N.D. Admin. Code Title 113 — North Dakota Health Information Network

Article 113-02 North Dakota Health Information Network

Chapter 113-02-01 North Dakota Health Information Network

N.D. Admin. Code 113-02-01-01 Organization of the health information technology office

1.History. The sixty-first legislative assembly created the health information technology office in the department of information technology and created the health information technology advisory committee.

2.Purpose. The health information technology office, upon recommendations of the advisory committee, shall implement a statewide interoperable health information infrastructure that is consistent with emerging national standards; promote the adoption and use of electronic health records and other health information technologies; promote interoperability of health information systems for the purpose of improving health care quality, patient safety, and the overall efficiency of health care and public health; apply for federal funds that may be available to assist the state and health care providers in implementing and improving health information technology; and establish a health information technology loan program to provide loans to health care providers for the purpose of purchasing and upgrading certified electronic health record technology, training personnel in the use of such technology, and improving the secure electronic exchange of health information.

The health information advisory committee shall collaborate with and make recommendations to the health information technology office. The health information technology advisory committee consists of the state chief information officer or the chief information officer's designee, the state health officer or the state health officer's designee, the governor or the governor's designee, the executive director of the department of human services or the executive director's designee, the chairman of the house human services committee and the chairman of the senate human services committee or if either or both of them are unwilling or unable to serve then the chairman of the legislative management shall appoint a replacement who is a member of the same legislative chamber as the individual being replaced, and individuals appointed by the governor to represent a broad range of public and private health information technology stakeholders.

3.Inquiries. General inquiries regarding the North Dakota health information technology office should be addressed to:

North Dakota Health Information Technology Office 600 East Boulevard Avenue, Dept. 113 Bismarck, ND 58505-0100

History

• Law Implemented: NDCC 28-32-02.1, 54-59-25, 54-59-26, 54-59-27, 54-59-28, 54-59-29, 54-59-30

N.D. Admin. Code 113-02-01-02 Definitions

Throughout this title, unless specifically stated otherwise, the following terms mean:

1."Authorized user" means a person who is authorized by a participant to participate in the North Dakota health information network and includes health care practitioners, employees, contractors, agents, or business associates of a participant. Those who may qualify as authorized users may be further defined in the North Dakota health information network policies and procedures.

2."Breach" means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under 45 CFR 164.402 which compromises the security or privacy of the protected health information.

3."Business associate" has the meaning set forth in 45 CFR 160.103 and generally means a person who creates, receives, maintains, or transmits protected health information in the performance of a function or activity on behalf of the covered entity. A subcontractor of a business associate may also be considered a business associate.

4."Individual" means a person who is the subject of protected health information and has the meaning set forth in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

5."Opt out" means that an individual has chosen to not participate in the North Dakota health

6."Participant" includes any organization, health care practitioner or institution, health plan, or clearinghouse who has executed a written participation agreement and business associate agreement with the North Dakota health information network.

7."Protected health information" means individually identifiable health information (any oral or recorded information relating to the past, present, or future physical or mental health of an individual; the provision of health care to the individual; or the payment for health care) maintained by any medium and transmitted by electronic media or in any other form or medium.

N.D. Admin. Code 113-02-01-03 Individual participation

1.Purpose. The North Dakota health information network functions to provide for the electronic use and disclosure of a participating individual's protected health information by qualifying participants and their authorized users.

2.Individual participation.

a.Individual participation in the North Dakota health information network is voluntary. All individuals are considered to be participating until an individual has made a written decision to opt out of participation in the North Dakota health information network. Unless an individual elects to not participate, the individual's protected health information will be available through the North Dakota health information network for the purposes specified in section 113-02-01-05.

b.An individual may choose not to participate completely or except for a medical emergency by completing and submitting the designated form to the North Dakota health

c.If an individual has chosen to not participate in the North Dakota health information network, then the individual's protected health information will not be available for use and disclosure through the North Dakota health information network except as required by law, as authorized by the individual in a medical emergency, or by the provider who originally created or ordered the creation of the individual's protected health information.

d.An individual may change a prior election by completing and submitting the designated form to the North Dakota health information network.

3.Individual rights.

a.An individual has the right to opt out of participation in the North Dakota health

b.A participant may not withhold coverage or care from an individual nor may a health insurer deny an individual a health insurance benefit based solely on that individual's choice to opt out of participation in the North Dakota health information network.

c.An individual has the right to request an amendment of incorrect protected health information created by the North Dakota health information network. The North Dakota health information network may review the request if it relates to information created by it or may require participants who created the information to review the request for an amendment.

d.An individual has the right to request an accounting of disclosures as defined under 45 CFR 164.528 and 42 U.S.C. 17935 section 13405(c).

e.An individual has the right to request a copy of the individual's protected health information that is available through the North Dakota health information network. The North Dakota health information network may provide the health information directly to the individual or may require participants to provide access to individuals.

f.An individual has the right to be notified, pursuant to 45 CFR 164.404, of a breach that affects the individual's protected health information.

g.An individual has the right to file a complaint as defined in the North Dakota health information network policies and procedures.

N.D. Admin. Code 113-02-01-04 Authorized participants

1.Access. The North Dakota health information network grants the rights to access the North Dakota health information network to participants and authorized users with a legitimate business need for purposes of treatment, obtaining payment for treatment, health care operations, to comply with public health reporting requirements, and as required by law.

2.Participant agreement requirement. Participants must execute a participation agreement with the North Dakota health information network prior to being granted access. Access and use of the North Dakota health information network is nontransferable by the participant.

3.Responsibilities. Participants shall identify all of its authorized users in accordance with the North Dakota health information network policies and procedures. The North Dakota health information network shall establish a unique identifier for each authorized user.

a.Access to an individual's protected health information shall be based on the authorized user's job function and relationship to the individual according to policies and procedures established by the North Dakota health information network.

b.Participants shall notify the North Dakota health information network within twenty-four hours of any authorized user who by reason of termination of employment or otherwise is removed as an authorized user.

c.Participants shall provide training for all of its authorized users consistent with the participant's and North Dakota health information network policies, including privacy and security requirements.

d.The participant may suspend, limit, or revoke the access authority of an authorized user on its own initiative upon a determination that the authorized user has not complied with the participant's or the North Dakota health information network policies. The participant shall be responsible for informing the North Dakota health information network immediately, and in any case within twenty-four hours, of any revocation or suspension.

4.Notification of breach. If an actual or suspected breach relates to the North Dakota health information network, participants shall notify the North Dakota health information network in the most expedient time possible and without unreasonable delay following discovery but no later than established policies of the North Dakota health information network and pursuant to 45 CFR 164, subpart D.

N.D. Admin. Code 113-02-01-05 Use and disclosure of protected health information

1.Approved uses and disclosures. A participant may use and disclose the protected health information accessible in the North Dakota health information network only for the following purposes:

a.Treatment, payment, and health care operations;

b.Permitted uses described in the participation agreement;

c.As allowed under 45 CFR parts 160 and 164; and

d.As required by law.

2.Prohibited uses and disclosures. An individual's protected health information may not be used without the individual's authorization by the North Dakota health information network, a participant, or a business associate for any of the following purposes:

a.Uses prohibited by law, including federal, state, or local laws, rules, or regulations;

b.Comparative studies or by third parties; or

c.The sale or commercial use of protected health information.

3.Audits. The North Dakota health information network is responsible for auditing the use of the health information network.

N.D. Admin. Code 113-02-01-06 Fees

Reserved

N.D. Admin. Code 113-02-01-07 Enforcement

1.The health information technology director may suspend or terminate the participation in the North Dakota health information network of any participant or authorized user.

2.The health information technology director, or designee, may provide written notice of suspension of a participant's access to the North Dakota health information network to all participants and may provide a written summary of the reasons for the suspension to the suspended participant. The participant may follow the necessary provisions for the appeal mechanisms of the North Dakota health information network policies and procedures by responding to the suspension with a plan of correction or an objection to the suspension. The health information technology director shall review and either accept or reject the plan of correction.

a.If the plan of correction is accepted, the health information technology director shall, upon completion of the plan of correction, reinstate the participant's access to the North Dakota health information network.

b.If the plan of correction is rejected, the participant may appeal the health information technology director's decision to the health information technology advisory committee for a final determination.

N.D. Admin. Code 113-02-01-08 Privacy and security protections

Appropriate safeguards must be used to prevent use or disclosure of protected health information other than permitted by the North Dakota health information network policies, including appropriate administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of protected health information through the North Dakota health information network.

1.At a minimum, appropriate safeguards shall be those identified in 45 CFR part 164, subpart C; and other applicable federal and state standards.

2.The North Dakota health information network shall report to a participant any successful unauthorized access, use, disclosure, modification, or destruction of a participant's electronic protected health information of which the North Dakota health information network is aware.

Chapter 113-01

N.D. Admin. Code 113-01

ARTICLE 113-01

Reserved