THE GENERAL ASSEMBLY OF PENNSYLVANIA

SENATE BILL

INTRODUCED BY FOLMER, SCARNATI, PILEGGI, FARNESE, M. WHITE, GORDNER, BOSCOLA, D. WHITE, VANCE, ERICKSON, TARTAGLIONE, BLAKE, STACK, BRUBAKER AND PIPPY, FEBRUARY 13, 2012

SENATOR CORMAN, APPROPRIATIONS, RE-REPORTED AS AMENDED, MAY 21, 2012   

AN ACT

Establishing the Pennsylvania eHealth Partnership Authority and

the Pennsylvania eHealth Partnership Fund; providing for

consent and confidentiality of health information; and

establishing civil immunity under certain circumstances.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

CHAPTER 1

PRELIMINARY PROVISIONS

Section 101.  Short title.

This act shall be known and may be cited as the Pennsylvania

eHealth Information Technology Act.

Section 102.  Definitions.

The following words and phrases when used in this act shall

have the meanings given to them in this section unless the

context clearly indicates otherwise:

"Authority."  The Pennsylvania eHealth Partnership Authority.

"Board."  The board of directors of the Pennsylvania eHealth

Partnership Authority.

"Electronic health record."  An electronic record of health-

related information relating to an individual that is created,

gathered, managed and consulted by authorized health care

<--

providers.

"Fund."  The Pennsylvania eHealth Partnership Fund.

"Health care provider."  A provider of services as defined

<--

under section 1861(u) of the Social Security Act (49 Stat. 620,

42 U.S.C. § 301 et seq.), a provider of medical or health

services as defined under section 1861(s) of the Social Security

Act (42 U.S.C. § 301 et seq.) and any other person or

organization who furnishes, bills or is paid for health care in

the normal course of business and is licensed by the

Commonwealth to provide health care or professional clinical

services.

"Health information."  Any information, whether oral or

recorded, in any form or medium that is created or received by a

health care provider, health plan, public health authority,

employer, life insurer, school or university or health care

clearing house and relates to any of the following:

(1)  The past, present or future physical or mental

health condition of an individual.

(2)  The past, present or future payment for the

provision of health care to an individual as defined under

section 1171(4) of the Health Insurance Portability and

Accountability Act of 1996 (Public Law 104-191, 110 Stat.

1936).

"Health information exchange."  The electronic movement of

health information among health information exchange systems

according to Federal laws and standards.

"Health information exchange systems."  An information

technology infrastructure with an interoperable system that

connects health care providers to ensure the secure digital

exchange of health information among approved participants who

are engaged in the care of a patient.

"Health care provider."  A person licensed by the

<--

Commonwealth to provide health care or professional clinical

services. The term includes:

(1)  A "health care practitioner," as defined in section

103 of the act of July 19, 1979 (P.L.130, No.48), known as

the Health Care Facilities Act.

(2)  A "health care provider," as defined in section 103

of the Health Care Facilities Act.

(3)  A life or health insurer or other payer.

(4)  A public health authority.

(5)  A pharmacy.

(6)  A laboratory.

(7)  A person that provides items or services described

in section 1861(s) of the Social Security Act (49 Stat. 620,

42 U.S.C. § 1395x(s)).

(8)  A "provider of services," as defined in section

1861(u) of the Social Security Act (42 U.S.C. § 1395x(u)).

"Health information."  Information, whether oral or recorded,

in any form or medium, that is created or received by a health

care provider relating to the following:

(1)  The past, present or future physical or mental

health or medical condition of an individual.

(2)  The past, present or future payment for the

provision of health care to an individual.

"Health information exchange."  A Statewide interoperable

system established under this act that electronically moves and

exchanges health information between approved participating

health care providers or health information organizations in a

manner that ensures the secure exchange of health information to

provide care to patients.

"Health information organization."  An information technology

infrastructure with an interoperable system that is established

by a health care provider or that connects participating health

care providers to ensure the secure digital exchange of health

information among participants engaged in the care of the

patient.

"Health information technology."  Hardware, software,

integrated technologies or related licenses, intellectual

property, upgrades or packaged solutions sold as services that

are designed for or support the use by health care entities or

patients for the electronic creation, maintenance, access or

exchange of health information as defined under section 3000(5)

<--

of the American Recovery and Reinvestment Act of 2009 (Public

Law 111-5, 123 Stat. 115).

"Interoperability."  The ability of different operating and

software systems to employ federally recognized standards to

exchange data securely, accurately, effectively and in a manner

that maintains and preserves the clinical purpose of the data.

"Participant."  A person or entity which has been approved by

the Pennsylvania eHealth Partnership Authority to send and

receive health information using the health information exchange

<--

system.

<--

"Payer."  An entity that contracts or offers to contract to

provide, deliver, pay or reimburse any of the costs of health

care services, including an employer, a health care plan, the

Federal Government, the Commonwealth, a municipality, a labor

union or an entity licensed under any of the following:

(1)  The act of May 17, 1921 (P.L.682, No.284), known as

The Insurance Company Law of 1921.

(2)  The act of December 29, 1972 (P.L.1701, No.364),

known as the Health Maintenance Organization Act.

(3)  40 Pa.C.S. Ch. 61 (relating to hospital plan

corporations).

(4)  40 Pa.C.S. Ch. 63 (relating to professional health

services plan corporations).

"Protected health information."  Personally identifying

<--

health information that is any of the following:

(1)  Transmitted or maintained by electronic or other

form of medium.

(2)  Maintained in electronic media.

CHAPTER 3

PENNSYLVANIA EHEALTH

PARTNERSHIP AUTHORITY

Section 301.  Scope of chapter.

This chapter relates to the Pennsylvania eHealth Partnership

Authority.

Section 302.  Pennsylvania eHealth Partnership Authority.

(a)  Establishment.--There is hereby established a body

corporate and politic to be known as the Pennsylvania eHealth

Partnership Authority, which shall be an independent agency of

the Commonwealth. The powers and duties of the authority shall

be vested in and exercised by a board of directors.

(b)  Composition.--The board shall consist of 15 members, who

<--

must be residents of this Commonwealth, with two additional, ex

officio nonvoting members selected by members of the advisory

council, composed and appointed as follows:

(1)  The Secretary of Health or a designee, who shall be

an employee of the Department of Health designated in writing

prior to service.

(2)  The Secretary of Public Welfare or a designee, who

shall be an employee of the Department of Public Welfare

designated in writing prior to service.

(3)  One representative of the health care community

focused on an unserved or underserved rural or urban patient

population, who shall be appointed by the Governor from a

list of individuals submitted for consideration by both the

Pennsylvania Area Health Education Center and the Association

of Community Health Centers.

(4)  One physician or nurse who is a resident of this

<--

Commonwealth appointed by the Governor from lists of

individuals submitted by the Pennsylvania Medical Society,

the Pennsylvania Osteopathic Medical Association, the

Pennsylvania Academy of Family Physicians and the

Pennsylvania State Nurses Association. At least one name on

each list shall include an individual residing in an unserved

or underserved rural patient population area and an

individual in an unserved or underserved urban patient

population area.

(5)  One hospital representative who is a resident of

<--

this Commonwealth appointed by the Governor from a list of

individuals submitted by the Hospital and Healthsystem

Association of Pennsylvania. At least one name on this list

shall include an individual residing in an unserved or

underserved rural or urban patient population area.

(6)  One insurance representative who is a resident of

<--

this Commonwealth appointed by the Governor from lists of

individuals submitted by the Blue Cross and Blue Shield plans

and the Insurance Federation of Pennsylvania.

(7)  One representative of an assisted living residence,

personal care home, long-term care nursing facility or, 

<--

continuing care facility or behavioral or mental health

<--

facility who shall be appointed by the Governor.

(8)  Two consumer representatives of this Commonwealth's

<--

consumers appointed by the Governor who are not primarily

involved in providing health care or health care insurance.

At least one of these individuals shall have expertise in

health care or health care information technology or the

laboratory industry.

(9)  Three representatives from established health

information exchange systems organizations appointed by the

<--

President pro tempore of the Senate, in consultation with the

Majority Leader and the Minority Leader of the Senate, each

of whom shall recommend one person. At least one of these

representatives shall be from the private information

technology sector with knowledge about security issues.

(10)  Three representatives from established health

information exchange systems organizations appointed by the

<--

Speaker of the House of Representatives, in consultation with

the Majority Leader and the Minority Leader of the House of

Representatives, each of whom shall recommend one person. At

least one of these representatives shall be from the private

information technology sector with knowledge about security

issues.

(c)  Terms.--Except a member as specified in subsection (b)

(1) or (2), a member of the board shall serve for a term of

three years after completion of the initial terms designated in

subsection (g) and may not be eligible to serve more than two

full consecutive three-year terms. A member shall remain on the

board until the member's replacement is appointed and,

notwithstanding any other provision of this act, all terms end

at the expiration of the authority.

(d)  Quorum.--A majority of the appointed members of the

board shall constitute a quorum. Action may be taken by the

board at a meeting upon a vote of a quorum of its members

present in person or through electronic means if authorized by

the bylaws of the board.

(e)  Meetings.--The board shall meet at the call of the

chairperson or as may be provided in the bylaws of the board.

The board shall hold meetings at least quarterly, which shall be

subject to the requirements of 65 Pa.C.S. Ch. 7 (relating to

open meetings). Meetings of the board may be held anywhere

within this Commonwealth.

(f)  Chairperson.--The Governor shall appoint a chairperson

from among the authority members.

(g)  Initial appointment and vacancy.--

(1)  A member appointed under subsection (b)(3), (4) or

(5) shall be appointed to an initial term of two years with

the option for reappointment to two additional three-year

terms.

(2)  A member appointed under subsection (b)(6) or (7)

shall be appointed to an initial term of one year with the

option for reappointment to two additional three-year terms.

(3)  A member appointed under subsection (b)(8) shall be

appointed to an initial term of three years with the option

for reappointment to one additional three-year term.

(4)  A member appointed under subsection (b)(9) or (10)

shall be appointed to an initial term that coincides with the

appointing members' terms with the option for reappointment

to two additional three-year terms.

(h)  Formation.--The board shall be formed within 90 days of

the effective date of this act.

Section 303.  Powers and duties.

(a)  General rule.--The board shall:

(1)  Adopt bylaws necessary to establish the authority

<--

and carry out the provisions of this act, to operate, develop

<--

and maintain the health information exchange system in

compliance with Federal and State law and to develop policies

and procedures to govern the exchange of health care

information.

(2)  Establish a system to provide for the exchange of

<--

electronic health information that Develop, establish and

<--

maintain a health information exchange that complies with

Federal and State law and that:

(i)  Promotes efficient and effective communication

among multiple health care providers, including

<--

hospitals, physicians, payers, employers, pharmacies,

laboratories and other health care entities and

practitioners.

(ii)  Creates efficiencies and promotes accuracy in

<--

the delivery of health care.

(iii)  Supports the ability to improve community

health status.

(3)  Employ individuals as necessary to carry out the

purposes of this act. Individuals employed by the authority

shall be considered employees of the Commonwealth for the

purposes of 71 Pa.C.S. Pt. XXV (relating to retirement for

State employees and officers).

(4)  Establish Adopt all of the following:

<--

(i)  Policies and procedures to govern the electronic

<--

exchange of health information in accordance with this

act.

(i) (ii)  Rules, responsibilities and obligations for

<--

organizations and individuals to become and remain

participants in the health information exchange.

<--

(ii) (iii)  Policies and procedures for organizations

<--

and individuals to be suspended and disengaged as

participants in the health information exchange.

<--

(5)  Make, execute and deliver contracts, grants and

other instruments.

(6)  Apply for, solicit, receive, establish priorities

for, allocate, disburse, contract for, administer and expend

funds consistent with the purposes of this act.

(7)  Apply for, accept and administer grants and loans to

carry out the purpose of the authority.

(8)  Accept funds from both public and private sources,

consistent with Federal and State law.

(9)  Develop and maintain a directory of health care

provider's contact information to enable participants to

share health information electronically.

(10)  Develop criteria for interoperability and approve 

<--

the approval of participants in the health information

<--

exchange.

(11)  Assure that security standards and procedures to

<--

protect confidentiality of electronic health records are

adopted and properly implemented.

(11)  Develop and maintain standards to ensure

<--

interoperability.

(12)  Establish and collect fees adopted by the

authority. Fees may include transaction fees, subscription

fees or other fees or donations, to cover costs of

implementation and operation of the exchange or for other

services provided by the authority. Receipt of services

provided by or through the authority may be conditioned on

payment of fees. Participation in the exchange by any health

care provider, payer, consumer or any other person is

voluntary.

(13)  Establish advisory groups with a diverse membership

representing interested and affected groups and individuals,

two of which shall be selected by other members of the group

to serve as nonvoting members of the board or the authority.

(14)  Develop and conduct public information programs to

educate and inform consumers and patients about health

information.

(15)  Submit an annual report to the Governor, the

President pro tempore of the Senate and the Speaker of the

House of Representatives for distribution to appropriate

legislative committees on the activities of the authority for

the year, including a summary of the receipts and

expenditures, a list of contracts and a summary of any

reportable security breaches that occurred and corrective

actions that were taken.

(16)  Work with the Federal Government and other

<--

governmental entities to achieve interoperability.

(16)  Develop and maintain:

<--

(i)  a registry of patients choosing to opt out of

the health information exchange; and

(ii)  procedures to reenroll into the health

information exchange.

(17)  Perform all other activities in furtherance of the

purposes of this act.

(b)  Audit.--

(1)  The accounts and books of the authority shall be

examined and audited annually by an independent certified

public accounting firm. The audit shall be public

information.

(2)  The authority shall, by December 31 of each year,

file a copy of the audit of the preceding Commonwealth fiscal

year required under paragraph (1) with the Secretary of the

Senate and the Chief Clerk of the House of Representatives.

(c)  Publication.--The authority shall annually submit a

financial statement to the Legislative Reference Bureau for

publication in the Pennsylvania Bulletin.

(d)  Expiration.--The authority shall expire five years after

the effective date of this chapter. One year prior to the

expiration, the Legislative Budget and Finance Committee shall

evaluate the management, viability and performance of the health

information exchange and shall provide a report to the

Communications and Technology Committee of the Senate and the

Health Committee of the House of Representatives and the Human

Services Committee of the House of Representatives. The report

shall include recommendations as to reauthorization of the

authority, dissolution of the authority or assumption of the

authority's responsibilities and assets by another entity.

CHAPTER 5

PENNSYLVANIA EHEALTH PARTNERSHIP FUND

Section 501.  Establishment.

There is established a separate fund in the State Treasury to

be known as the Pennsylvania eHealth Partnership Fund. The fund

shall be administered by the authority.

Section 502.  Funds.

All moneys deposited into the fund shall be held for the

purposes of the authority and may not be considered a part of

the General Fund, but shall be used only to effectuate the

purposes of this act as determined by the authority. All

interest earned from the investment or deposit of moneys

accumulated in the fund shall be deposited in the account fund 

<--

for the same use.

CHAPTER 7

CONSENT AND CONFIDENTIALITY

OF HEALTH INFORMATION

Section 701.  Consent and confidentiality of health information.

(a)  Construction.--Nothing in this act shall be construed to 

<--

(a)  Construction.--

<--

(1)  Nothing in this act shall be construed to prohibit a

health care provider from obtaining and storing a patient's

medical health records in electronic form or exchanging

<--

health information with another health care provider in

<--

accordance with Federal or State law. Federal law or State

<--

law other than this act.

(2)  Nothing in this act shall supersede or limit any

other law which requires additional consent to the release of

health information or otherwise establishes greater

restrictions or limitations on the release of health

information.

(b)  Consent.--The authority shall promulgate a consent form

including notice of a patient's right ability to decline to

<--

allow exchange of the patient's electronic health information in

the health information exchange system. The notice shall

<--

include, at a minimum and in plain language, the following

information:

(1)  Definition of a health information exchange.

(2)  Explanation of the benefits of participation in the

health information exchange system.

<--

(3)  Explanation of the limits of the patient's right 

<--

ability to decline the release or exchange of the patient's

<--

electronic health information with the health information

<--

exchange system to the health information exchange.

<--

(4)  Explanation of the manner in which the electronic 

<--

health information exchange system will address privacy

<--

issues. and, where practicable, an opportunity to consent to

<--

exchange of that health information on the electronic health

information exchange system.

(c)  Notice to patients.--Upon implementation of the notice

of a patient's right to decline, a patient shall be provided

with the form by a health care provider. If a patient chooses to

execute a denial of release, the notice shall be signed, dated

and witnessed by the patient, or the patient's representative.

Copies of the executed form shall be kept by the provider and

delivered to the patient within five business days of the

provider's receipt of the executed form.

<--

(5)  Explanation of the manner in which an individual may

decline to participate in the health information exchange.

(c)  Opt-out registry.--

(1)  In order to decline participation in the health

information exchange, a patient must sign and date a form

declining participation. If appropriate, the signature must

be witnessed by the patient's representative. Copies of the

completed form shall be sent by the provider within five

business days to the authority to be included in an opt-out

registry.

(2)  After receipt of the form, the authority shall

within five business days notify health information

organizations that the patient has not authorized the release

of the health information.

(3)  Once the patient is included in the opt-out

registry, the authority shall notify the patient. The

notification shall include a copy of the completed form

signed by the patient or electronic notification to the

patient.

(4)  The patient alone shall decide to opt out of a

health information exchange.

(d)  Disclosure.--

(1)  The authority shall retain only the personally

<--

identifying health information necessary for the operation of

<--

the health exchange information system information exchange.

<--

The authority may not disclose, without prior written patient 

<--

consent of the patient, any personally identifying health

<--

information that the authority or its employees, agents or

<--

contractors retain, or to which the authority or its agents

or contractors have access or any other electronic health

<--

records maintained or accessible by the authority under this

act, to any person who is not an authorized employee, agent

or contractor of the authority, except as required by law.

(2)  Disclosures permitted by and between Sharing health

<--

information among participants in the health information

exchange system may shall not be considered disclosures made

<--

by the authority a disclosure under paragraph (1).

<--

(3)  Violations of this subsection:

(i)  shall subject employees, agents and contractors

to administrative discipline, including discharge and

suspension; and

(ii)  shall subject contractors to monetary penalties

or contract revocation or suspension.

(e)  Construction.--Nothing in this act may be construed to

alter a proprietary interest held by any participant in any

record, data or information released, accepted or exchanged 

<--

included in the health information exchange system, except

<--

insofar as the paperwork approved by the authority may require

participants to license those interests by contract in order to

allow for the free flow of information.

CHAPTER 40

MISCELLANEOUS PROVISIONS

Section 4001.  Nonapplicability.

(1)  Nothing in this act shall constitute a waiver of

<--

sovereign immunity.

(1)  This act is subject to 1 Pa.C.S. § 2310 (relating to

<--

sovereign immunity reaffirmed; specific waiver).

(2)  The authority shall be subject to the act of

February 14, 2008 (P.L.6, No.3), known as the Right-to-Know

Law. Health information or personally identifying information

shall not be considered a public record for purposes of the

Right-to-Know Law.

(3)  The authority may not be subject to legal process

<--

related to lawsuits to which the authority is not a party.

Section 4002.  Effective date.

This act shall take effect immediately.