applicable department of health regulations, but at a minimum shall contain the

6-21

following information in a clear and conspicuous manner:

6-22

     (1) A statement of the need for and proposed uses of that information; and

6-23

     (2) A statement that the authorization for access to, disclosure of and/or release of

6-24

information may be withdrawn at any future time and is subject to revocation.

6-25

     (3) That the patient has the right not to participate in the HIE; and

6-26

     (4) The patient's right to choose to: (i) enroll in and participate fully in the HIE; or (ii)

6-27

designate only specific health care providers that may access the patient participant's confidential

6-28

health care information.

6-29

     (d) Except as specifically provided by law or this chapter, or use for clinical care, a

6-30

patient participant's confidential health care information shall not be accessed by, given, sold,

6-31

transferred, or in any way relayed from the HIE to any other person or entity not specified in the

6-32

patient participant authorization form meeting the requirements of subsection (c) of this section

6-33

without first obtaining additional authorization.

6-34

     (e) Nothing contained in this chapter shall be construed to limit the permitted access to or

7-1

the release, transfer, access or disclosure of confidential health care information described in

7-2

subsection (b) of this section or under other applicable law.

7-3

     (f) Confidential health care information received, disclosed or held by the HIE shall not

7-4

be subject to subpoena directed to the HIE or RHIO unless the following procedures have been

7-5

completed: (i) the person seeking the confidential health care information has already requested

7-6

and received the confidential health care information from the health care provider that was the

7-7

original source of the information; and (ii) a determination has been made by the superior court

7-8

upon motion and notice to the HIE or RHIO and the parties to the litigation in which the

7-9

subpoena is served that the confidential health care information sought from the HIE is not

7-10

available from another source and is either relevant to the subject matter involved in the pending

7-11

action or is reasonably calculated to lead to the discovery of admissible evidence in such pending

7-12

action. Any person issuing a subpoena to the HIE or RHIO pursuant to this section shall certify

7-13

that such measures have been completed prior to the issuance of the subpoena.

7-14

     (g) Nothing herein shall interfere with or impact upon any rights or obligations imposed

7-15

by the Workers Compensation Act as contained in title 28, chapters 29 through 38, of these

7-16

General Laws.

7-17

     5-37.7-8. Security. -- The HIE must be subject to at least the following security

7-18

procedures:

7-19

     (a) Authenticate the recipient of any confidential health care information disclosed by the

7-20

HIE pursuant to this chapter pursuant to rules and regulations promulgated by the agency.

7-21

     (b) Limit authorized access to personally identifiable confidential health care information

7-22

to persons having a need to know that information; additional employees or agents may have

7-23

access to de-identified information;

7-24

     (c) Identify an individual or individuals who have responsibility for maintaining security

7-25

procedures for the HIE;

7-26

     (d) Provide an electronic or written statement to each employee or agent as to the

7-27

necessity of maintaining the security and confidentiality of confidential health care information,

7-28

and of the penalties provided for in this chapter for the unauthorized access, release, transfer, use,

7-29

or disclosure of this information;

7-30

     (e) Take no disciplinary or punitive action against any employee or agent for bringing

7-31

evidence of violation of this chapter to the attention of any person.

7-32

     5-37.7-9. Secondary disclosure. -- Any confidential health care information obtained by

7-33

a provider participant pursuant to this chapter may be further disclosed by such provider

7-34

participant with or without authorization of the patient participant to the same extent that such

8-1

information may be disclosed pursuant to existing state and federal law, without regard to the

8-2

source of the information.

8-3

     5-37.7-10. Patient's rights. -- Pursuant to this chapter, a patient participant who has his

8-4

or her confidential health care information transferred through the HIE shall have the following

8-5

rights:

8-6

     (a) To obtain a copy of his or her confidential health care information from the HIE;

8-7

     (b) To obtain a copy of the disclosure report pertaining to his or her confidential health

8-8

care information;

8-9

     (c) To be notified as required by chapter 49.2 of title 11, the Rhode Island identity theft

8-10

protection act, of a breach of the security system of the HIE;

8-11

     (d) To terminate his or her participation in the HIE in accordance with rules and

8-12

regulations promulgated by the agency; and

8-13

     (e) To request to amend his or her own information through the provider participant.

8-14

     5-37.7-11. Immunity. -- Any health care provider who relies in good faith upon any

8-15

information provided through the HIE in his, her or its treatment of a patient, shall be immune

8-16

from any criminal or civil liability arising from any damages caused by such good faith reliance.

8-17

This immunity does not apply to acts or omissions constituting negligence or reckless, wanton or

8-18

intentional misconduct.

8-19

     5-37.7-12. Reconciliation with other authorities. -- (a) This chapter shall only apply to

8-20

the HIE system, and does not apply to any other private and/or public health information systems

8-21

utilized in Rhode Island, including other health information systems utilized within or by a health

8-22

care facility or organization.

8-23

     (b) As this chapter provides extensive protection with regard to access to and disclosure

8-24

of confidential health care information by the HIE, it supplements, with respect to the HIE only,

8-25

any less stringent disclosure requirements, including, but not limited to, those contained in

8-26

chapter 37.3 of this title, the health insurance portability and accountability act (HIPAA) and

8-27

regulations promulgated thereunder, and any other less stringent federal or state law.

8-28

     (c) This chapter shall not be construed to interfere with any other federal or state laws or

8-29

regulations which provide more extensive protection than provided in this chapter for the

8-30

confidentiality of health care information. Notwithstanding such provision, because of the

8-31

extensive protections with regard to access to and disclosure of confidential health care

8-32

information by the HIE provided for in this chapter, patient authorization obtained for access to or

8-33

disclosure of information to or from the HIE or a provider participant shall be deemed the same

8-34

authorization required by other state or federal laws including information regarding mental

9-1

health (the Rhode Island mental health law, Rhode Island general laws section 40.1-5-1 et seq.);

9-2

HIV (Rhode Island general laws section 23-6-17); sexually transmitted disease (Rhode Island

9-3

general laws sections 23-6-17 and 23-11-9); alcohol and drug abuse (Rhode Island general laws

9-4

section 23-1.10-1 et seq., 42 U.S.C. section 290dd-2) or genetic information (Rhode Island

9-5

general laws section 27-41-53, Rhode Island general laws section 27-20-39 and Rhode Island

9-6

general laws section 27-19-44).

9-7

     5-37.7-13. Penalties – Attorneys' fees for violations. -- (a) Civil penalties. Anyone who

9-8

violates the provisions of this chapter may be held liable for actual and exemplary damages.

9-9

     (b) Criminal penalties. Anyone who intentionally and knowingly violates the provisions

9-10

of this chapter shall, upon conviction, be fined not more than ten thousand dollars ($10,000) per

9-11

patient, per violation, or imprisoned for not more than one year, or both.

9-12

     (c) Commission of crime. The civil and criminal penalties in this section shall also be

9-13

applicable to anyone who obtains confidential health care information maintained under the

9-14

provisions of this chapter through the commission of a crime.

9-15

     (d) Attorneys' fees. Attorneys' fees may be awarded at the discretion of the court, to the

9-16

successful party in any action under this chapter.

9-17

     5-37.7-14. Waivers void. -- Any agreement purporting to waive the provisions of this

9-18

chapter is declared to be against public policy and void.

9-19

     5-37.7-15. Severability. -- If any provision of this chapter is held by a court to be invalid,

9-20

that invalidity shall not affect the remaining provisions of the chapter, and to this end the

9-21

provisions of the chapter are declared severable.

9-22

     SECTION 3. This act shall take effect on March 1, 2009.

=======

LC01827/SUB A/2

========

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - THE RHODE ISLAND HEALTH

INFORMATION EXCHANGE ACT OF 2008

***

10-1

     This act would establish the "Rhode Island Health Information Exchange Act of 2008"

10-2

for the purpose of providing safeguards and confidentiality protection for health information

10-3

exchange.

10-4

     This act would take effect on March 1, 2009.

=======

LC01827/SUB A/2

=======

2008 -- S 2679 H.

SUBSTITUTE A

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - THE RHODE ISLAND HEALTH

INFORMATION EXCHANGE ACT OF 2008

=======

LC01827/SUB A/2

=======

======================================================================

Presented by