California Code of Regulations › Title 22 - Social Security › Division 14 - California Office of Health Information Integrity › Chapter 1 - Demonstration Projects for the Electronic Exchange of Health Information › Section 126020 - Definitions

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) "Access" means the
				HIPAA definition given at 45
				C.F.R. §
										164.304.
(b) "Affiliated organization" means legally
				separate organizations which have designated themselves as a single, affiliated
				organization and are under common ownership or control or are a part of the same
				Organized Health Care Arrangement ("OHCA") as defined by HIPAA.
(c) "Applicant" means an entity that submits an
				application to CalOHII for approval as a demonstration project.
(d) "Authorization" as used in section
				126055(b)(2) means
				written permission in the form required for compliance with Civil Code sections
				56.11,
				56.21; Insurance
				Code section
				791.06, and/or
				45 C.F.R. §
										164.508 or as required by more stringent law as
				defined by 45 CFR §
										160.202.
(e) "Business Associate" means the HIPAA
				definition given at 45 C.F.R.
				§
										160.103.
(f) "CalOHII" means the California Office of
				Health Information Integrity.
(g) "CMIA
				Provider" means the Confidentiality of Medical Information Act definition of a
				Provider of Health Care given at Civil Code section
				56.05(j).
(h) "De-identified health information" means the
				HIPAA definition given at 45
				C.F.R. §
										164.514.
(i) "Demonstration Project Participant" means any
				provider, health plan, health information organization, or governmental authority
				approved by CalOHII to test privacy and/or security policies for the exchange of
				electronic health information in the demonstration project.
(j) "Disclosure" means the HIPAA definition given
				at 45 C.F.R. §
										160.103.
(k) "Electronic Health Record (EHR)" means the
				definition given at section
				13400 of subtitle D of the American
				Recovery and Reinvestment Act of 2009: "an electronic record of health-related
				information about an individual that is created, gathered, managed, and consulted by
				authorized health care clinicians and staff."
(l) "Governmental authority" means any municipal,
				county, state or other governmental entity that has jurisdiction and control over
				the provision or payment for medical services or that routinely received medical
				information to complete its designated governmental function, including specialized
				units from the local and state public health authorities.
(m) "Health Care Provider" means the HIPAA
				definition given at 45 C.F.R.
				§
										164.103.
(n) "Health Information Organization" (HIO) means
				a third party facilitator that conducts, oversees, or governs the disclosure of
				individual health information among separate, unaffiliated entities.
(o) "HIPAA" means the Health Insurance Portability
				and Accountability Act of 1996 as amended by subsequent legislation and the
				implementation of Privacy, Security, and Enforcement Rules under 45 C.F.R. Part 160
				and Subparts A, C, D, and E of Part 164.
(p) "HIPAA covered entity" means the HIPAA
				definition for covered entity given at
				45 C.F.R.
				160.103.
(q) "Independent Directed Exchange" means the
				electronic disclosure of encrypted individual health information over the internet
				to an unaffiliated entity and where third party facilitators do not have the ability
				to decrypt the content of the individual health information (IHI) package nor
				provide governance or oversight.
(r)
				"Individual" means the person who is the subject of health information.
(s) "Individual Health Information" (IHI) means
				information, in oral, electronic or physical form, including demographic information
				collected from an individual, and:
(1) Is created
				or received by or derived from a health care provider, health care clearinghouse,
				health plan, employer, pharmaceutical company, or contractor;
(2) Relates to the past, present, or future
				physical or mental health or condition of an individual; the provision of health
				care to an individual; or the past, present, or future payment for the provision of
				health care to an individual; and
(3) Is
				Individually identifiable which means the information includes or contains any
				element of personal identifying information to which there is a reasonable basis to
				believe the information can be used to identify the individual such as the patient's
				name, address, electronic mail address, telephone number, social security number, or
				other information that, alone or in combination with other potentially available
				information, reveals the individual's identity.