65-6832. Same; participation agreements; specification of procedures and requirements. (a) The corporation shall establish requirements for participation agreements to include the following:

(1) Specification of procedures for the covered entity to disclose an individual’s protected health information to the approved HIO;

(2) specification of procedures for the covered entity to access an individual’s protected health information from the approved HIO;

(3) specification of the written notice to be provided by the covered entity to any individual, or such individual's personal representative, prior to the covered entity’s disclosure of the individual’s protected health information to the approved HIO. Such written notice, which may be incorporated into the covered entity’s notice of privacy practices required under the HIPAA privacy rule, shall include the following that:

(A) The individual’s protected health information will be disclosed to the approved HIO to facilitate the provision of health care to the individual;

(B) the approved HIO maintains appropriate safeguards to protect the privacy and security of protected health information;

(C) only authorized individuals may access protected health information from the approved HIO;

(D) the individual, or such individual's personal representative, has the right to request in writing that the covered entity: (i) Not disclose any of the individual’s protected health information to the approved HIO; or (ii) not disclose specified categories of the individual’s protected health information to the approved HIO;

(E) such restrictions may result in a health care provider not having access to information necessary to provide appropriate care for the individual;

(F) the covered entity is required to honor a written request delivered to the covered entity by an individual, or such individual's representative, not to disclose any of the individual’s protected health information to an approved HIO; and

(G) the covered entity is required to honor a written request delivered to the covered entity by an individual, or such individual's representative, for reasonable restrictions on the disclosure of specified categories of the individual’s protected health information to an approved HIO.

(4) specification of documentation requirements to demonstrate delivery of such notice to an individual, or such individual's personal representative, by or on behalf of the covered entity prior to the covered entity’s disclosure of the individual’s protected health information to the approved HIO;

(5) standards for determining the reasonableness of an individual’s written request, or the written request of such individual's personal representative, not to disclose specified categories of the individual’s protected health information to the approved HIO based on the covered entity’s technological capabilities; and

(6) specification of the purposes for which a covered entity may access protected health information through the approved HIO.

(b)  This section shall take effect on and after July 1, 2011.

History: L. 2011, ch. 114, § 32; June 9.