# Presentation: 278321

## NHIN / HISPC / SLHIE Joint Conference

**Minnesota Health Records Act:****Updating Privacy Laws to Enable Electronic Health Information Exchange**
***May 1, 2008***
*Dallas, TX*
**Michael Hawton**
**Project Manager **
**Minnesota Privacy and Security Project**
**Center for Health Informatics**
**Minnesota Department of Health**

## Objectives

- Minnesota’s Patient Consent Requirements
- Representation of Consent
- Record Locator Service (RLS)
- Minnesota Standard Consent Form to Release Health Information
- Next Steps

**Notes:**
This effort has been accomplished under the MN e-Health Initiative established in 2004 as a private–public collaboration to accelerate the use of health information technology in Minnesota a 26 member appointed committee representing key stakeholders including health care providers, payers, public health professionals, and consumers that is responsible for making recommendations to implement a statewide interoperable health information infrastructure - including patient privacy requirements.

Representatives - hospitals, health plans, physicians, nurses, other healthcare providers, academic institutions, state government purchasers, local and state public health agencies, citizens, and others with expert knowledge of health information technology and electronic health record systems.

At the time, only a fraction of clinical health and healthcare data was accessed and transferred digitally. An estimated 5-15% of Minnesota primary care clinics have electronic health records and few systems exchange clinical data electronically on a real time basis. As a result, the information needed to support patient care and public health was not available when and where it was needed to support clinical decision-making, patients, and public health.  As of the fall of 2007 at 68% Implementation.

Patient Safety. Medical errors (known as “adverse events”) occur in nearly one out of every four hospitalizations [4], killing an estimated 44,000 to 98,000 people each year in the U.S., according to an Institute of Medicine (IOM) report. Studies show that adverse drug events occur in 5 to 18 percent of ambulatory patients as well [5]. A 2001 Robert Wood Johnson survey shows that 95 percent of physicians, 89 percent of nurses, and 82 percent of healthcare executives said that they have witnessed serious medical errors. HIT can play a great role in reducing these events.

## Minnesota’s Patient Consent Requirements

- Patient consent is required for nearly all disclosures of health records – _**including treatment**_
- Patients need to give written consent (M.S. § 144.293, subd. 2)
- Limited exceptions to consent (M.S. § 144.293, subd. 5)
- Medical emergency
- Within “related health care entities”
- Consent generally expires within one year (M.S. § 144.293, subd. 4)
- Consents that do not expire (M.S. § 144.293, subd. 6)
- Disclosures to providers being consulted
- Disclosures to payers for payment

**Notes:**
Privacy and Confidentiality Environment in Minnesota

## 2007 Revisions to Minnesota Health Records Act

- Laws of Minnesota 2007, chapter 147, article 10, sections 2-9, Minnesota Statutes § 144.291-.298:
- Improve readability through recodification
- Definitions and requirements for new and existing terms and concepts:
- Health record
- Medical emergency
- Related health care entity
- Health information exchange
- Record locator service
- Identifying data

## 2007 Revisions to MN Health Records Act: Representation of Consent

- A provider, or a person who receives health records from a provider, may not release a patient's health records to a person without:(1) a signed and dated consent from the patient or the patient's legally authorized representative authorizing the release;(2) specific authorization in law; or**(3) a representation from a **_**provider**_** that holds a signed and dated consent from the patient authorizing the release.**** **(M.S. § 144.293, subd. 2)

**Notes:**
Example where Representation of Consent applies = Patient is being seen at clinic A, for current care needs to access the patient’s health record. Patient is normally seen at clinic B. Clinic A obtains a signed and dated consent form authorizing the release. Clinic A informs clinic B that they are holding a signed and dated consent. Clinic B can release the patient’s health record based on the representation of consent.

Only a health care provider may request a patient’s health record using a representation of having obtained patient consent.
Requesting provider must obtain a signed and dated consent from the patient.

The provider releasing health records to another provider using a representation of having obtained patient consent must document:
1- identity of the requesting provider 
2- identity of the patient
3- records requested
4- date of the request
M.S. § 144.294, subd. 9, (b)

## 2007 Revisions to MN Health Records Act: Representation of Consent

**Patient encounter is at Clinic A**
**2. Clinic A obtains signed & dated consent to release health records**
**3. Clinic A contacts Clinic B, the patient’s family physician to request health records**

**1, 2 & 4**

**3**

**4. Clinic A informs Clinic B that they are holding a signed and dated consent**
**5. Clinic B audits: requestor identity, patient identity, records requested and date of request**
**6. Clinic B honors request based on representation of consent**

**5**

**6**

**Notes:**
Example where Representation of Consent applies = Patient is being seen at clinic A, for current care needs to access the patient’s health record. Patient is normally seen at clinic B. Clinic A obtains a signed and dated consent form authorizing the release. Clinic A informs clinic B that they are holding a signed and dated consent. Clinic B can release the patient’s health record based on the representation of consent.

Health information exchange would not be possible without representation of consent because written and signed consent would still be required at both provider A and B.

## 2007 Revisions to MN Health Records Act: Record Locator Service (RLS)

- An electronic index of patient identifying information that directs providers in a health information exchange to the location of patient health records held by providers and group purchasers. (M.S. § 144.293, subd. 8)
- Providers or group purchasers **may construct** a record locator service _**without**_ **patient consent**
- Providers **must obtain patient consent to access** patients’ information in a record locator service.
- Providers must provide a mechanism for patients to completely opt-out of the RLS in the consent process.

**Notes:**
(A) Construct = “A provider or group purchaser may release patient identifying information and information about the location of the patient’s health records to a record locator service without consent from the patient, unless the patient has elected to be excluded from the service under paragraph (d).”

(B) A health information exchange maintaining a record locator service must maintain an audit log of providers accessing information in a record locator service that at least contains information on:
	(1) the identity of the provider accessing the information;
	(2) the identity of the patient whose information was accessed by the provider; and
	(3) the date the information was accessed.

(C) A provider or an entity operating a record locator service must provide a mechanism under which patients may exclude their identifying information and information about the location of their health records from a record locator service. At a minimum, a consent form that permits a provider to access a record locator service must include a conspicuous check-box option that allows a patient to exclude all of the patient's information from the record locator service. 

(D) Protections
	(1) Not a government database
	(2) Allows multiple groups of providers to create an RLS
	(3) Only providers may access information in an RLS
	(4) Providers must provide a mechanism for patients to completely opt-out of the RLS in the consent process
	(5) An HIE maintaining an RLS must maintain an audit log of who accessed information
	(6) An HIE or entity maintaining an RLS is liable for inappropriate disclosures of information
	(7) MDH cannot access/receive information from a RLS

## 2007 Revisions to MN Health Records Act: Record Locator Service Protections

- Not a government database
- Only providers may access information in an RLS
- An HIE maintaining an RLS must maintain an audit log of providers who accessed information
- An HIE or entity maintaining an RLS is liable for inappropriate disclosures of information
- MDH cannot access/receive information from an RLS

**Notes:**
(b) A health information exchange maintaining a record locator service must maintain an audit log of providers accessing information in a record locator service that at least contains information on:
(1) the identity of the provider accessing the information;
(2) the identity of the patient whose information was accessed by the provider; and
(3) the date the information was accessed.

## Standard Consent Form to Release Health Information

- Organizations are not required to use, but if they choose they can adopt it in whole or in part
- Does not replace organizations existing consent to release health information forms
- If properly executed it is a legally enforceable request
- Approved by the Commissioner of Health, January, 2008 (M.S. § 144.292, Subd.8)

**Notes:**
Examples of federal and state statutes reviewed during development of form = 45 CFR, Part 164.508, 42 CFR, Part 2, Minnesota Statutes 13.05, 13.386 and 72A.501.
This work was completed during the implementation extension contract of the HISPC project.  The form lays the groundwork for the interstate exchange of health information by complying with all state and federal requirements for health information exchange.

## Next Steps

- Inform providers and organizations of changes to the Minnesota Health Records Act and the purpose and use of the standard consent form.
- Assist organizations with the implementation of new statutory requirements such as, the RLS.
- Support the statewide health information technology implementation plan.
- Make policy recommendations.

## Thank You! - Questions

**Minnesota Department  of Health**
**Michael Hawton**
**Project Manager **
**Minnesota Privacy and Security Project**
**Center for Health Informatics**
**651.201.3598**
- _[michael.hawton@health.state.mn.us](mailto:michael.hawton@health.state.mn.us)__ _
**More Information:**
- _[http://www.health.state.mn.us/e-health/index.html](http://www.health.state.mn.us/e-health/index.html)__ _