65-6825. Same; use and disclosure of protected health information. (a) No covered entity shall use or disclose protected health information except as follows:

(1) Use and disclosure of protected health information consistent with an authorization that satisfies the requirements of 45 C.F.R. § 164.508;

(2) use and disclosure of protected health information without an authorization as permitted under 45 C.F.R. §§ 164.502, 164.506, 164.508, 164.510 and 164.512; or

(3) use and disclosure of protected health information as required under 45 C.F.R. § 164.502.

(b) Notwithstanding the provisions of subsection (a), no covered entity shall disclose an individual’s protected health information to a health information organization for any purpose without an authorization that satisfies the requirements of 45 C.F.R. § 164.508, unless such covered entity:

(1) Is a party to a current participation agreement with an approved HIO at the time the disclosure is made;

(2) discloses the individual’s protected health information to that approved HIO in a manner consistent with the approved HIO’s established procedures;

(3) prior to the disclosure, has furnished to the individual, or such individual's personal representative, whose information is to be disclosed to the approved HIO, the notice required under K.S.A. 2012 Supp. 65-6832, and amendments thereto; and

(4) restricts disclosure to the approved HIO of any protected health information concerning the individual that is the subject of a written request delivered to the covered entity by the individual, or such individual's personal representative, for reasonable restrictions on disclosure of all or any specified categories of the individual’s protected health information, as defined pursuant to K.S.A. 2012 Supp. 65-6832, and amendments thereto, following the covered entity’s receipt of such written request.

(c) Notwithstanding the provisions of subsections (a) and (b), a covered entity that uses or discloses protected health information in compliance with this section shall be immune from any civil or criminal liability or any adverse administrative action arising out of or relating to such use or disclosure.

(d) This section shall take effect on and after July 1, 2011.

History: L. 2011, ch. 114, § 25; June 9.