Oklahoma Administrative Code › Title 317 - Oklahoma Health Care Authority › Chapter 30 - Medical Providers-Fee for Service › Subchapter 3 - General Provider Policies › Part 1 - GENERAL SCOPE AND ADMINISTRATION › Section 317:30-3-4.1 - Uniform Electronic Transaction Act

Current through Vol. 41, No. 20, July 1, 2024
These rules regulate the format, use, and retention of
					 electronic records and signatures generated, sent, communicated, received, or
					 stored by the Oklahoma Health Care Authority (OHCA), in conformity with the
					 Uniform Electronic Transaction Act, found at Section 15-101 et seq. of Title
					 12A of the Oklahoma Statutes.
(1)
Use of electronic records and electronic signatures.
The rules
				  regarding electronic records and electronic signatures apply when both parties
				  agree to conduct business electronically. Nothing in these regulations requires
				  parties to conduct business electronically. However, should a party have the
				  capability and desire to conduct business electronically with the OHCA, then
				  the following guidelines must be adhered to:
(A) Only employees designated by the
				  provider's agency may make entries in the member's medical record. All entries
				  in the member's medical record must be dated and authenticated with a method
				  established to identify the author. The identification method may include
				  computer keys, Private/Public Key Infrastructure (PKIs), voice authentication
				  systems that utilize a personal identification number (PIN) and voice
				  authentication, or other codes. Providers must have a process in place to
				  deactivate an employee's access to records upon termination of employment of
				  the designated employee.
(B) When
				  PKIs, computer key/code(s), voice authentication systems or other codes are
				  used, a signed statement must be completed by the agency's employee documenting
				  that the chosen method is under the sole control of the person using it and
				  further demonstrate that:
(i) A list of PKIs,
				  computer key/code(s), voice authentication systems or other codes can be
				  verified;
(ii) All adequate
				  safeguards are maintained to protect against improper or unauthorized use of
				  PKIs, computer keys, or other codes for electronic signatures; and
(iii) Sanctions are in place for improper or
				  unauthorized use of computer key/code(s), PKIs, voice authentication systems or
				  other code types of electronic signatures.
(C) There must be a specific action by the
				  author to indicate that the entry is verified and accurate. Systems requiring
				  an authentication process include, but are not limited to:
(i) Computerized systems that require the
				  provider's employee to review the document online and indicate that it has been
				  approved by entering a unique computer key/code capable of
				  verification;
(ii) A system in
				  which the provider's employee signs off against a list of entries that must be
				  verified in the member's records;
(iii) A mail system that sends transcripts to
				  the provider's employee for review;
(iv) A postcard identifying and verifying the
				  accuracy of the record(s) signed and returned by the provider's employee;
				  or
(v) A voice authentication
				  system that clearly identifies the author by a designated PIN or security
				  code.
(D)
				  Auto-authentication systems that authenticate a report prior to the
				  transcription process do not meet the stated requirements and will not be an
				  acceptable method for the authentication process.
(E) The authentication of an electronic
				  medical record (signature and date entry) is expected on the day the record is
				  completed. If the electronic medical record is transcribed by someone other
				  than the provider, the signature of the rendering provider and date entry is
				  expected within three (3) business days from the day the record is completed.
				  Before any claim is submitted to the OHCA for payment of a provided service,
				  the provider must authenticate the electronic medical records relating to that
				  service.
(F) Records may be edited
				  by designated administrators within the provider's facility. Edits must be in
				  the form of a correcting entry which preserves entries from the original
				  record. Edits must be completed prior to claims submission or no later than
				  forty-five (45) days after the date of service, whichever occurs
				  first.
(G) Use of the electronic
				  signature, for clinical documentation, shall be deemed to constitute a
				  signature and will have the same effect as a written signature on the clinical
				  documentation. The section of the electronic record documenting the service
				  provided must be authenticated by the employee or individual who provided the
				  described service.
(H) Any
				  authentication method for electronic signatures must:
(i) be unique to the person using
				  it;
(ii) identify the individual
				  signing the document by name and title;
(iii) be capable of verification, assuring
				  that the documentation cannot be altered after the signature has been
				  affixed;
(iv) be under the sole
				  control of the person using it;
(v)
				  be linked to the data in such a manner that if the data is changed, the
				  signature is invalidated; and
(vi)
				  provide strong and substantial evidence that will make it difficult for the
				  signer to claim that the electronic representation is not valid.
(I) Failure to properly maintain
				  or authenticate medical records (i.e., signature and date entry) may result in
				  the denial or recoupment of SoonerCare payments.