 |
ARIZONA STATE SENATE
Fifty-Sixth Legislature, First Regular Session
health information organizations
Purpose
Allows the state's official health information exchange organization (HIE) to receive, use and redisclose confidential information regarding child immunizations and communicable diseases only for the purposes permitted by federal law and removes the prohibition of a HIE from using the information as a set of data for grant or other research funding.
Background
In Arizona, the HIE is Contexture, which connects more than 500 Arizona organizations, including first responders, hospitals, labs and providers of community behavioral health, physical health, post-acute care and hospice providers (Contexture).
The Child Immunization Reporting System is established within the Department of Health Services (DHS) to collect, store, analyze, release and report immunization data. Identifying information in the system is confidential. A person who is authorized to receive confidential information must disclose this information only as permitted. Except under specified situations, DHS must release identifying information only to outlined entities and persons. DHS may also release identifying information to an entity designated by the person or the person's health care decision maker, parent or guardian for specified purposes (A.R.S. § 36-135).
The disclosure of an individual's individually identifiable health information through a HIE is only allowed under specific outlined circumstances. A HIE may not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research or use the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer (A.R.S. § 36-3805).
The federal Health Information Portability and Accountability Act (HIPAA) requires the Secretary of the U.S. Department of Health and Human Services (U.S. HHS) to publicize standards for the electronic exchange, privacy and security of health information. In 2002, the U.S. HHS developed a proposed rule governing the privacy of individually identifiable health information. The regulation, known as the privacy rule, establishes a set of national standards governing the protection of certain health information. HIPAA privacy rules address the use and disclosure of individuals’ protected health information by entities that are subject to the privacy rule as well as standards for privacy rights for individuals to understand and control how their health information is used. The privacy rule applies to health plans, health care clearinghouses and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of the U.S. HHS has adopted standards under HIPAA (HIPAA).
There is no anticipated fiscal impact to the state General Fund associated with this legislation.
Provisions
1. Allows the state's official HIE to receive, use and redisclose confidential information regarding child immunizations and communicable diseases only for the purposes permitted by HIPAA privacy standards, regardless of whether the information is being maintained by or for a covered entity or business associate.
2. Prohibits a HIE from disclosing, rather than transferring, individually identifiable health information or de-identified health information to any person or entity for the purpose of research unless the disclosure complies with applicable federal and state laws that regulate the disclosure of individually identifiable health information or de-identified health information for research.
3. Removes the prohibition of a HIE from using the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer.
4. Applies the federal definition of research, meaning a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
5. Makes technical and conforming changes.
6. Becomes effective on the general effective date.
Prepared by Senate Research
February 3, 2023
MM/MC/slp