A.R.S. tit. 36 ch. 38 — Arizona Revised Statutes Title 36 Chapter 38 — Health Information Organizations

36-3801. Definitions In this chapter, unless the context otherwise requires: 1. "Breach" has the same meaning prescribed in 45 Code of Federal Regulations, part 164, subpart D. 2. "De-identified health information" has the same meaning as described in 45 Code of Federal Regulations section 164.514. 3. "Health care decision maker" has the same meaning prescribed in section 12-2291. 4. "Health care provider" has the same meaning prescribed in section 12-2291. 5. "Health information organization" means an organization that oversees and governs the exchange of individually identifiable health information among organizations according to nationally recognized standards. Health information organization does not include: (a) A health care provider or an electronic health record maintained by or on behalf of a health care provider. (b) Entities that are subject to title 20 or that are health plans as defined in 45 Code of Federal Regulations section 160.103. (c) The exchange of individually identifiable health information directly between health care providers without a separate organization governing that exchange. 6. "Individual": (a) Means the person who is the subject of the individually identifiable health information. (b) Does not include an inmate as defined under the health insurance portability and accountability act privacy standards prescribed in 45 Code of Federal Regulations section 164.501. 7. "Individually identifiable health information" has the same meaning prescribed in the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E). 8. "Medical records" has the same meaning prescribed in section 12-2291. 9. "Opt out" means an individual's written decision that the individual's individually identifiable health information cannot be shared through a health information organization. 10. "Participation" or "participating", with respect to a health information organization, means providing or accessing individually identifiable health information in the manner provided in the health information organization's policies. 11. "Person" has the same meaning prescribed in section 1-215. 12. "Written" means in handwriting or through an electronic transaction that meets the requirements of title 44, chapter 26. 36-3802. Individual rights A. An individual has the following rights: 1. Except as otherwise provided in state or federal law, to opt out of having the individual's individually identifiable health information accessible through a health information organization pursuant to section 36-3803. 2. To request a copy of the individual's individually identifiable health information that is accessible through the health information organization in accordance with the health insurance portability and accountability act (45 Code of Federal Regulations section 164.524). The health information organization may provide this right directly or may require health care providers or other persons participating in the health information organization to provide this access to individuals. Charges for copies are governed by section 12-2295. 3. To request the amendment of incorrect individually identifiable health information accessible through the health information organization. 4. To request a list of the persons who have accessed the individual's individually identifiable health information through the health information organization for a period of at least three years before the individual's request. This list must be provided to the individual within thirty days after the individual's request. 5. To be notified, pursuant to section 18-552 and 45 Code of Federal Regulations part 164, subpart D, of a breach at the health information organization that affects the individual's individually identifiable health information. B. If an individual does not have the capacity to make health care decisions, the individual's health care decision maker may exercise all individual rights in this chapter on behalf of the individual. 36-3803. Individual right to opt out of health information organizations Except as otherwise provided in state or federal law, an individual has the right to opt out of having the individual's individually identifiable health information accessible through a health information organization by providing notice as explained in the health information organization's notice of health information practices. If an individual provides a notice of opt out to a health care provider, the health care provider must promptly provide that notice to the health information organization in the manner provided in the health information organization's policies. A decision to opt out of having individually identifiable health information accessible through the health information organization may be changed by an individual at any time by providing notice as explained in the health information organization's notice of health information practices. Individuals who previously elected to opt out of having a particular health care provider's data accessible through the health information organization will be treated by the health information organization as having elected to opt out under this section within ninety days after August 27, 2019. 36-3804. Notice of health information practices; posting; distribution; decision to opt out A. A health information organization must maintain a written notice of health information practices describing the following: 1. Individually identifiable health information that is accessible through the health information organization. 2. The categories of persons who have access to information, including individually identifiable health information, through the health information organization. 3. The purposes for which access to the information, including individually identifiable health information, is provided through the health information organization. The notice of health information practices may reference a publicly accessible website that displays the current list of allowed purposes for which access to this information is allowed through the health information organization. 4. Except as otherwise provided in state or federal law, the individual's right to opt out of having the individual's individually identifiable health information accessible through the health information organization. 5. An explanation as to how an individual may opt out of having the individual's individually identifiable health information accessible through the health information organization. B. The notice shall include a statement informing the individual of the right not to have the individual's individually identifiable health information accessible through the health information organization, except as otherwise provided by state or federal law, and that this right is protected by article XXVII, section 2, Constitution of Arizona. C. A health information organization must post its current notice of health information practices on its website in a conspicuous manner. D. Notwithstanding any other requirement in this section, a health information organization must provide an individual with a copy of the notice of health information practices within thirty days after receiving a written request for that information. E. A health care provider participating in a health information organization must distribute and document the distribution of the health information organization's notice of health information practices in the same circumstances and in the same manner as the health care provider is required to distribute and document a notice of privacy practices by the health insurance portability and accountability act (45 Code of Federal Regulation section 164.520(c)(2) and (3)). The health information organization's notice of health information privacy practices must use a legible font in at least ten-point type. Health care providers that share a location may provide the health information organization's notice of health information practices for, or on behalf of, any of the health care providers that share a location. F. Except as otherwise provided in state or federal law, if an individual chooses to opt out of having the individual's individually identifiable health information accessible through the health information organization, the individual's individually identifiable health information shall not be accessible through the health information organization later than thirty days after the health information organization receives notice, in the manner explained in the health information organization's notice of health information practices, of the individual's decision to opt out. A person who receives de-identified information from the health information organization may not use such de-identified information, either alone or in combination with other information, to identify an individual. G. If there is a material change to a health information organization's notice of health information practices, including the health information organization's capability to implement individual preferences for sharing or segregating individually identifiable health information, a health care provider must redistribute the notice of health information practices at the next point of contact with the individual or in the same manner and within the same time period as is required by 45 Code of Federal Regulations section 164.528 in relation to the health care provider's notice of privacy practices, whichever comes first. 36-3805. Disclosure of individually identifiable health information; transfer; consent A. Except as otherwise provided in state or federal law, disclosure of an individual's individually identifiable health information through a health information organization is allowed only if: 1. The individual has not opted out of having the individual's individually identifiable health information accessible through the health information organization. 2. The purpose of the disclosure is explained in the health information organization's current notice of health information practices. 3. The disclosure complies with the health insurance portability and accountability act privacy standard (45 Code of Federal Regulations part 164, subpart E). B. A health information organization may not sell or otherwise make commercial use of an individual's individually identifiable health information without the written consent of the individual. C. A health information organization may not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research or using the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer. A health care provider must document that it has provided a notice of transfer to the individual and that the individual has received and read and understands the notice. Documentation must be in the form of a signature by the individual indicating the individual has received and read and understands the notice and that the individual gives consent to the transfer of information. For the purposes of this subsection, "consent" means that a health care provider participating in a health information organization has provided a notice to the individual that is in at least twelve-point type and that describes the purposes of the transfer. D. This chapter does not: 1. Interfere with any other federal or state laws or regulations that provide more extensive protection of individually identifiable health information than provided in this chapter. 2. Limit, change or otherwise affect a health information organization's right or duty to exchange information, including individually identifiable health information and de-identified health information, in accordance with applicable law and by means other than through the health information organization. 36-3806. Required policies A health information organization must implement and enforce policies governing the privacy and security of individually identifiable health information and compliance with this chapter. These policies must: 1. Implement the individual rights prescribed in section 36-3802. 2. Address the individual's right to opt out of having the individual's individually identifiable health information accessible through the health information organization pursuant to section 36-3803. 3. Address the content and distribution of the notice of health information practices prescribed in section 36-3804. 4. Implement the restrictions on disclosure of individually identifiable health information through the health information organization as prescribed in section 36-3805. 5. Address security safeguards to protect individually identifiable health information as required by the health insurance portability and accountability act security rule (45 Code of Federal Regulations part 164, subpart C). 6. Prescribe the appointment and responsibilities of a person or persons who have responsibility for maintaining privacy and security procedures for the health information organization. 7. Require training of each employee and agent of the health information organization about the health information organization's policies, including the need to maintain the privacy and security of individually identifiable health information and the penalties for the unauthorized access, release, transfer, use or disclosure of individually identifiable health information. The health information organization must initially provide this training before an employee or agent may have access to individually identifiable health information available through the health information organization, and at a later time as reasonable and appropriate in accordance with the training implementation specifications required by the health insurance portability and accountability act privacy rule (45 Code of Federal Regulations section 164.530(b)). 36-3808. Civil litigation subpoenas; certification requirements A. Except as otherwise provided in state or federal law, individually identifiable health information that is accessible through a health information organization is not subject to a civil litigation subpoena directed to the health information organization unless section 12-2294.01 is followed and a court has determined on motion and notice to the health information organization and the parties to the civil litigation in which the subpoena is served that the information sought from the health information organization is not available from the original source and either is relevant to the subject matter involved in the pending civil action or is reasonably calculated to lead to the discovery of admissible evidence in the pending action. B. A person who issues a civil litigation subpoena to the health information organization pursuant to this section must certify before the issuance of the civil litigation subpoena that the requirements of subsection A of this section have been met. 36-3809. Health care providers; duty to maintain medical records; civil immunity A. A health care provider participating in a health information organization is responsible for maintaining the provider's own medical records pursuant to title 12, chapter 13, article 7.1. B. Participation in a health information organization does not impact the content, use or disclosure of medical records or information contained in medical records that are held in locations other than the health information organization. C. This chapter does not limit, change or otherwise affect a health care provider's right or duty to exchange medical records or information contained in medical records in accordance with applicable law. D. A health information organization is not liable for damages in any civil action for any of the following: 1. Inaccurate or incomplete health information that is provided by third parties and that is accessible through the health information organization. 2. Another person's use or disclosure of health information through the health information organization. 3. The use or disclosure of health information that is made in good faith pursuant to this article or as otherwise provided by law. The health information organization is presumed to have acted in good faith. This presumption may be rebutted by clear and convincing evidence. E. Subsection D of this section does not preclude liability for that portion of any damages resulting from intentional misconduct or gross negligence by a health information organization.