65-6832. Same; participation agreements; specification of procedures and requirements. The department shall establish requirements to be used by approved health information organizations in participation agreements with covered entities and shall include the following:

(a) Specification of procedures by which an individual's protected health information will be disclosed by covered entities, will be collected by approved health information organizations and will be shared with other participating covered entities and with the department as required by law for public health purposes;

(b) specification of procedures by which an individual may elect that protected health information be restricted from disclosure by approved health information organizations to covered entities;

(c) specifications of purposes for, and procedures by which a covered entity can access an individual's protected health information from the approved health information organization, including access to restricted information by a covered entity in an emergency situation when necessary to properly treat the individual;

(d) specification of the written notice to be provided by the covered entity to any individual, or such individual's personal representative that explains how and what protected health information will be shared with the approved health information organization. Such written notice, which may be incorporated into the covered entity's notice of privacy practices required under the HIPAA privacy rule, shall include the following that:

(1) The individual's protected health information will be disclosed to the approved health information organization to facilitate the provision of health care to the individual;

(2) the approved health information organization maintains appropriate safeguards to protect the privacy and security of protected health information;

(3) only authorized individuals may access protected health information from the approved health information organization;

(4) the individual, or such individual's personal representative, has the right to request in writing that the individual's protected health information not be disclosed by the health information organization;

(5) the health information organization is required to honor a written request not to disclose an individual's protected health information, except that disclosure is permitted (A) in an emergency situation when necessary to properly treat the individual, or (B) when necessary to satisfy a covered entity's legal obligation to report certain information to a government official; and

(6) the inability to access restricted information by a covered entity may result in a health care provider not having access to information necessary to provide appropriate care for the individual;

(e) specification of documentation requirements to demonstrate delivery of such notice to an individual, or such individual's personal representative, by or on behalf of the covered entity.

History: L. 2011, ch. 114, § 32; L. 2013, ch. 112, § 17; July 1.