Current through Register 2024 Notice Reg. No. 12, March 22, 2024
(a) Prior to the approval of any
demonstration project, the Applicant must provide CalOHII with copies of:
(1) The Applicant's Notice of Privacy
Practices created pursuant to
45 C.F.R. §
164.520.
(2) The Applicant's Participants Agreement
and a list of the entities included in the agreement.
(3) A description of the Applicant's
complaint mechanism required by §
126040(d),
including any documentation or patient educational materials related to the
complaint process.
(b)
Once a demonstration project is approved, but prior to the start of the
demonstration project, within a specified time frame negotiated with and
approved by CalOHII, the Demonstration Project Participant must provide:
(1) If the Demonstration Project Participant
is a HIO, a list of all parties who have signed the HIO's Participant
Agreement, with their contact information and a general description of the
service(s) provided, including the data shared, the purpose, and whether
further dissemination of the data is allowed, regardless of whether the
information is de-identified.
(2)
If the Demonstration Project Participant is not a HIO, a list of all of the
Participant's current business associates with electronic access to individual
health information disclosed through the demonstration project, with their
contact information and a general description of the service(s) provided,
including the data shared, the purpose, and whether further dissemination of
the data is allowed, regardless of whether the information is
de-identified.
(3) If a new
business associate is added after the start of the project, or a business
associate agreement is modified, the Demonstration Project Participant must
provide CalOHII with an updated list quarterly.
(4) In CalOHII's discretion, CalOHII may
require copies of the Demonstration Project Participant's business associate
agreements be provided to CalOHII. The Participant shall provide copies within
five working days from the receipt of written request from
CalOHII.
(c) All
unauthorized electronic disclosures or access of individual health information
shall be reported by the Demonstration Project Participant to CalOHII within
thirty (30) business days of the detection of the unauthorized access or
disclosure. Good faith acquisition of IHI by an employee or agent within the
course of coordinating care or delivering treatment services, provided that IHI
is not used or subject to further unauthorized disclosure do not need to be
reported. A report to CalOHII under this provision does not relieve the
Demonstration Project Participant from any requirement under any local, state,
or federal law.
(d) A Demonstration
Project Participant must ensure there is a mechanism to receive and respond to
patient complaints.
(1) Complaints associated
with the demonstration project shall be reported and forwarded to CalOHII
quarterly and include the Demonstration Project Participant's response to any
complaint regarding the demonstration project.
(2) Complaints reflecting significant risk to
patient privacy and confidentiality of individual health information or patient
health and safety attributable to the demonstration project shall be reported
by the Demonstration Project Participant to CalOHII
immediately.
1. New section
filed 1-31-2012; operative 1-31-2012. Exempt from the rulemaking requirements
of the Administrative Procedure Act and submitted to OAL for printing only
pursuant to Health and Safety Code section
130278
(Register 2012, No. 5).
Note: Authority cited: Sections
130277
and
130278,
Health and Safety Code. Reference: Sections
130200,
130277
and
130279,
Health and Safety Code.
