| |
| PRIOR PRINTER'S NOS. 1955, 2092 | PRINTER'S NO. 2196 |
|
| |
| THE GENERAL ASSEMBLY OF PENNSYLVANIA |
| |
| SENATE BILL |
|
| |
| |
| INTRODUCED BY FOLMER, SCARNATI, PILEGGI, FARNESE, M. WHITE, GORDNER, BOSCOLA, D. WHITE, VANCE, ERICKSON, TARTAGLIONE, BLAKE, STACK, BRUBAKER AND PIPPY, FEBRUARY 13, 2012 |
| |
| |
| SENATOR CORMAN, APPROPRIATIONS, RE-REPORTED AS AMENDED, MAY 21, 2012 |
| |
| |
| |
| AN ACT |
| |
1 | Establishing the Pennsylvania eHealth Partnership Authority and |
2 | the Pennsylvania eHealth Partnership Fund; providing for |
3 | consent and confidentiality of health information; and |
4 | establishing civil immunity under certain circumstances. |
5 | The General Assembly of the Commonwealth of Pennsylvania |
6 | hereby enacts as follows: |
7 | CHAPTER 1 |
8 | PRELIMINARY PROVISIONS |
9 | Section 101. Short title. |
10 | This act shall be known and may be cited as the Pennsylvania |
11 | eHealth Information Technology Act. |
12 | Section 102. Definitions. |
13 | The following words and phrases when used in this act shall |
14 | have the meanings given to them in this section unless the |
15 | context clearly indicates otherwise: |
16 | "Authority." The Pennsylvania eHealth Partnership Authority. |
17 | "Board." The board of directors of the Pennsylvania eHealth |
18 | Partnership Authority. |
|
1 | "Electronic health record." An electronic record of health- |
2 | related information relating to an individual that is created, |
3 | gathered, managed and consulted by authorized health care | <-- |
4 | providers. |
5 | "Fund." The Pennsylvania eHealth Partnership Fund. |
6 | "Health care provider." A provider of services as defined | <-- |
7 | under section 1861(u) of the Social Security Act (49 Stat. 620, |
8 | 42 U.S.C. § 301 et seq.), a provider of medical or health |
9 | services as defined under section 1861(s) of the Social Security |
10 | Act (42 U.S.C. § 301 et seq.) and any other person or |
11 | organization who furnishes, bills or is paid for health care in |
12 | the normal course of business and is licensed by the |
13 | Commonwealth to provide health care or professional clinical |
14 | services. |
15 | "Health information." Any information, whether oral or |
16 | recorded, in any form or medium that is created or received by a |
17 | health care provider, health plan, public health authority, |
18 | employer, life insurer, school or university or health care |
19 | clearing house and relates to any of the following: |
20 | (1) The past, present or future physical or mental |
21 | health condition of an individual. |
22 | (2) The past, present or future payment for the |
23 | provision of health care to an individual as defined under |
24 | section 1171(4) of the Health Insurance Portability and |
25 | Accountability Act of 1996 (Public Law 104-191, 110 Stat. |
26 | 1936). |
27 | "Health information exchange." The electronic movement of |
28 | health information among health information exchange systems |
29 | according to Federal laws and standards. |
30 | "Health information exchange systems." An information |
|
1 | technology infrastructure with an interoperable system that |
2 | connects health care providers to ensure the secure digital |
3 | exchange of health information among approved participants who |
4 | are engaged in the care of a patient. |
5 | "Health care provider." A person licensed by the | <-- |
6 | Commonwealth to provide health care or professional clinical |
7 | services. The term includes: |
8 | (1) A "health care practitioner," as defined in section |
9 | 103 of the act of July 19, 1979 (P.L.130, No.48), known as |
10 | the Health Care Facilities Act. |
11 | (2) A "health care provider," as defined in section 103 |
12 | of the Health Care Facilities Act. |
13 | (3) A life or health insurer or other payer. |
14 | (4) A public health authority. |
15 | (5) A pharmacy. |
16 | (6) A laboratory. |
17 | (7) A person that provides items or services described |
18 | in section 1861(s) of the Social Security Act (49 Stat. 620, |
19 | 42 U.S.C. § 1395x(s)). |
20 | (8) A "provider of services," as defined in section |
21 | 1861(u) of the Social Security Act (42 U.S.C. § 1395x(u)). |
22 | "Health information." Information, whether oral or recorded, |
23 | in any form or medium, that is created or received by a health |
24 | care provider relating to the following: |
25 | (1) The past, present or future physical or mental |
26 | health or medical condition of an individual. |
27 | (2) The past, present or future payment for the |
28 | provision of health care to an individual. |
29 | "Health information exchange." A Statewide interoperable |
30 | system established under this act that electronically moves and |
|
1 | exchanges health information between approved participating |
2 | health care providers or health information organizations in a |
3 | manner that ensures the secure exchange of health information to |
4 | provide care to patients. |
5 | "Health information organization." An information technology |
6 | infrastructure with an interoperable system that is established |
7 | by a health care provider or that connects participating health |
8 | care providers to ensure the secure digital exchange of health |
9 | information among participants engaged in the care of the |
10 | patient. |
11 | "Health information technology." Hardware, software, |
12 | integrated technologies or related licenses, intellectual |
13 | property, upgrades or packaged solutions sold as services that |
14 | are designed for or support the use by health care entities or |
15 | patients for the electronic creation, maintenance, access or |
16 | exchange of health information as defined under section 3000(5) | <-- |
17 | of the American Recovery and Reinvestment Act of 2009 (Public |
18 | Law 111-5, 123 Stat. 115). |
19 | "Interoperability." The ability of different operating and |
20 | software systems to employ federally recognized standards to |
21 | exchange data securely, accurately, effectively and in a manner |
22 | that maintains and preserves the clinical purpose of the data. |
23 | "Participant." A person or entity which has been approved by |
24 | the Pennsylvania eHealth Partnership Authority to send and |
25 | receive health information using the health information exchange | <-- |
26 | system. | <-- |
27 | "Payer." An entity that contracts or offers to contract to |
28 | provide, deliver, pay or reimburse any of the costs of health |
29 | care services, including an employer, a health care plan, the |
30 | Federal Government, the Commonwealth, a municipality, a labor |
|
1 | union or an entity licensed under any of the following: |
2 | (1) The act of May 17, 1921 (P.L.682, No.284), known as |
3 | The Insurance Company Law of 1921. |
4 | (2) The act of December 29, 1972 (P.L.1701, No.364), |
5 | known as the Health Maintenance Organization Act. |
6 | (3) 40 Pa.C.S. Ch. 61 (relating to hospital plan |
7 | corporations). |
8 | (4) 40 Pa.C.S. Ch. 63 (relating to professional health |
9 | services plan corporations). |
10 | "Protected health information." Personally identifying | <-- |
11 | health information that is any of the following: |
12 | (1) Transmitted or maintained by electronic or other |
13 | form of medium. |
14 | (2) Maintained in electronic media. |
15 | CHAPTER 3 |
16 | PENNSYLVANIA EHEALTH |
17 | PARTNERSHIP AUTHORITY |
18 | Section 301. Scope of chapter. |
19 | This chapter relates to the Pennsylvania eHealth Partnership |
20 | Authority. |
21 | Section 302. Pennsylvania eHealth Partnership Authority. |
22 | (a) Establishment.--There is hereby established a body |
23 | corporate and politic to be known as the Pennsylvania eHealth |
24 | Partnership Authority, which shall be an independent agency of |
25 | the Commonwealth. The powers and duties of the authority shall |
26 | be vested in and exercised by a board of directors. |
27 | (b) Composition.--The board shall consist of 15 members, who | <-- |
28 | must be residents of this Commonwealth, with two additional, ex |
29 | officio nonvoting members selected by members of the advisory |
30 | council, composed and appointed as follows: |
|
1 | (1) The Secretary of Health or a designee, who shall be |
2 | an employee of the Department of Health designated in writing |
3 | prior to service. |
4 | (2) The Secretary of Public Welfare or a designee, who |
5 | shall be an employee of the Department of Public Welfare |
6 | designated in writing prior to service. |
7 | (3) One representative of the health care community |
8 | focused on an unserved or underserved rural or urban patient |
9 | population, who shall be appointed by the Governor from a |
10 | list of individuals submitted for consideration by both the |
11 | Pennsylvania Area Health Education Center and the Association |
12 | of Community Health Centers. |
13 | (4) One physician or nurse who is a resident of this | <-- |
14 | Commonwealth appointed by the Governor from lists of |
15 | individuals submitted by the Pennsylvania Medical Society, |
16 | the Pennsylvania Osteopathic Medical Association, the |
17 | Pennsylvania Academy of Family Physicians and the |
18 | Pennsylvania State Nurses Association. At least one name on |
19 | each list shall include an individual residing in an unserved |
20 | or underserved rural patient population area and an |
21 | individual in an unserved or underserved urban patient |
22 | population area. |
23 | (5) One hospital representative who is a resident of | <-- |
24 | this Commonwealth appointed by the Governor from a list of |
25 | individuals submitted by the Hospital and Healthsystem |
26 | Association of Pennsylvania. At least one name on this list |
27 | shall include an individual residing in an unserved or |
28 | underserved rural or urban patient population area. |
29 | (6) One insurance representative who is a resident of | <-- |
30 | this Commonwealth appointed by the Governor from lists of |
|
1 | individuals submitted by the Blue Cross and Blue Shield plans |
2 | and the Insurance Federation of Pennsylvania. |
3 | (7) One representative of an assisted living residence, |
4 | personal care home, long-term care nursing facility or, | <-- |
5 | continuing care facility or behavioral or mental health | <-- |
6 | facility who shall be appointed by the Governor. |
7 | (8) Two consumer representatives of this Commonwealth's | <-- |
8 | consumers appointed by the Governor who are not primarily |
9 | involved in providing health care or health care insurance. |
10 | At least one of these individuals shall have expertise in |
11 | health care or health care information technology or the |
12 | laboratory industry. |
13 | (9) Three representatives from established health |
14 | information exchange systems organizations appointed by the | <-- |
15 | President pro tempore of the Senate, in consultation with the |
16 | Majority Leader and the Minority Leader of the Senate, each |
17 | of whom shall recommend one person. At least one of these |
18 | representatives shall be from the private information |
19 | technology sector with knowledge about security issues. |
20 | (10) Three representatives from established health |
21 | information exchange systems organizations appointed by the | <-- |
22 | Speaker of the House of Representatives, in consultation with |
23 | the Majority Leader and the Minority Leader of the House of |
24 | Representatives, each of whom shall recommend one person. At |
25 | least one of these representatives shall be from the private |
26 | information technology sector with knowledge about security |
27 | issues. |
28 | (c) Terms.--Except a member as specified in subsection (b) |
29 | (1) or (2), a member of the board shall serve for a term of |
30 | three years after completion of the initial terms designated in |
|
1 | subsection (g) and may not be eligible to serve more than two |
2 | full consecutive three-year terms. A member shall remain on the |
3 | board until the member's replacement is appointed and, |
4 | notwithstanding any other provision of this act, all terms end |
5 | at the expiration of the authority. |
6 | (d) Quorum.--A majority of the appointed members of the |
7 | board shall constitute a quorum. Action may be taken by the |
8 | board at a meeting upon a vote of a quorum of its members |
9 | present in person or through electronic means if authorized by |
10 | the bylaws of the board. |
11 | (e) Meetings.--The board shall meet at the call of the |
12 | chairperson or as may be provided in the bylaws of the board. |
13 | The board shall hold meetings at least quarterly, which shall be |
14 | subject to the requirements of 65 Pa.C.S. Ch. 7 (relating to |
15 | open meetings). Meetings of the board may be held anywhere |
16 | within this Commonwealth. |
17 | (f) Chairperson.--The Governor shall appoint a chairperson |
18 | from among the authority members. |
19 | (g) Initial appointment and vacancy.-- |
20 | (1) A member appointed under subsection (b)(3), (4) or |
21 | (5) shall be appointed to an initial term of two years with |
22 | the option for reappointment to two additional three-year |
23 | terms. |
24 | (2) A member appointed under subsection (b)(6) or (7) |
25 | shall be appointed to an initial term of one year with the |
26 | option for reappointment to two additional three-year terms. |
27 | (3) A member appointed under subsection (b)(8) shall be |
28 | appointed to an initial term of three years with the option |
29 | for reappointment to one additional three-year term. |
30 | (4) A member appointed under subsection (b)(9) or (10) |
|
1 | shall be appointed to an initial term that coincides with the |
2 | appointing members' terms with the option for reappointment |
3 | to two additional three-year terms. |
4 | (h) Formation.--The board shall be formed within 90 days of |
5 | the effective date of this act. |
6 | Section 303. Powers and duties. |
7 | (a) General rule.--The board shall: |
8 | (1) Adopt bylaws necessary to establish the authority | <-- |
9 | and carry out the provisions of this act, to operate, develop | <-- |
10 | and maintain the health information exchange system in |
11 | compliance with Federal and State law and to develop policies |
12 | and procedures to govern the exchange of health care |
13 | information. |
14 | (2) Establish a system to provide for the exchange of | <-- |
15 | electronic health information that Develop, establish and | <-- |
16 | maintain a health information exchange that complies with |
17 | Federal and State law and that: |
18 | (i) Promotes efficient and effective communication |
19 | among multiple health care providers, including | <-- |
20 | hospitals, physicians, payers, employers, pharmacies, |
21 | laboratories and other health care entities and |
22 | practitioners. |
23 | (ii) Creates efficiencies and promotes accuracy in | <-- |
24 | the delivery of health care. |
25 | (iii) Supports the ability to improve community |
26 | health status. |
27 | (3) Employ individuals as necessary to carry out the |
28 | purposes of this act. Individuals employed by the authority |
29 | shall be considered employees of the Commonwealth for the |
30 | purposes of 71 Pa.C.S. Pt. XXV (relating to retirement for |
|
1 | State employees and officers). |
2 | (4) Establish Adopt all of the following: | <-- |
3 | (i) Policies and procedures to govern the electronic | <-- |
4 | exchange of health information in accordance with this |
5 | act. |
6 | (i) (ii) Rules, responsibilities and obligations for | <-- |
7 | organizations and individuals to become and remain |
8 | participants in the health information exchange. | <-- |
9 | (ii) (iii) Policies and procedures for organizations | <-- |
10 | and individuals to be suspended and disengaged as |
11 | participants in the health information exchange. | <-- |
12 | (5) Make, execute and deliver contracts, grants and |
13 | other instruments. |
14 | (6) Apply for, solicit, receive, establish priorities |
15 | for, allocate, disburse, contract for, administer and expend |
16 | funds consistent with the purposes of this act. |
17 | (7) Apply for, accept and administer grants and loans to |
18 | carry out the purpose of the authority. |
19 | (8) Accept funds from both public and private sources, |
20 | consistent with Federal and State law. |
21 | (9) Develop and maintain a directory of health care |
22 | provider's contact information to enable participants to |
23 | share health information electronically. |
24 | (10) Develop criteria for interoperability and approve | <-- |
25 | the approval of participants in the health information | <-- |
26 | exchange. |
27 | (11) Assure that security standards and procedures to | <-- |
28 | protect confidentiality of electronic health records are |
29 | adopted and properly implemented. |
30 | (11) Develop and maintain standards to ensure | <-- |
|
1 | interoperability. |
2 | (12) Establish and collect fees adopted by the |
3 | authority. Fees may include transaction fees, subscription |
4 | fees or other fees or donations, to cover costs of |
5 | implementation and operation of the exchange or for other |
6 | services provided by the authority. Receipt of services |
7 | provided by or through the authority may be conditioned on |
8 | payment of fees. Participation in the exchange by any health |
9 | care provider, payer, consumer or any other person is |
10 | voluntary. |
11 | (13) Establish advisory groups with a diverse membership |
12 | representing interested and affected groups and individuals, |
13 | two of which shall be selected by other members of the group |
14 | to serve as nonvoting members of the board or the authority. |
15 | (14) Develop and conduct public information programs to |
16 | educate and inform consumers and patients about health |
17 | information. |
18 | (15) Submit an annual report to the Governor, the |
19 | President pro tempore of the Senate and the Speaker of the |
20 | House of Representatives for distribution to appropriate |
21 | legislative committees on the activities of the authority for |
22 | the year, including a summary of the receipts and |
23 | expenditures, a list of contracts and a summary of any |
24 | reportable security breaches that occurred and corrective |
25 | actions that were taken. |
26 | (16) Work with the Federal Government and other | <-- |
27 | governmental entities to achieve interoperability. |
28 | (16) Develop and maintain: | <-- |
29 | (i) a registry of patients choosing to opt out of |
30 | the health information exchange; and |
|
1 | (ii) procedures to reenroll into the health |
2 | information exchange. |
3 | (17) Perform all other activities in furtherance of the |
4 | purposes of this act. |
5 | (b) Audit.-- |
6 | (1) The accounts and books of the authority shall be |
7 | examined and audited annually by an independent certified |
8 | public accounting firm. The audit shall be public |
9 | information. |
10 | (2) The authority shall, by December 31 of each year, |
11 | file a copy of the audit of the preceding Commonwealth fiscal |
12 | year required under paragraph (1) with the Secretary of the |
13 | Senate and the Chief Clerk of the House of Representatives. |
14 | (c) Publication.--The authority shall annually submit a |
15 | financial statement to the Legislative Reference Bureau for |
16 | publication in the Pennsylvania Bulletin. |
17 | (d) Expiration.--The authority shall expire five years after |
18 | the effective date of this chapter. One year prior to the |
19 | expiration, the Legislative Budget and Finance Committee shall |
20 | evaluate the management, viability and performance of the health |
21 | information exchange and shall provide a report to the |
22 | Communications and Technology Committee of the Senate and the |
23 | Health Committee of the House of Representatives and the Human |
24 | Services Committee of the House of Representatives. The report |
25 | shall include recommendations as to reauthorization of the |
26 | authority, dissolution of the authority or assumption of the |
27 | authority's responsibilities and assets by another entity. |
28 | CHAPTER 5 |
29 | PENNSYLVANIA EHEALTH PARTNERSHIP FUND |
30 | Section 501. Establishment. |
|
1 | There is established a separate fund in the State Treasury to |
2 | be known as the Pennsylvania eHealth Partnership Fund. The fund |
3 | shall be administered by the authority. |
4 | Section 502. Funds. |
5 | All moneys deposited into the fund shall be held for the |
6 | purposes of the authority and may not be considered a part of |
7 | the General Fund, but shall be used only to effectuate the |
8 | purposes of this act as determined by the authority. All |
9 | interest earned from the investment or deposit of moneys |
10 | accumulated in the fund shall be deposited in the account fund | <-- |
11 | for the same use. |
12 | CHAPTER 7 |
13 | CONSENT AND CONFIDENTIALITY |
14 | OF HEALTH INFORMATION |
15 | Section 701. Consent and confidentiality of health information. |
16 | (a) Construction.--Nothing in this act shall be construed to | <-- |
17 | (a) Construction.-- | <-- |
18 | (1) Nothing in this act shall be construed to prohibit a |
19 | health care provider from obtaining and storing a patient's |
20 | medical health records in electronic form or exchanging | <-- |
21 | health information with another health care provider in | <-- |
22 | accordance with Federal or State law. Federal law or State | <-- |
23 | law other than this act. |
24 | (2) Nothing in this act shall supersede or limit any |
25 | other law which requires additional consent to the release of |
26 | health information or otherwise establishes greater |
27 | restrictions or limitations on the release of health |
28 | information. |
29 | (b) Consent.--The authority shall promulgate a consent form |
30 | including notice of a patient's right ability to decline to | <-- |
|
1 | allow exchange of the patient's electronic health information in |
2 | the health information exchange system. The notice shall | <-- |
3 | include, at a minimum and in plain language, the following |
4 | information: |
5 | (1) Definition of a health information exchange. |
6 | (2) Explanation of the benefits of participation in the |
7 | health information exchange system. | <-- |
8 | (3) Explanation of the limits of the patient's right | <-- |
9 | ability to decline the release or exchange of the patient's | <-- |
10 | electronic health information with the health information | <-- |
11 | exchange system to the health information exchange. | <-- |
12 | (4) Explanation of the manner in which the electronic | <-- |
13 | health information exchange system will address privacy | <-- |
14 | issues. and, where practicable, an opportunity to consent to | <-- |
15 | exchange of that health information on the electronic health |
16 | information exchange system. |
17 | (c) Notice to patients.--Upon implementation of the notice |
18 | of a patient's right to decline, a patient shall be provided |
19 | with the form by a health care provider. If a patient chooses to |
20 | execute a denial of release, the notice shall be signed, dated |
21 | and witnessed by the patient, or the patient's representative. |
22 | Copies of the executed form shall be kept by the provider and |
23 | delivered to the patient within five business days of the |
24 | provider's receipt of the executed form. | <-- |
25 | (5) Explanation of the manner in which an individual may |
26 | decline to participate in the health information exchange. |
27 | (c) Opt-out registry.-- |
28 | (1) In order to decline participation in the health |
29 | information exchange, a patient must sign and date a form |
30 | declining participation. If appropriate, the signature must |
|
1 | be witnessed by the patient's representative. Copies of the |
2 | completed form shall be sent by the provider within five |
3 | business days to the authority to be included in an opt-out |
4 | registry. |
5 | (2) After receipt of the form, the authority shall |
6 | within five business days notify health information |
7 | organizations that the patient has not authorized the release |
8 | of the health information. |
9 | (3) Once the patient is included in the opt-out |
10 | registry, the authority shall notify the patient. The |
11 | notification shall include a copy of the completed form |
12 | signed by the patient or electronic notification to the |
13 | patient. |
14 | (4) The patient alone shall decide to opt out of a |
15 | health information exchange. |
16 | (d) Disclosure.-- |
17 | (1) The authority shall retain only the personally | <-- |
18 | identifying health information necessary for the operation of | <-- |
19 | the health exchange information system information exchange. | <-- |
20 | The authority may not disclose, without prior written patient | <-- |
21 | consent of the patient, any personally identifying health | <-- |
22 | information that the authority or its employees, agents or | <-- |
23 | contractors retain, or to which the authority or its agents |
24 | or contractors have access or any other electronic health | <-- |
25 | records maintained or accessible by the authority under this |
26 | act, to any person who is not an authorized employee, agent |
27 | or contractor of the authority, except as required by law. |
28 | (2) Disclosures permitted by and between Sharing health | <-- |
29 | information among participants in the health information |
30 | exchange system may shall not be considered disclosures made | <-- |
|
1 | by the authority a disclosure under paragraph (1). | <-- |
2 | (3) Violations of this subsection: |
3 | (i) shall subject employees, agents and contractors |
4 | to administrative discipline, including discharge and |
5 | suspension; and |
6 | (ii) shall subject contractors to monetary penalties |
7 | or contract revocation or suspension. |
8 | (e) Construction.--Nothing in this act may be construed to |
9 | alter a proprietary interest held by any participant in any |
10 | record, data or information released, accepted or exchanged | <-- |
11 | included in the health information exchange system, except | <-- |
12 | insofar as the paperwork approved by the authority may require |
13 | participants to license those interests by contract in order to |
14 | allow for the free flow of information. |
15 | CHAPTER 40 |
16 | MISCELLANEOUS PROVISIONS |
17 | Section 4001. Nonapplicability. |
18 | (1) Nothing in this act shall constitute a waiver of | <-- |
19 | sovereign immunity. |
20 | (1) This act is subject to 1 Pa.C.S. § 2310 (relating to | <-- |
21 | sovereign immunity reaffirmed; specific waiver). |
22 | (2) The authority shall be subject to the act of |
23 | February 14, 2008 (P.L.6, No.3), known as the Right-to-Know |
24 | Law. Health information or personally identifying information |
25 | shall not be considered a public record for purposes of the |
26 | Right-to-Know Law. |
27 | (3) The authority may not be subject to legal process | <-- |
28 | related to lawsuits to which the authority is not a party. |
29 | Section 4002. Effective date. |
30 | This act shall take effect immediately. |
|
