Arizona 2022 Regular Session

Arizona House Bill HB2155 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	REFERENCE TITLE: health information organizations; research; disclosures State of Arizona House of Representatives Fifty-fifth Legislature Second Regular Session 2022 HB 2155 Introduced by Representative Cobb AN ACT Amending section 36-3805, Arizona Revised Statutes; amending title 36, chapter 38, article 1, Arizona Revised Statutes, by adding section 36-3807; relating to health information organizations. (TEXT OF BILL BEGINS ON NEXT PAGE)
2	2
3	3
4	4
5	5
6	6
7	7
8	8
9	9	REFERENCE TITLE: health information organizations; research; disclosures
10	10	State of Arizona House of Representatives Fifty-fifth Legislature Second Regular Session 2022
11	11	HB 2155
12	12	Introduced by Representative Cobb
13	13
14	14	REFERENCE TITLE: health information organizations; research; disclosures
15	15
16	16
17	17
18	18
19	19
20	20
21	21
22	22
23	23
24	24	State of Arizona
25	25
26	26	House of Representatives
27	27
28	28	Fifty-fifth Legislature
29	29
30	30	Second Regular Session
31	31
32	32	2022
33	33
34	34
35	35
36	36
37	37
38	38
39	39
40	40	HB 2155
41	41
42	42
43	43
44	44	Introduced by
45	45
46	46	Representative Cobb
47	47
48	48
49	49
50	50
51	51
52	52	AN ACT
53	53
54	54
55	55
56	56	Amending section 36-3805, Arizona Revised Statutes; amending title 36, chapter 38, article 1, Arizona Revised Statutes, by adding section 36-3807; relating to health information organizations.
57	57
58	58
59	59
60	60
61	61
62	62	(TEXT OF BILL BEGINS ON NEXT PAGE)
63	63
64	64
65	65
66	66	Be it enacted by the Legislature of the State of Arizona: Section 1. Section 36-3805, Arizona Revised Statutes, is amended to read: START_STATUTE36-3805. Disclosure of individually identifiable health information; transfer; consent; definition A. Except as otherwise provided in state or federal law, disclosure of an individual's individually identifiable health information through a health information organization is allowed only if: 1. The individual has not opted out of having the individual's individually identifiable health information accessible through the health information organization. 2. The purpose of the disclosure is explained in the health information organization's current notice of health information practices. 3. The disclosure complies with the health insurance portability and accountability act privacy standard standards (45 Code of Federal Regulations part 164, subpart E). B. A health information organization may not sell or otherwise make commercial use of an individual's individually identifiable health information without the written consent of the individual. C. A health information organization may not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research or using the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer. A health care provider must document that it has provided a notice of transfer to the individual and that the individual has received and read and understands the notice. Documentation must be in the form of a signature by the individual indicating the individual has received and read and understands the notice and that the individual gives consent to the transfer of information. For the purposes of this subsection, "consent" means that a health care provider participating in a health information organization has provided a notice to the individual that is in at least twelve-point type and that describes the purposes of the transfer unless the transfer complies with applicable federal and state laws that regulate the disclosure of individually identifiable health information or de-identified health information for research. If an individual has opted out pursuant to section 36-3803, the individual's identifiable health information may not be transferred for research. D. This chapter does not: 1. Interfere with any other federal or state laws or regulations that provide more extensive protection of individually identifiable health information than provided in this chapter. 2. Limit, change or otherwise affect a health information organization's right or duty to exchange information, including individually identifiable health information and de-identified health information, in accordance with applicable law and by means other than through the health information organization. E. For the purposes of this section, "research" has the same meaning prescribed in the health insurance portability and accountability act privacy standards (45 Code of Federal REgulations part 164, subpart E).END_STATUTE Sec. 2. Title 36, chapter 38, article 1, Arizona Revised Statutes, is amended by adding section 36-3807, to read: START_STATUTE36-3807. Use of de-identified health information; prohibition A person who receives an individual's de-identified health information from a health information organization may not use that de-identified health information, either alone or in combination with other information, to identify the individual.END_STATUTE
67	67
68	68	Be it enacted by the Legislature of the State of Arizona:
69	69
70	70	Section 1. Section 36-3805, Arizona Revised Statutes, is amended to read:
71	71
72	72	START_STATUTE36-3805. Disclosure of individually identifiable health information; transfer; consent; definition
73	73
74	74	A. Except as otherwise provided in state or federal law, disclosure of an individual's individually identifiable health information through a health information organization is allowed only if:
75	75
76	76	1. The individual has not opted out of having the individual's individually identifiable health information accessible through the health information organization.
77	77
78	78	2. The purpose of the disclosure is explained in the health information organization's current notice of health information practices.
79	79
80	80	3. The disclosure complies with the health insurance portability and accountability act privacy standard standards (45 Code of Federal Regulations part 164, subpart E).
81	81
82	82	B. A health information organization may not sell or otherwise make commercial use of an individual's individually identifiable health information without the written consent of the individual.
83	83
84	84	C. A health information organization may not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research or using the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer. A health care provider must document that it has provided a notice of transfer to the individual and that the individual has received and read and understands the notice. Documentation must be in the form of a signature by the individual indicating the individual has received and read and understands the notice and that the individual gives consent to the transfer of information. For the purposes of this subsection, "consent" means that a health care provider participating in a health information organization has provided a notice to the individual that is in at least twelve-point type and that describes the purposes of the transfer unless the transfer complies with applicable federal and state laws that regulate the disclosure of individually identifiable health information or de-identified health information for research. If an individual has opted out pursuant to section 36-3803, the individual's identifiable health information may not be transferred for research.
85	85
86	86	D. This chapter does not:
87	87
88	88	1. Interfere with any other federal or state laws or regulations that provide more extensive protection of individually identifiable health information than provided in this chapter.
89	89
90	90	2. Limit, change or otherwise affect a health information organization's right or duty to exchange information, including individually identifiable health information and de-identified health information, in accordance with applicable law and by means other than through the health information organization.
91	91
92	92	E. For the purposes of this section, "research" has the same meaning prescribed in the health insurance portability and accountability act privacy standards (45 Code of Federal REgulations part 164, subpart E).END_STATUTE
93	93
94	94	Sec. 2. Title 36, chapter 38, article 1, Arizona Revised Statutes, is amended by adding section 36-3807, to read:
95	95
96	96	START_STATUTE36-3807. Use of de-identified health information; prohibition
97	97
98	98	A person who receives an individual's de-identified health information from a health information organization may not use that de-identified health information, either alone or in combination with other information, to identify the individual.END_STATUTE