Code of Maryland Regulations, Chapter 10.25.18, Section 10.25.18.03 - Rights of a Health Care Consumer Concerning Information Accessed, Used, or Disclosed Through an HIE | Code of Maryland Regulations

A. A health care consumer has the following rights in accordance with the requirements specified in this section:

(1) The right to have information regarding the health care consumer's rights under these regulations readily available to assist the health care consumer in making an informed decision concerning:

(a) The accessibility of a patient's protected health information electronically through an HIE; and

(b) The risks and benefits of participating in the HIE.

(2) The right to opt out of an HIE.

(a) A health care consumer has the right to opt out of an HIE at any time and refuse access to the patient's PHI through an HIE, except when a disclosure is limited to:

(i) Core elements of the MPI;

(ii) A disclosure that a person is required to make under federal or State law requirements;

(iii) Results of a diagnostic procedure sent to the health care provider who ordered the procedure or another provider as designated by the ordering provider;

(iv) Information regarding prescription medications dispensed or filled by a pharmacy, sent to the health care provider who ordered the prescriptions or another health care provider as designated by the ordering health care provider;

(v) Public health authorities for reporting purposes required, authorized, or otherwise compliant with applicable law; or

(vi) Communications permitted under HIPAA or State law without a health care consumer's consent or authorization when using point-to-point.

(b) Provided, however, that §A(2)(a)(iii), (iv), and (vi) of this regulation shall not apply to disclosures of sensitive health information, which receive additional protections consistent with Regulation .04 of this chapter.

(c) A health care consumer shall be advised in writing by the HIE receiving the opt out notice or request that opting out does not preclude any participating organization that has received or accessed PHI via the HIE prior to such opt out, and incorporated such PHI into its records, from retaining such information in its records.

(3) The right to the additional protections to and restrictions for disclosure of a patient's sensitive health information provided by State or federal law and consistent with Regulation .04 of this chapter.

(4) The right to resume participation in an HIE after previously opting out in accordance with these regulations. Any such resumption of participation shall be upon written notice or request by the health care consumer.

B. An HIE shall provide needed information about the HIE to a health care consumer whose protected health information is maintained by a health information exchange, or may be accessed, used, or disclosed through the HIE.

(1) An HIE shall develop, adopt, implement, and keep current a health care consumer education plan that considers stakeholder input.

(a) The health care consumer education plan shall include the core HIE education content as defined in Regulation .02 of this chapter.

(b) The health care consumer education plan shall outline how the HIE will make available the following information to health care consumers:

(i) A description of each type of patient health information that may be used, accessed or disclosed through the HIE;

(ii) The health information maintained by the HIE;

(iii) The specific details concerning who may access, use, or disclose a patient's health information and for what purpose;

(iv) The privacy and security measures that the HIE has implemented to protect health information, and a detailed explanation of what happens if there is a breach that results in unauthorized access to protected health information;

(v) A health care consumer's rights regarding the HIE and the control over, protection of, use of, and correction of each type of health information;

(vi) The process provided for a health care consumer to exercise the health care consumer's rights, including a detailed description of the steps a health care consumer needs to take in order to opt out from participation in the HIE;

(vii) The implications of a health care consumer's decision to opt out of participation in an HIE and not permit the disclosure of that consumer's PHI to authorized users, except as otherwise permitted under applicable law; and

(viii) The HIE's policies and procedures, including without limitation, policies and procedures consistent with these regulations regarding how the health care consumer may gain access to the patient's health information.

(2) An HIE shall develop and implement health care consumer education materials as provided in §B(1) of this regulation. Such education materials shall have the following characteristics:

(a) Provide a balanced perspective, outlining the various points of view concerning each subject matter, including the risks and benefits associated with sharing protected health information electronically through the HIE;

(b) Are not inaccurate or misleading;

(c) Minimize the use of technical terms and, when such terms are necessary, clearly define the technical terms;

(d) Use plain language that is easily understandable to each health care consumer population served, taking into account the various levels of education, understanding, and interest across that population;

(e) Use text and illustrations that are culturally sensitive, language appropriate, and that recognize user diversity including ethnicity, age, race, and gender;

(f) Update material to include and incorporate new information; and

(g) Specify the time sensitivity of any material included.

(3) An HIE shall cooperate with applicable State agencies to educate health care consumers consistent with a statewide education plan approved by such applicable State agency.

(4) An HIE shall make health care consumer educational materials readily available, at no charge, to participating organizations and the participating organizations' users through distribution channels such as websites, postal mail, email, secure third-party smart phone applications, and any other reasonable media or distribution channel commonly used and generally available to the HIE and health care consumer.

(5) In addition to the foregoing requirements, with regard to sensitive health information, the health care consumer educational content shall include:

(a) The scope of sensitive health information;

(b) The health care consumer's right to control sensitive health information;

(c) The method by which to engage in the granular patient consent process;

(d) The method or methods by which the health care consumer can access the patient's own sensitive health information;

(e) The circumstances under which an HIE must restrict or may disclose legally protected health information; and

(f) The method by which a health care consumer can request that a patient's legally protected health information be disclosed to a specific health care provider.

(6) When an HIE updates its health care consumer educational content, the HIE shall timely make the updated materials available to health care consumers.

C. An HIE shall comply with the following requirements to allow a health care consumer to obtain information concerning a patient's PHI that may be available through the HIE.

(1) An HIE shall provide the following information to the health care consumer, upon written notice or request by the health care consumer, describing what PHI is available through the HIE concerning the specified patient:

(a) The participating organization that disclosed the PHI to the HIE;

(b) The date the PHI was disclosed to the HIE; and

(c) The type of PHI disclosed to the HIE, if known by the HIE.

(2) An HIE shall provide written information, in accordance with this Regulation, to health care consumers concerning the methods available to such health care consumers to access a patient's PHI that is available through the HIE.

(a) If the patient's PHI is directly available electronically to the health care consumer through the HIE, the HIE shall advise the health care consumer how to obtain the PHI electronically.

(b) If the patient's PHI is not directly available electronically to the health care consumer through the HIE, the HIE shall, within 7 days from receipt of such health care consumer's written notice or request, provide the health care consumer with the contact information for each participating organization that has disclosed information to the HIE and received information from the HIE concerning the patient, so that the health care consumer may gain access to the patient's health information directly from each participating organization.

(3) An HIE shall make a good faith effort to facilitate a health care consumer's amendment of the patient's health information available through the HIE by informing the health care consumer how to seek amendment of the information.

(a) An HIE shall send information regarding the process for amending health information being made available through the HIE within 20 days of receiving notice from a health care consumer of a desire to amend the patient's health information available through the HIE and shall include the contact information of relevant participating organizations that provided the information; and

(b) This process shall be in accordance with the requirements specified in Health-General Article, §4-304(b), Annotated Code of Maryland and HIPAA, including 45 CFR § 164.526.

(c) An HIE shall make a good faith effort to notify the participating organization of each authorized user who has accessed, used, or disclosed the health information that has subsequently been amended.

(4) Upon receipt of written notice or request, an HIE shall provide each health care consumer with a report detailing any disclosure through the HIE for a time period specified by the health care consumer, of the patient's PHI. In the case of recurring disclosures to the same entity for the same purpose, a summary report may be provided by the HIE. However, if the health care consumer requests the details of the summary report, the HIE shall promptly provide them.

(a) The time period specified by the health care consumer shall not exceed the data retention period as specified in the HIPAA Privacy Rule, 45 CFR § 164.528.

(b) The report shall specify the following for each instance that the patient's PHI was disclosed during the time frame reflected in the report:

(i) The name of each authorized user;

(ii) The name of the participating organization to which the authorized user is affiliated, if such information is kept by the HIE in the ordinary course of business;

(iii) The date and time of the disclosure;

(iv) The type of PHI disclosed, if known by the HIE; and

(v) The name of the participating organization that made the protected health information available to the HIE.

(c) An HIE shall acknowledge a health care consumer's written notice or request for the report within 10 business days of receipt of the request.

(d) An HIE shall respond to a health care consumer's written notice or request with either the requested report or with a written explanation why such report is unavailable, when it will be available, or where the health care consumer may obtain the requested information, in accordance with 45 CFR § 164.528(a)(2)(D)(3). The HIE shall respond within a reasonable time frame, but not later than 30 days of the initial written notice or request by the health care consumer.

(i) An HIE shall provide up to two copies annually of the report at no cost to the health care consumer, upon written notice or request by the consumer. If the report is available in an electronic format, it shall be provided to the consumer in a generally available electronic format such as PDF, if so requested, at no additional charge.

(ii) For any additional report, the HIE may charge a reasonable fee not to exceed the cost to provide the additional report, but no more than the allowable amount in accordance with Health-General Article, §4-304, Annotated Code of Maryland, and 45 CFR § 164.524(c)(4).

D. An HIE shall:

(1) Establish and maintain an online process that allows health care consumers to obtain an electronic report detailing any disclosures of their information through the HIE in accordance with §C(4) (b) of this regulation; and

(2) Implement and maintain compliance with the provisions detailed in Regulation .12A(1)-(7), B(l)-(2), and C(4)(b)-(d) of this chapter in implementing §D(1) of this regulation.

E. An HIE shall take affirmative steps to protect a patient's protected health information, including sensitive health information, that is accessible to or through the HIE from a breach or a non-HIPAA violation.

(1) An HIE shall have an easily accessible and convenient method by which a person may notify the HIE concerning a potential or an actual breach or a non-HIPAA violation.

(2) When an HIE is notified in writing of a potential or an actual breach or a non-HIPAA violation, the HIE shall:

(a) Acknowledge receipt of the notification within 1 business day;

(b) Begin an investigation concerning the matter upon receipt of the notification in compliance with Regulation .07 of this chapter and;

(c) In accordance with Regulation .08 of this chapter, provide the person filing the notification and each health care consumer whose protected health information was breached with information concerning the determination and resolution of the matter by the HIE.

(3) An HIE shall implement robust technical measures consistent with generally accepted industry best practices to assure valid patient identification and minimize patient record mismatches.

F. An HIE shall implement a process to allow a health care consumer to make an educated decision regarding the patient's participation in an HIE, opting out from such participation, or opting to resume participation in the HIE system, in accordance with this regulation.

(1) An HIE shall maintain a log that records each patient's participation status over time; and

(a) The HIE shall retain the log for the duration required by State or federal law, -whichever requires a longer retention; and

(b) The HIE shall keep the log in a retrievable storage medium.

(2) An HIE shall not disclose a patient's PHI if the health care consumer has submitted a written notice or request to opt-out of the HIE in accordance with §(A)(2) of this regulation except as otherwise permitted under applicable law and in accordance with this chapter.

(3) An HIE shall not disclose information derived from a patient's PHI, including for secondary use, if the health care consumer has submitted a written notice or request to opt-out of the HIE, except as otherwise permitted under applicable law.

G. The following requirements shall apply to all communications between an HIE and a health care consumer:

(1) An HIE shall implement a process to allow a health care consumer to communicate with the HIE about the patient's participation status through an appropriate medium of the health care consumer's choice, including the following:

(a) By telephone, via a toll-free number;

(b) By mail, via a standardized form;

(c) By fax, via a standardized form;

(d) Online, via a secure website; and

(e) In person at the HIE's offices during business hours.

(2) A health care consumer's communication opting out or opting in to an HIE shall be made:

(a) In writing;

(b) Online; or

(c) By telephone, if the HIE confirms the action with a written communication to the health care consumer in accordance with §G(5)(a) and (b) of this regulation.

(3) An HIE shall take appropriate measures to assure that a health care consumer who communicates with the HIE is authorized to act on behalf of the patient.

(4) An HIE shall implement the health care consumer's requested action within 5 business days of receipt of the health care consumer's written or online request concerning:

(a) Opting-out of the HIE; and

(b) Resuming participation in the HIE after previously opting-out.

(5) An HIE shall provide to each health care consumer the option to receive confirmation of any change in the patient's participation status. If a health care consumer requests such confirmation in writing, the HIE shall:

(a) Send the confirmation of participation status change within 3 business days of the effective date of change of such patient's participation status; and

(b) If consistent with all applicable privacy and security law and regulations, including HIPAA and applicable State law and regulations, send the confirmation of status change through one of the following methods as specified by the health care consumer:

(i) An email sent to the email address specified by the health care consumer;

(ii) A letter to an address specified by the health care consumer;

(iii) A letter by fax to a fax number specified by the health care consumer;

(iv) A letter given to the health care consumer at the HIE during normal business hours; or

(v) A text message sent to the number specified by the health care consumer.

(6) When a health care consumer changes the patient's participation status, the HIE shall provide the following to the health care consumer and, unless the patient is a minor or subject to a power of attorney or otherwise unable to handle his or her own affairs, to the patient:

(a) Information concerning when the status change will become effective; and

(b) Information concerning what information will be excluded from the HIE regarding a health care consumer who opts out.

H. A participating organization shall comply with the following requirements to assure patient and health care consumer rights.

(1) A participating organization shall inform each health care consumer no later than the first medical encounter following enrollment of the organization in an HIE, by written and oral notice, of:

(a) Such organization's participation in an HIE, including in such organization's Notice of Privacy Practices under HIPAA; and

(b) Information concerning the health care consumer's right to opt out from participation in the HIE and the process to opt out; and

(c) The types of information the participating organization will disclose to the HIE and for what purposes information accessed through the HIE may be used for treatment, payment, health care operations, and secondary use as described in this chapter.

(2) In addition to applicable HIPAA notification requirements, a participating organization shall notify each health care consumer whose protected health information, including sensitive health information, is breached or is maintained, accessed, used, or disclosed in a manner that constitutes a non-HIPAA violation in accordance with Regulation .08 of this chapter.