Rhode Island Code of Regulations › Title 216 - Department of health › Chapter 10 - Public Health Administration › Subchapter 10 - Registries › Part 6 - Regional Health Information Organization and Health Information Exchange › Section 216-RICR-10-10-6.3 - General Provisions

Current through June 14, 2024
6.3.1
Participation in the Health Information Exchange (HIE)
A. A statewide Health Information Exchange
				  (HIE) has been established pursuant to R.I. Gen. Laws Chapter
				  5-37.7. Confidential health
				  information shall only be accessed, released or transferred from the HIE
				  pursuant to R.I. Gen. Laws Chapter
				  5-37.7. In addition to the
				  requirements set forth in R.I. Gen. Laws
				  5-37.7:
1. Patients and health care providers shall
				  have the choice to participate in records-sharing via the HIE, as defined by
				  the Act and this Part. Patient participants shall be able to rescind permission
				  for disclosure to health care providers via the HIE ("opt out") by signing an
				  opt-out form provided by the HIE. Patient participants may indicate his or her
				  desire to opt out pursuant to §6.5.1(A) of this Part and may subsequently
				  reverse an opt out decision pursuant to §6.5.1(A)(5) of this
				  Part.
2. Individuals shall be
				  informed about the opportunity to opt out through provider participants and
				  other publicly available means, and provider participants shall offer the
				  opportunity to discuss HIE participation and consent options at the request of
				  an individual patient. Individuals will be informed about the HIE through
				  materials that explain the context and process of disclosure of health
				  information through the HIE, including any and all choices available to the
				  individual. The RHIO shall provide examples or templates of educational
				  materials and any needed technical assistance to provider participants on
				  patient education about the HIE.
3.
				  When entering into a treating relationship with a provider participant or no
				  later than six (6) months after a provider begins submitting records to the
				  HIE, individuals will be clearly informed of their opportunity to opt-out in a
				  distinct written document, whether paper, electronic, or web-based. The
				  notification may be contained within a document detailing other privacy
				  practices, but the HIE shall be specifically discussed. The notification shall
				  include an explanation that due to his or her provider's participation in the
				  HIE, at a minimum, their protected health information may be disclosed to:
a. Health care providers that care for them
				  in emergencies, on a temporary basis;
b. Public health authorities in the process
				  of carrying out their functions, pursuant to R.I. Gen. Laws §
													5-37.7-7(b)(2);
				  and
c.  Health plans where
				  information is necessary for care management, quality, and performance measure
				  reporting.
4. Individuals
				  shall be notified by provider participants of their opportunity to opt-out of
				  participation in the HIE a minimum of sixty (60) days prior to opt out policies
				  going into effect ("go live"). This notification shall include all components
				  specified in §6.3.1(A)(3) of this Part, as well as clearly outline the
				  methods available to complete an opt-out form as specified in §6.5.1(A)(4)
				  of this Part.
5. Mental health
				  treatment information received from data submitting partners shall be included
				  in the RHIO's repository of protected health information, and shall be subject
				  to any opt-out form completed by a patient participant. Mental health treatment
				  information shall not be stored or disclosed separately except as otherwise
				  required by law or Regulation.
6.
				  The RHIO shall maintain a dedicated telephone number staffed with qualified
				  personnel who can respond to individuals' questions related to any and all
				  choices and processes available to the individual. If there are remaining
				  concerns or complaints after contacting the RHIO, individuals can contact the
				  Department of Health "Health Information Line."
7. The RHIO shall maintain a process for
				  reviewing and resolving complaints related to it, and to assist patient
				  participants in resolving complaints.
a. The
				  RHIO and all provider participants will accept complaints pertaining to the RI
				  HIE. Provider participants will forward complaints to the RHIO.
b. The RHIO will appoint a Privacy Officer
				  who will review all complaints. Complaints will not be public and will be kept
				  confidential as required by law. Any confidential health information contained
				  in the complaint will be protected in accordance with applicable State and
				  Federal law.
c. Neither the RHIO
				  nor provider participants will retaliate, discriminate against, intimidate,
				  coerce or otherwise reprise patient participants or patient advocates relating
				  to the filing of a complaint or for filing a complaint.
d. The RHIO will contractually require
				  provider participants to comply with HIPAA, including establishing and
				  implementing HIPAA compliant policies and procedures.
e. Patient participants may lodge a complaint
				  with the provider participant directly, with the RHIO or with the Department of
				  Health. If a complaint is lodged directly with the RHIO and the RHIO refers the
				  patient participant to the provider participant and the provider participant
				  cannot directly resolve the complaint or believes the complaint is in error,
				  the patient participant may then submit it to the RHIO Privacy Officer for
				  review and assistance as requested by the patient participant.
f. All patient participants lodging
				  complaints directly with the RHIO will be directed to fill out a patient
				  complaint form and will be given assistance if requested. If the complaint
				  involves a provider participant, the RHIO will notify the provider participant
				  if it addresses actions by the provider participant.
g. Any complaint regarding breach of
				  security, if appropriate, may invoke the response to breach procedures by the
				  RHIO.
h. The RHIO shall maintain
				  copies of all written patient complaint forms.
i. The disposition of the complaint shall be
				  documented by the RHIO Privacy Officer as part of the complaint
				  process.
j. For complaints lodged
				  directly to the Department, the Department will follow its usual process for
				  investigating complaints and the complaint shall remain confidential to the
				  public until it has been resolved. If applicable, once it is resolved, the
				  Department will notify the RHIO Privacy Officer and/or provider participant.
				  Any patient participant wishing to lodge a verbal complaint may do so by
				  calling the Department of Health "Health Information Line."
k. Any complaint lodged by a patient
				  participant with the provider participant, the RHIO or the Department shall be
				  resolved within thirty (30) days of submission.
l. The Department reserves the right to
				  access the records of complaints received by the RHIO and the resolution of
				  such complaints.