Arkansas Administrative Code › Agency 220 - Office of Health Information Technology › Rule 220.00.11-001 - Privacy Policies

Current through Register Vol. 49, No. 6, June, 2024
OHIT wishes to express its gratitude to Connecting for Health and the
	 Markel Foundation for their work in developing the Common Foundation: Resources
	 for Implementing Private and Secure Health Information Exchange and NEHII, Inc.
	 This work incorporates some of the concepts set forth in those
	 resources.
OHIT Privacy Policies
INTRODUCTION
The following policies apply to the access, use and disclosure of
	 protected health information by Participating Entities through the Office of
	 Health Information Technology (OHIT) State Health Alliance for Records Exchange
	 ("SHARE") and other data exchange services being made available to
	 Participating Entities. SHARE and these other services are collectively
	 referred to as the 'System." These policies are designed for use as SHARE and
	 its Participating Entities exchange health information. It is anticipated these
	 policies will be reviewed and revised as needed based on the experience of OHIT
	 and Participating Entities.
STATUS OF OHIT AND PARTICIPATING ENTITIES
The following terms used throughout the policies are defined as
	 follows:
Participating Entities
means those entities which provide
	 data to SHARE and those entities which obtain and use data from SHARE as health
	 care providers, health plans, or health care clearinghouses (collectively
	 "Covered Entities" as defined by HIPAA1). All
	 Participating Entities are Covered Entities under HIPAA or have signed
	 Participation Agreements with OHIT. Participating Entities should not be
	 confused with Individuals whose protected health information is exchanged using
	 SHARE.
Business Associate
means one who acts for, or on behalf of
	 a Participating Entity to perform a function or activity involving the use or
	 disclosure of protected health information, including claims processing or
	 administration, data analysis, processing or administration, utilization
	 review, quality assurance, billing, benefit management, practice management,
	 and re-pricing; or any other function or activity, See
	 45
	 CFR §
								160.103.
OHIT is a business associate ("BA") of the Participating Entities who
	 are Covered Entities under HIPAA. OHIT accepts and agrees to follow terms
	 applicable to the privacy of protected health information by virtue of its
	 business associate agreements with Participating Entities and these privacy
	 policies.
Individual(s)
means those persons whose protected health
	 information is transmitted using SHARE.
PRIVACY PRINCIPLES
These OHIT Privacy Policies ("Privacy Policies") are rooted in nine
	 privacy principles discussed in the
Connecting for Health
"The
	 Architecture for Privacy in a Networked Health Information Environment" and a
	 tenth adapted from NeHII, Inc. by OHIT that, taken together with privacy
	 policies and procedures already deployed by Participating Entities as Covered
	 entities under HIPAA form a comprehensive array of administrative safeguards
	 addressing privacy of protected health information. OHIT has modeled its
	 Privacy Policies on the
Connecting For Health
"Model Privacy
	 Policies and Procedures for Health Information Exchange," with a number of
	 differences based on state law, physical and technical safeguards available
	 through SHARE, and SHARE's unique operating environment.
These core privacy principles and the policies that flow from them
	 promote balance between consumer control of and access to health information
	 and the operational need of covered entities to ensure that information uses
	 and disclosures are not overly restricted, such that consumers would be denied
	 many of the benefits and improvements that information technology can bring to
	 the health care system. The policies are intended to reflect a carefully
	 balanced view of all of the principles and avoid emphasizing some over others
	 in any way that would weaken the overall approach. The guiding OHIT privacy
	 principles are as follows:
Openness and Transparency.
Clarity about procedures,
	 policies, developments, and technology concerning the handling of protected
	 health information is vital to protecting privacy. Individuals should be able
	 to understand what information exists about them, how the protected health
	 information is used, and how they can control use of that information. Openness
	 and transparency helps promote privacy practices and gives individuals
	 confidence with regard to privacy of protected health information, which in
	 turn can help increase consumer participation in health information
	 networks.
Purpose Specification and Minimization.
Access to and use
	 of patient health information must be limited to the type and amount necessary
	 to accomplish specified permitted purposes. Minimizing the use of protected
	 health information will help decrease the amount of privacy violations, which
	 may occur when data is collected for one legitimate reason and then reused for
	 different or unauthorized purposes.
Disclosure Limitation.
Protected health information should
	 be made available through SHARE to OHIT and Participating Entities only by
	 lawful means, and, if applicable, with the knowledge and permission of the
	 individual. Electronic collection of protected information may be confusing to
	 most individuals. It is important that individuals are aware of how information
	 concerning them is being collected in an electronic networked environment.
	 Individuals should be educated about the potential health and treatment
	 benefits as well as risks to their protected health information that are
	 associated with participation in SHARE. Individuals deciding not to participate
	 should have the opportunity to know the System-wide effect of such decision and
	 the potential disadvantages.
Access and Use Limitation.
Protected health information
	 should be obtained by one Participating Entity from another only pursuant to
	 mutual agreement that the information is being accessed for qualifying
	 treatment or payment purposes of the requesting Participating Entity or for
	 other purposes permitted by law. Participating Entities may use and disclose
	 protected health information obtained through SHARE only for purposes and uses
	 consistent with their permitted access and consistent with their obligations as
	 covered entities under HIPAA. Certain exceptions, such as for law enforcement
	 or public health reporting, may warrant disclosure of information for other
	 purposes. However, when information obtained by a Participating Entity through
	 SHARE is used for purposes other than those for which the information was
	 originally obtained, the Participating Entity so using or disclosing the
	 information should first apply the rules applicable to it as a Covered Entity
	 under HIPAA and as a contracting Participating Entity.
Individual Participation and Control.
Consistent with the
	 scope of individual rights in HIPAA, individuals should have the right to
	 request and receive in a timely and intelligible manner information regarding
	 various parties that may have that individual's specific health information; to
	 know any reason for a denial of such request; to request to amend any protected
	 health information that the individual believes is inaccurate; and to request
	 not to have his or her information made available through SHARE. Individuals
	 have a vital stake in their protected health information, such rights enable
	 individuals to make informed decisions about participation and provide another
	 means to monitor for inappropriate access, use and disclosure of protected
	 health information. Individual participation promotes information quality,
	 privacy, and confidence in privacy practices.
Data Integrity and Quality.
Health information should be
	 detailed, complete, appropriate, and current to guarantee its value to the
	 various parties. The effective delivery of quality health care depends on
	 complete health information. In addition, individuals can be negatively
	 affected by inaccurate health information in other contexts, such as insurance
	 and employment. Therefore, SHARE must maintain the integrity of protected
	 health information and individuals must be allowed to view information about
	 them and request to amend such health information so that it is accurate and
	 complete.
Security Safeguards and Controls.
In an era of increased
	 computer and Internet-related crime, security safeguards are vital to privacy
	 protection. Networked environments could be susceptible to cyber-crime without
	 adequate controls. Such controls are put in place to prevent information loss,
	 corruption, unauthorized use, modification, and disclosure. Methods of
	 precaution that can be implemented include information scrubbing, identity
	 management tools, hashing, auditing, authenticating, and other means to ensure
	 information privacy. Privacy and security safeguards should be coordinated for
	 the protection of patient health information.
Accountability and Oversight.
Privacy protections have
	 less value to an individual if privacy violators are not held accountable for
	 failing to follow procedures relating to such privacy protections. Potential
	 Participating Entities, such as those who will provide data to SHARE, are
	 unlikely to fully trust SHARE and fully participate, if they believe other
	 Participating Entities are not applying the same rules and being held to the
	 same standard of accountability. User and workforce training, privacy audits,
	 and other oversight tools can help to identify and address privacy violations
	 and security breaches by conditioning participation and access authority on
	 compliance with these and the individual Participating Entity's privacy
	 policies, by excluding from participation those who violate privacy
	 requirements, and by identifying and correcting weaknesses in privacy and
	 security safeguards.
Remedies.
To ensure privacy protection there must be legal
	 and financial remedies that hold violators accountable for failing to comply
	 with OHIT policies. Such remedies will give individuals confidence in the
	 organization's commitment to keeping protected health information private, and
	 mitigate any harm that privacy violations may cause individuals. As a condition
	 of continued participation, all Participating Entities in SHARE must have a
	 common duty to participate in investigation, mitigation and remediation steps
	 for the integrity of SHARE.
Reliance on Covered Entity Policies and Enforcement.
While
	 OHIT should have a number of core policies and procedures for the benefit and
	 confidence of all Participating Entities, OHIT should not try to replace
	 policies, procedures and methods already adopted by Participating Entities as
	 covered entities under HIPAA. OHIT should identify, disseminate and enforce
	 only those policies and procedures necessary for coordination of privacy
	 response, but should recognize that existing Participating Entity policies
	 govern in all other areas.
OHIT policies incorporate the principles outlined in the preceding ten
	 principles as well as basic requirements set forth in HIPAA. The OHIT policies
	 seek to achieve a balance between maintaining the confidentiality of health
	 information and maximizing the benefits of such information.
EFFECT OF LEGISLATION AND RULE CHANGES
OHIT and Participating Entities need to remain flexible in approach in
	 order to adapt to the uncertainty of state and federal legislation and
	 regulations that will affect design, safeguards, rights and responsibilities
	 over time. This shall include monitoring and implementing design components and
	 safeguards mandated in the Health Information Technology for Economic and
	 Clinical Health Act or "HITECH" as enacted in P.L 111-5 and regulations to be
	 issued thereunder.
SAFEGUARDS IN AN ELECTRONIC NETWORKED ENVIRONMENT
HIPAA permits covered entities that hold protected health information
	 to disclose such information to other covered entities both for their own
	 treatment and payment purposes and for the treatment and payment purposes
of such third parties, without written
	 authorization.
2 HIPAA limits authority to
	 disclose without authorization in other situations and attaches conditions.
	 HIPAA thus places a duty on Participating Entities holding protected health
	 information to determine that each proposed disclosure is permitted.
In a non-electronic health care environment, Participating Entities
	 subject to this duty would have the opportunity to examine third party requests
	 for information beforehand and make an individual determination whether a
	 disclosure is a permitted disclosure for the treatment or payment purposes of
	 the requesting Participating Entity. In an electronic health care environment,
	 such as SHARE, the disclosing Participating Entity will not receive or
	 "process" a request for access. Other Participating Entities using SHARE can
	 simply locate the Participating Entity's record and access it as needed. The
	 human element of analyzing individual requests is absent.
Accordingly, to permit Participating Entities that furnish information
	 to meet their obligation to disclose protected health information only for a
	 qualifying purpose, and to meet certain other conditions during the initial
	 phase of SHARE, including the responsibility to do the following:
* Access information from another Participating Entity's records only
	 for a qualifying treatment or payment use by the requesting Participating
	 Entity. A qualifying treatment or payment use is one that would permit the
	 Participating Entity from whose records the information is accessed to disclose
	 such information to the requesting Participating Entity under
	 §§164.506(c)(2) and (3) of the Privacy Rule.
* Access information by applying the minimum necessary standards as
	 defined by HIPAA.
To support this approach, OHIT and the Participating Entities will
	 ensure that the all Participating Entities must be covered entities under HIPAA
	 or have signed a Participation Agreement with OHIT and therefore are
	 individually subject to regulation and penalties.
* During its initial phase, all Participating Entities commit to
	 accessing PHI only for their treatment and payment purposes. While
	 §164.506(c)(4) permits limited disclosure for the health care operations
	 of another Participating Entity, SHARE is only to be used by Participating
	 Entities to access protected health information for treatment and payment
	 purposes or for public health reporting purposes. As SHARE matures, OHIT is
	 authorized to develop Privacy and Security Procedures to address uses and
	 disclosures which are not for treatment, payment, operations or public health
	 reporting including requests for research purposes in accordance with state and
	 federal regulations.
"Treatment" and "payment," as used in these policies and explanations,
	 have the meaning given in Section §164.501 off the Privacy Rule.
OHIT Privacy
Policy 100: Compliance with Law and
	 Policy
Scope and Applicability:
This Policy applies to OHIT and
	 all Participating Entities.
Policy:
1.
Laws.
Each Participating Entity must, at all times, comply with all
  federal, state, and local laws and regulations, including, but not limited to,
  those protecting the confidentiality and security of protected health
  information and establishing certain individual privacy rights. Each
  Participating Entity must use reasonable efforts to stay up-to-date of any
  changes or updates to and interpretations of such laws and regulations to
  ensure compliance.3
2.
OHIT Policies.
Each
  Participating Entity shall, at all times, comply with these OHIT Policies
  ("OHIT Policies"). These OHIT Policies may be changed and updated from time to
  time upon reasonable written notice to Participating Entities. Amendments shall
  be effective when adopted by the OHIT with review by the SHARE Health
  Information Exchange Council and promulgated as required by the Arkansas
  Administrative Procedures Act. OHIT shall notify Participating Entities of all
  policy changes. Each Participating Entity is responsible for ensuring it has,
  and is in compliance with, the most recent version of these OHIT
  Policies.
3.
Participating
  Entity Policies.
Each Participating Entity is responsible for
  establishing internal policies that are necessary to comply with applicable
  laws and these OHIT Policies.
4.
Participating Entity Criteria
. Each Participating Entity shall
  itself be a HIPAA Covered Entity or have executed a Participation Agreement
  with SHARE. Therefore, each Participating Entity will have either a legal duty
  as a regulated Covered Entity under HIPAA or have contractually assumed
  obligations under its Participation Agreement. Each Participating Entity must
  commit to be a data provider to the extent possible in order to become a data
  user.
5.
User
  Criteria.
Authorized users are individuals who have been granted access
  authority. Each authorized user derives his or her permission to access and use
  SHARE from a Participating Entity. Therefore each authorized user must maintain
  a current relationship to a Participating Entity in order to use SHARE.
  Authorized users must therefore be:
(i)
  Participating Entities (for example, an individual physician) or workforce of a
  Participating Entity,
(ii) an
  individual Business Associate (BA) or workforce of such BA, or
(iii) an individual contractor or
  subcontractor of a BA or workforce of such contractor or subcontractor.
  Additionally, a Participating Entity that is a covered health plan may also be
  an authorized user in its role as a third party administrator and BA for
  self-funded group health plans that are covered entities under HIPAA but are
  not themselves Participating Entities.