PENNSYLVANIA EHEALTH INFORMATION TECHNOLOGY ACT — 2012 Pa. Act 121 (historical enacted text)

Historical Act text

PRIOR PRINTER'S NOS. 1955, 2092, 2196PRINTER'S NO. 2269
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No.8Session of2012
INTRODUCED BY FOLMER, SCARNATI, PILEGGI, FARNESE, M. WHITE, GORDNER, BOSCOLA, D. WHITE, VANCE, ERICKSON, TARTAGLIONE, BLAKE, STACK, BRUBAKER AND PIPPY, FEBRUARY 13, 2012
AS AMENDED ON THIRD CONSIDERATION, JUNE 11, 2012
AN ACT
Establishing the Pennsylvania eHealth Partnership Authority and
the Pennsylvania eHealth Partnership Fund; providing for
consent and confidentiality of health information; and
establishing civil immunity under certain circumstances.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
CHAPTER 1
PRELIMINARY PROVISIONS
Section 101. Short title.
This act shall be known and may be cited as the Pennsylvania
eHealth Information Technology Act.
Section 102. Definitions.
The following words and phrases when used in this act shall
have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Authority." The Pennsylvania eHealth Partnership Authority.
"Board." The board of directors of the Pennsylvania eHealth
Partnership Authority.
"Electronic health record." An electronic record of health-
related information relating to an individual that is created,
3 gathered, managed and consulted by health care providers or <--
payers.
"Fund." The Pennsylvania eHealth Partnership Fund.
"Health care provider." A person licensed by the
Commonwealth to provide health care or professional clinical
services. The term includes:
(1) A "health care practitioner," as defined in section
103 of the act of July 19, 1979 (P.L.130, No.48), known as
the Health Care Facilities Act.
(2) A "health care provider," as defined in section 103
of the Health Care Facilities Act.
14 (3) A life or health insurer or other payer. <--
15 (4) (3) A public health authority. <--
16 (5) (4) A pharmacy. <--
17 (6) (5) A laboratory. <--
18 (7) (6) A person that provides items or services <--
described in section 1861(s) of the Social Security Act (49
Stat. 620, 42 U.S.C. § 1395x(s)).
21 (8) (7) A "provider of services," as defined in section <--
1861(u) of the Social Security Act (42 U.S.C. § 1395x(u)).
"Health information." Information, whether oral or recorded,
in any form or medium, that is created or received by a health
care provider relating to the following:
(1) The past, present or future physical or mental
health or medical condition of an individual.
(2) The past, present or future payment for the
provision of health care to an individual.
"Health information exchange." A Statewide interoperable
system established under this act that electronically moves and
exchanges health information between approved participating
health care providers or health information organizations in a
manner that ensures the secure exchange of health information to
provide care to patients.
"Health information organization." An information technology
infrastructure with an interoperable system that is established
8 by a health care provider or payer or that connects <--
9 participating health care providers or payers to ensure the <--
secure digital exchange of health information among participants
engaged in the care of the patient.
"Health information technology." Hardware, software,
integrated technologies or related licenses, intellectual
property, upgrades or packaged solutions sold as services that
are designed for or support the use by health care entities or
patients for the electronic creation, maintenance, access or
exchange of health information.
"Interoperability." The ability of different operating and
software systems to employ federally recognized standards to
exchange data securely, accurately, effectively and in a manner
that maintains and preserves the clinical purpose of the data.
"Participant." A person or entity which has been approved by
the Pennsylvania eHealth Partnership Authority to send and
receive health information using the health information
exchange.
"Payer." An entity that contracts or offers to contract to
provide, deliver, pay or reimburse any of the costs of health
care services, including an employer, a health care plan, the
Federal Government, the Commonwealth, a municipality, a labor
union or an entity licensed under any of the following:
(1) The act of May 17, 1921 (P.L.682, No.284), known as
The Insurance Company Law of 1921.
(2) The act of December 29, 1972 (P.L.1701, No.364),
known as the Health Maintenance Organization Act.
(3) 40 Pa.C.S. Ch. 61 (relating to hospital plan
corporations).
(4) 40 Pa.C.S. Ch. 63 (relating to professional health
services plan corporations).
CHAPTER 3
PENNSYLVANIA EHEALTH
PARTNERSHIP AUTHORITY
Section 301. Scope of chapter.
This chapter relates to the Pennsylvania eHealth Partnership
Authority.
Section 302. Pennsylvania eHealth Partnership Authority.
(a) Establishment.--There is hereby established a body
corporate and politic to be known as the Pennsylvania eHealth
Partnership Authority, which shall be an independent agency of
the Commonwealth. The powers and duties of the authority shall
be vested in and exercised by a board of directors.
(b) Composition.--The board shall consist of 15 members, who
must be residents of this Commonwealth, with two additional, ex
officio nonvoting members selected by members of the advisory
council, composed and appointed as follows:
(1) The Secretary of Health or a designee, who shall be
an employee of the Department of Health designated in writing
prior to service.
(2) The Secretary of Public Welfare or a designee, who
shall be an employee of the Department of Public Welfare
designated in writing prior to service.
(3) One representative of the health care community
focused on an unserved or underserved rural or urban patient
population, who shall be appointed by the Governor from a
list of individuals submitted for consideration by both the
Pennsylvania Area Health Education Center and the Association
of Community Health Centers.
(4) One physician or nurse appointed by the Governor
from lists of individuals submitted by the Pennsylvania
Medical Society, the Pennsylvania Osteopathic Medical
Association, the Pennsylvania Academy of Family Physicians
and the Pennsylvania State Nurses Association. At least one
name on each list shall include an individual residing in an
unserved or underserved rural patient population area and an
individual in an unserved or underserved urban patient
population area.
(5) One hospital representative appointed by the
Governor from a list of individuals submitted by the Hospital
and Healthsystem Association of Pennsylvania. At least one
name on this list shall include an individual residing in an
unserved or underserved rural or urban patient population
area.
(6) One insurance representative appointed by the
Governor from lists of individuals submitted by the Blue
Cross and Blue Shield plans and the Insurance Federation of
Pennsylvania.
(7) One representative of an assisted living residence,
personal care home, long-term care nursing facility,
continuing care facility or behavioral or mental health
facility who shall be appointed by the Governor.
(8) Two consumer representatives appointed by the
Governor who are not primarily involved in providing health
care or health care insurance. At least one of these
individuals shall have expertise in health care or health
care information technology or the laboratory industry.
(9) Three representatives from established health
information organizations appointed by the President pro
tempore of the Senate, in consultation with the Majority
Leader and the Minority Leader of the Senate, each of whom
shall recommend one person. At least one of these
representatives shall be from the private information
technology sector with knowledge about security issues.
(10) Three representatives from established health
information organizations appointed by the Speaker of the
House of Representatives, in consultation with the Majority
Leader and the Minority Leader of the House of
Representatives, each of whom shall recommend one person. At
least one of these representatives shall be from the private
information technology sector with knowledge about security
issues.
(c) Terms.--Except a member as specified in subsection (b)
(1) or (2), a member of the board shall serve for a term of
three years after completion of the initial terms designated in
subsection (g) and may not be eligible to serve more than two
full consecutive three-year terms. A member shall remain on the
board until the member's replacement is appointed and,
notwithstanding any other provision of this act, all terms end
at the expiration of the authority.
(d) Quorum.--A majority of the appointed members of the
board shall constitute a quorum. Action may be taken by the
board at a meeting upon a vote of a quorum of its members
present in person or through electronic means if authorized by
the bylaws of the board.
(e) Meetings.--The board shall meet at the call of the
chairperson or as may be provided in the bylaws of the board.
The board shall hold meetings at least quarterly, which shall be
subject to the requirements of 65 Pa.C.S. Ch. 7 (relating to
open meetings). Meetings of the board may be held anywhere
within this Commonwealth.
(f) Chairperson.--The Governor shall appoint a chairperson
from among the authority members.
(g) Initial appointment and vacancy.--
(1) A member appointed under subsection (b)(3), (4) or
(5) shall be appointed to an initial term of two years with
the option for reappointment to two additional three-year
terms.
(2) A member appointed under subsection (b)(6) or (7)
shall be appointed to an initial term of one year with the
option for reappointment to two additional three-year terms.
(3) A member appointed under subsection (b)(8) shall be
appointed to an initial term of three years with the option
for reappointment to one additional three-year term.
(4) A member appointed under subsection (b)(9) or (10)
shall be appointed to an initial term that coincides with the
appointing members' terms with the option for reappointment
to two additional three-year terms.
(h) Formation.--The board shall be formed within 90 days of
the effective date of this act.
Section 303. Powers and duties.
(a) General rule.--The board shall:
(1) Adopt bylaws necessary to establish the authority
and carry out the provisions of this act.
(2) Develop, establish and maintain a health information
exchange that complies with Federal and State law and that:
(i) Promotes efficient and effective communication
5 among multiple health care providers, payers and <--
participants.
(ii) Creates efficiencies and promotes accuracy in
the delivery of health care.
(iii) Supports the ability to improve community
health status.
(3) Employ individuals as necessary to carry out the
purposes of this act. Individuals employed by the authority
shall be considered employees of the Commonwealth for the
purposes of 71 Pa.C.S. Pt. XXV (relating to retirement for
State employees and officers).
(4) Adopt all of the following:
(i) Policies and procedures to govern the electronic
exchange of health information in accordance with this
act.
(ii) Rules, responsibilities and obligations for
organizations and individuals to become and remain
participants in the health information exchange.
(iii) Policies and procedures for organizations and
individuals to be suspended and disengaged as
participants in the health information exchange.
(5) Make, execute and deliver contracts, grants and
other instruments.
(6) Apply for, solicit, receive, establish priorities
for, allocate, disburse, contract for, administer and expend
funds consistent with the purposes of this act.
(7) Apply for, accept and administer grants and loans to
carry out the purpose of the authority.
(8) Accept funds from both public and private sources,
consistent with Federal and State law.
(9) Develop and maintain a directory of health care
provider's contact information to enable participants to
share health information electronically.
(10) Develop criteria for the approval of participants
in the health information exchange.
(11) Develop and maintain standards to ensure
interoperability.
(12) Establish and collect fees adopted by the
authority. Fees may include transaction fees, subscription
fees or other fees or donations, to cover costs of
implementation and operation of the exchange or for other
services provided by the authority. Receipt of services
provided by or through the authority may be conditioned on
payment of fees. Participation in the exchange by any health
care provider, payer, consumer or any other person is
voluntary.
(13) Establish advisory groups with a diverse membership
representing interested and affected groups and individuals,
two of which shall be selected by other members of the group
to serve as nonvoting members of the board or the authority.
(14) Develop and conduct public information programs to
educate and inform consumers and patients about health
information.
(15) Submit an annual report to the Governor, the
President pro tempore of the Senate and the Speaker of the
House of Representatives for distribution to appropriate
legislative committees on the activities of the authority for
the year, including a summary of the receipts and
expenditures, a list of contracts and a summary of any
reportable security breaches that occurred and corrective
actions that were taken.
(16) Develop and maintain:
(i) a registry of patients choosing to opt out of
the health information exchange; and
9 (ii) procedures to reenroll re-enroll into the <--
health information exchange.
(17) Perform all other activities in furtherance of the
purposes of this act.
(b) Audit.--
(1) The accounts and books of the authority shall be
examined and audited annually by an independent certified
public accounting firm. The audit shall be public
information.
(2) The authority shall, by December 31 of each year,
file a copy of the audit of the preceding Commonwealth fiscal
year required under paragraph (1) with the Secretary of the
Senate and the Chief Clerk of the House of Representatives.
(c) Publication.--The authority shall annually submit a
financial statement to the Legislative Reference Bureau for
publication in the Pennsylvania Bulletin.
(d) Expiration.--The authority shall expire five years after
the effective date of this chapter. One year prior to the
expiration, the Legislative Budget and Finance Committee shall
evaluate the management, viability and performance of the health
information exchange and shall provide a report to the
Communications and Technology Committee of the Senate and the
Health Committee of the House of Representatives and the Human
Services Committee of the House of Representatives. The report
shall include recommendations as to reauthorization of the
authority, dissolution of the authority or assumption of the
authority's responsibilities and assets by another entity.
CHAPTER 5
PENNSYLVANIA EHEALTH PARTNERSHIP FUND
Section 501. Establishment.
There is established a separate fund in the State Treasury to
be known as the Pennsylvania eHealth Partnership Fund. The fund
shall be administered by the authority.
Section 502. Funds.
All moneys deposited into the fund shall be held for the
purposes of the authority and may not be considered a part of
the General Fund, but shall be used only to effectuate the
purposes of this act as determined by the authority. All
interest earned from the investment or deposit of moneys
accumulated in the fund shall be deposited in the fund for the
same use.
CHAPTER 7
CONSENT AND CONFIDENTIALITY
OF HEALTH INFORMATION
Section 701. Consent and confidentiality of health information.
(a) Construction.--
(1) Nothing in this act shall be construed to prohibit a
26 health care provider or payer from obtaining and storing a <--
patient's health records in electronic form or exchanging
28 health information with another health care provider or payer <--
in accordance with Federal law or State law other than this
act.
(2) Nothing in this act shall supersede or limit any
other law which requires additional consent to the release of
health information or otherwise establishes greater
restrictions or limitations on the release of health
information.
(b) Consent.--The authority shall promulgate a consent form
including notice of a patient's ability to decline to allow
exchange of the patient's electronic health information in the
health information exchange. The notice shall include, at a
minimum and in plain language, the following information:
(1) Definition of a health information exchange.
(2) Explanation of the benefits of participation in the
health information exchange.
(3) Explanation of the limits of the patient's ability
to decline the release or exchange of the patient's health
information with the health information exchange.
(4) Explanation of the manner in which the health
information exchange will address privacy issues.
(5) Explanation of the manner in which an individual may
decline to participate in the health information exchange.
(c) Opt-out registry.--
(1) In order to decline participation in the health
information exchange, a patient must sign and date a form
declining participation. If appropriate, the signature must
be witnessed by the patient's representative. Copies of the
completed form shall be sent by the provider within five
business days to the authority to be included in an opt-out
registry.
(2) After receipt of the form, the authority shall
within five business days notify health information
organizations that the patient has not authorized the release
of the health information.
(3) Once the patient is included in the opt-out
registry, the authority shall notify the patient. The
notification shall include a copy of the completed form
signed by the patient or electronic notification to the
patient.
(4) The patient alone shall decide to opt out of a
health information exchange.
(d) Disclosure.--
(1) The authority shall retain only the health
information necessary for the operation of the health
information exchange. The authority may not disclose, without
prior written consent of the patient, any health information
that the authority or its employees, agents or contractors
retain, or to which the authority or its agents or
contractors have access or any other health records
maintained or accessible by the authority under this act, to
any person who is not an authorized employee, agent or
contractor of the authority, except as required by law.
(2) Sharing health information among participants in the
health information exchange shall not be considered a
disclosure under paragraph (1).
(3) Violations of this subsection:
(i) shall subject employees, agents and contractors
to administrative discipline, including discharge and
suspension; and
(ii) shall subject contractors to monetary penalties
or contract revocation or suspension.
(e) Construction.--Nothing in this act may be construed to
alter a proprietary interest held by any participant in any
record, data or information released, accepted or included in
the health information exchange, except insofar as the paperwork
approved by the authority may require participants to license
those interests by contract in order to allow for the free flow
of information.
CHAPTER 40
MISCELLANEOUS PROVISIONS
Section 4001. Nonapplicability.
(1) This act is subject to 1 Pa.C.S. § 2310 (relating to
sovereign immunity reaffirmed; specific waiver).
(2) The authority shall be subject to the act of
February 14, 2008 (P.L.6, No.3), known as the Right-to-Know
Law. Health information or personally identifying information
shall not be considered a public record for purposes of the
Right-to-Know Law.
17 (3) Nothing in this act is intended to affect common law <--
or statutory rights or obligations with respect to patient
accessibility to their electronic or nonelectronic medical
records.
Section 4002. Effective date.
This act shall take effect immediately.