Patient Notification Toolkit

Transcripción

1 Patient Notification Toolkit A Step-by-Step Guide to Setting Up a Process for Notifying Your Patients of Their Rights Under Arizona Law Arizona Health-e Connection (AzHeC) is a non-profit, public-private partnership that drives the adoption of health information technology (HIT). AzHeC operates The Network, the statewide Health Information Exchange (HIE) and is pleased to provide this Toolkit with instructions and samples to assist health care providers in setting up the Patient Notification process required by Arizona law for providers that participate in a health information organization (HIO) like The Network. In addition to this Toolkit, The Network provides hands-on assistance to providers to integrate an efficient and effective patient notification and opt-out process into their operations. For questions or for assistance regarding implementing this Patient Notification Process as a Network participant, please call

2 Table of Contents Summary of Patient Notification Process 3 HIO Legal Requirements Overview.. 5 Key Required Documents 9 Patient Education Materials The Arizona HIO Statute.. 15 Appendix A Patient Notification Process Materials Notice of Health Information Practices (HIO Notice) English Notice of Health Information Practices (HIO Notice) Spanish Opt-Out Change Form English Opt-Out Change Form Spanish Opt Back-In Change Form English Opt Back-In Change Form - Spanish Release of Information (ROI) Form English Release of Information (ROI) Form Spanish Appendix B Patient Education Materials.. 30 Frequently Asked Questions for Network Participants Sample Script for Staff Link to Nurse Video English Link to Nurse Video Spanish What You Need to Know About Secure Sharing of Your Health Information English What You Need to Know About Secure Sharing of Your Health Information Spanish

3 Summary of Patient Notification Process Patient Notification Process_

4 Summary of Patient Notification Process (Notification of Right to Opt-Out) Arizona is an opt-out state which means that consent is not required for patient information to be shared in a health information organization (HIO). However, participating providers are required to provide notice to patients of their right to Opt-Out of their information being shared. This Patient Notification Process is required when the health care provider begins to participate in the HIO, that is when a provider begins to access or share data in the HIO. This Patient Notification Process includes three (3) steps: 1. Distribute the Notice of Health Information Practices (HIO Notice) to patients, once you begin to participate in the HIO. 2. Obtain a signature from the patient acknowledging receipt of the HIO Notice. This signature can be obtained on any form, including the health care provider s HIPAA Notice of Privacy Practices or conditions of admission or treatment. 3. Provide the Opt-Out Change Form or Opt Back-In Change Form to any patient who wants to change a decision regarding opting in or opting out. Three (3) things to remember: 1. The Arizona HIO statute does not require that a patient receive the HIO Notice before that patient s information is available and exchanged through the system. 2. The Arizona HIO statute requires the signature of a patient or health care decision maker acknowledging that the patient or guardian has received, read and understands the HIO Notice. 3. Under the Arizona HIO statute, there is no duty on behalf of the provider, to assist in gathering or completing the information on the Opt-Out Change Form, which should be used to capture a patient s desire to opt-out of the HIO. Sample language which can be placed on a Participant s HIPAA Notice, conditions of admission or treatment, or another form prepared by the Participant: I acknowledge receipt and have read and understand the Notice of Health Information Practices regarding my providers participation in The Network, the statewide Health Information Exchange (HIE), or I previously received this information and decline another copy. Patient Notification Process_

5 HIO Legal Requirements Overview Patient Notification Process_

6 HIO Overview of Legal Requirements Arizona Revised Statutes ( ARS ) , et seq., established the legal requirements in Arizona for exchanging health information through a Health Information Organization (HIO). The law also established key patient rights with respect to HIOs. Arizona is an opt-out state Since Arizona is an Opt-Out state patients may choose not to have their health information shared with others through an HIO. A provider participating in an HIO must provide the Notice of Health Information Practices (HIO Notice) to its patients, which informs patients of how health information exchange happens through an HIO and about their rights. If a patient does not optout of the HIO, providers participating in the HIO may exchange a patient s information with each other through the HIO. HIO participating health care providers are required to have a Patient Notification and Opt- Out Process Arizona health care providers who participate in an HIO are required to have a patient notification and opt-out process that involves these three (3) steps: 1. Providing the HIO Notice to patients at the first patient encounter after the provider begins to participate in the HIO (in other words, when the provider begins to share and/or access any individually identifiable health information through the HIO). The HIO Notice is a simple, two-sided document described in this Toolkit (see Key Documents) and available from The Network at 2. Obtaining a patient or guardian signature acknowledging that a patient or guardian has reviewed, read and understands the HIO Notice; and 3. Using an Opt-Out Change Form (see Key Documents), to capture a patient s desire to: a. Opt-out of having his or her information available for sharing among his or her providers through The Network; or b. Choose to have some of his or her information excluded, i.e. one provider s information Key Points to Understand The Patient Notification Process involves these simple steps. Here are a few key points to understand and keep in mind: 1. The Arizona HIO statute requires a health care provider to start distributing the HIO Notice to all of his or her patients, when the health care provider begins to participate in the HIO. While the Arizona HIO statute does not define what it means to participate in the HIO, The Network recommends health care providers start distributing the HIO Notice as soon as the health care provider begins to share patient health information through the HIO or when the provider begins to access data in the HIO (whichever comes first). Patient Notification Process_

7 Note: the statute does not require the distribution of the HIO Notice by HIO participants that are not health care providers, as defined by the Arizona HIO statute (e.g., clinical laboratories). 2. The Arizona HIO statute does not require that a patient receive the HIO Notice before that patient s information is available and exchanged through the system. Health care providers may provide a particular patient s health information to The Network before that particular patient has received the HIO Notice and has a chance to opt-out. The statute prohibits the HIO from allowing access to an individual s health information only if the individual has exercised his/her right to opt-out. There are two reasons why this approach was taken. One, stakeholders designing the HIO were concerned that an individual s health information be available for emergencies where that individual had not yet had an encounter with a health care provider participating in the HIO. Two, many health care providers do not have the technology to provide to the HIO just one patient s information at a time. To ensure that the public is educated about their rights before they have an encounter with a health care provider participating in the HIO, The Network created substantial public education about the HIO and related patient rights (see the consumer health IT website developed by AzHeC and The Network). 3. The Arizona HIO statute requires the signature of a patient or health care decision maker acknowledging that the patient or guardian has received, read and understands the HIO Notice. This signature can be obtained on any form, including the health care provider s HIPAA Notice of Privacy Practices or its Conditions of Admission or Treatment. The Health Information Portability and Accountability Act of 1996 (HIPAA) requires health care providers to provide a Notice of Privacy Practices (a HIPAA Notice) to their patients and to use a good faith effort to obtain each patient s signature indicating that the patient has received the HIPAA Notice. Network participants can meet the requirements of the Arizona HIO statute by including a statement on their HIPAA Notices that the patient has received, read and understands the HIO Notice. Alternatively, the Arizona required documentation and signature can be obtained on a health care provider s Conditions of Admission or treatment form, directly on the HIO Notice itself, or on another form that the provider drafts. 4. Network providers use the Opt-Out Change Form or Opt Back-In Change Form to capture patients decisions, but there is no duty under the HIO statute to assist in gathering or completing information on the form. The Opt-Out Change Form is the form used to capture a patient s desire to opt-out of an HIO or to prevent viewing of health information from a particular provider. It is the patient s responsibility to complete the form. Patient Rights under the Arizona HIO Statute Arizona law provides patients with the right to choose not to have their health information available through an HIO, and the right to change their mind. Providers use the Opt-Out Change Form or Opt Back-In Change Form to record these decisions: Patient Notification Process_

8 The right to opt-out of having their individually identified information securely shared through the HIO; The right to change their mind regarding an opt-out decision; and The right to opt-out of a particular health care provider sharing the individual s health information through the HIO (provided that, if the health care provider is an employee of an organization, the organization may choose to apply the opt-out to all health care providers employed by the organization). The Arizona HIO law also provides the following patient rights regarding their health information in an HIO: The right to ask for a copy of their health information that is available through the HIO; The right to request that incorrect health information about them be amended; The right to request a list of individuals who have viewed their information through the HIO for a period of at least 3 years before the patient s request; and The right to be notified of a breach at the HIO that affects the patient s individually identifiable health information. Patient Notification Process_

9 Key Required Documents Patient Notification Process_

10 Key Required Documents There are two essential documents that Network participants should use to implement and manage the Patient Notification Process required by Arizona law. The Notice of Health Information Practices (HIO Notice) is one key document required to comply with the Arizona HIO law. It is the primary information piece that describes how secure sharing works and advises patients of their rights. The Opt-Out Change Form is used to record a patient s decision to opt-out of participation in the HIO or to exclude information from a particular provider from being securely shared. The Opt-Back In Change Form is used for a patient to opt back in. Both documents are available in English and Spanish. The Network also provides a Request for Information (ROI) Form to accommodate a patient request for information regarding their health information in an HIO. Notice of Health Information Practices (HIO Notice) The HIO Notice is a simple, two-sided document that meets specific language and other requirements of the Arizona HIO law. To ensure compliance with the Arizona HIO law, providers should use the Notice of Health Information Practices (HIO Notice), which is available in this packet, from The Network and on the AzHeC website The HIO Notice should be provided to a patient at the provider s first encounter with the patient after the provider begins participating in the HIO. See Appendix A for the Notice of Health Information Practices (HIO Notice). What the HIO Notice Says Providers and office staff who interact with patients should read and become familiar with the HIO Notice. 1. Purpose and Key Message for Patients: The HIO Notice first explains secure information sharing and its benefits. It provides in the key message for patients who would like their providers to securely share their information through the HIO. There is no joining or enrollment. If patients do not opt-out, their information is automatically available for secure sharing. 2. How Secure Sharing of Information Works: The HIO Notice also describes how secure sharing works, including what information is shared, who can view a patient s information and how the information is protected. 3. Patient Rights Regarding Secure Electronic Information Sharing: The HIO Notice lists the specific patient rights, including the right to opt-out and the right to exclude information from a particular health care provider from secure sharing through the HIO. Signature Requirement The Arizona HIO statute requires the signature of a patient or health care decision maker acknowledging the patient or guardian has received, read and understands the HIO Notice. This signature can be obtained on one of the following forms: Patient Notification Process_

11 1. Notice of Privacy Practices (HIPAA Notice) Network Participants are required to provide and obtain a patient s signature on a Notice of Privacy Practices (HIPAA Notice). Network Participants can meet the signature requirement of the HIO statute by including a statement on their HIPAA Notice that the patient has received, read and understands the Notice of Health Information Practices (HIO Notice). 2. Conditions of Admission (COA) For Network Participants that provide and obtain a patient signature on a Conditions of Admission, Participants can meet the signature requirement of the HIO statute by including a statement on the Conditions of Admission that the patient has received, read and understands the HIO Notice. 3. A Form Drafted by the Participant A Network Participant can use a special form drafted by the Participant stating that the patient has received, read and understands the Notice of Health Information Practices (HIO Notice). Opt-Out Change Form The Opt-Out Change Form is used to record a patient s choice regarding his or her individually identifiable health information. After completion by a patient, these forms should be sent immediately to The Network. The form is used for two purposes: 1. To document a patient s choice to opt-out; 2. To document a patient s choice to have information excluded from a particular provider, and to record the name and address of that provider or providers Opt Back-In Change Form The Opt Back-In Change Form is used to record a patient s choice to opt back in and share their health information. After completion by a patient, these forms should be sent immediately to The Network. 1. To document the choice of a patient who has previously opted-out, to opt back in. See Appendix A for the Opt-Out Change Form and Opt Back-In Change Form Request for Information (ROI) Form The Arizona HIO Statute provides specific rights to patients regarding their health information in an HIO: The right to ask for a copy of their health information that is available through the HIO; The right to request that incorrect health information about them be amended; and The right to request a list of individuals who have viewed their information through the HIO for a period of at least 3 years before the patient s request. Patient Notification Process_

12 To accommodate patient requests for information, The Network provides a Request for Information (ROI) Form to assist providers who receive requests for information. It is important to note that: The Arizona HIO statute does not require providers to provide a Request for Information (ROI) Form; The ROI Form should be provided only upon request and only to patients who have received and acknowledged the Notice of Health Information Practices (HIO Notice) from a Network Participant and have not opted out; and The Arizona HIO statute does not require a provider to assist a patient in completing a Request for Information Form. For example, helping to identify a provider whose information a patient wants excluded from the HIO. See Appendix A for the Request for Information (ROI) Form Patient Notification Process_

13 Patient Education Materials Patient Notification Process _

14 Patient Education Materials The Network has developed patient education materials to assist in implementing the Patient Notification and Opt-Out process in your practice or at your facility. These include: Frequently Asked Questions for Network Participants This will help Network Participants answer patient questions about The Network and patient rights under Arizona law. Sample Script for Staff This is script that providers and staff can use to describe secure sharing of health information and patient rights under Arizona law. What you Need to Know About Secure Sharing of Your Health Information This is a basic fact sheet aimed at low literacy patients and consumers to provide basic information about secure health information exchange and the right to opt-out of having their information securely shared. Patient Video This is a 2-minute video that is available on the AzHeC website ( and on YouTube that provides a description of the benefits of secure sharing and patient rights under Arizona law. See Appendix B for Patient Education Materials Patient Notification Process_

15 The Arizona HIO Statute Patient Notification Process_

16 The Arizona HIO Statute Arizona Revised Statutes Title 36, Chapter 38, Article 1, Sections Definitions In this chapter, unless the context otherwise requires: 1. "Breach" has the same meaning prescribed in 45 Code of Federal Regulations, part 164, subpart D. 2. "Clinical laboratory" has the same meaning prescribed in section "De-identified health information" has the same meaning as described in 45 Code of Federal Regulations section "Health care decision maker" has the same meaning prescribed in section "Health care provider" has the same meaning prescribed in section "Health information organization" means an organization that oversees and governs the exchange of individually identifiable health information among organizations according to nationally recognized standards. Health information organization does not include: a. A health care provider or an electronic health record maintained by or on behalf of a health care provider. b. Entities that are subject to title 20 or that are health plans as defined in 45 Code of Federal Regulations section c. The exchange of individually identifiable health information directly between health care providers without a separate organization governing that exchange. 7. "Individual": a. Means the person who is the subject of the individually identifiable health information. b. Does not include an inmate as defined under the health insurance portability and accountability act privacy standards prescribed in 45 Code of Federal Regulations section "Individually identifiable health information" has the same meaning prescribed in the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 160 and part 164, subpart E. 9. "Medical records" has the same meaning prescribed in section "Opt-Out" means an individual's written decision that the individual's individually identifiable health information cannot be shared through a health information organization. 11. "Person" has the same meaning prescribed in section "Treatment" has the same meaning prescribed in the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 160 and part 164, subpart E. 13. "Written" means in handwriting or through an electronic transaction that meets the requirements of title 44, chapter 26. Patient Notification Process_

17 Individual rights A. A health information organization must provide the following rights to individuals: 1. To Opt-Out of participating in the health information organization pursuant to section To request a copy of the individual's individually identifiable health information that is available through the health information organization. The health information organization may provide this right directly or may require health care providers participating in the health information organization to provide access to individuals. The copy may be provided electronically, if the individual requesting the copy consents to electronic delivery of the individually identifiable health information, and must be provided to the individual within thirty days after the individual's request. Charges for copies are governed by section To request amendment of incorrect individually identifiable health information available through the health information organization. 4. To request a list of the persons who have accessed the individual's individually identifiable health information through the health information organization for a period of at least three years before the individual's request. This list must be provided to the individual within thirty days after the individual's request. 5. To be notified, pursuant to section and 45 Code of Federal Regulations part 164, subpart D, of a breach at the health information organization that affects the individual's individually identifiable health information. B. If an individual does not have the capacity to make health care decisions, the individual's health care decision maker may exercise all individual rights in this chapter on behalf of the individual Voluntary participation in health information organizations An individual has the right to Opt-Out of participating in a health information organization by providing notice as explained in the health information organization's notice of health information practices. An individual also has the right to Opt-Out of a particular health care provider sharing the individual's individually identifiable health information through the health information organization, provided that, if the health care provider is an employee of an organization, the organization may apply such Opt-Out to all health care providers employed by the organization. If an individual provides a notice of Opt-Out to a health care provider, the health care provider must provide that notice to the health information organization. A decision to Opt-Out of participating in a health care information organization may be changed by an individual at any time by providing notice as explained in the health information organization's notice of health information practices Notice of health information practices A. A health information organization must maintain a written notice of health information practices describing the following: 1. Individually identifiable health information that the health information organization collects about individuals. 2. The categories of persons who have access to information, including individually identifiable health information, through the health information organization. 3. The purposes for which access to the information, including individually identifiable health information, is provided through the health information organization. 4. The individual's right to Opt-Out of participating in the health information organization. 5. An explanation as to how an individual opts out of participating in the health information organization. Patient Notification Process_

18 B. The notice shall include a statement informing the patient of the right to choose to keep the patient's personal health information out of the health information organization and that this right is protected by article XXVII, section 2, Constitution of Arizona. C. A health information organization must post its current notice of health information practices on its website in a conspicuous manner. D. Notwithstanding any other requirement in this section, a health information organization must provide an individual with a copy of the notice of health information practices within thirty days after receiving a written request for that information. E. A health care provider participating in a health information organization must provide the health information organization's notice of health information practices in at least twelvepoint type to the provider's patients before or at the provider's first encounter with a patient, beginning on the first day of the provider's participation in the health information organization. A health care provider must document that it has provided the health information organization's notice of health information practices to a patient and that the patient has received and read and understands the notice. Documentation must be in the form of a signature by the patient indicating the patient has received and read and understands the notice of health information practices and whether the patient chooses to Opt-Out. As technology develops and electronic methods of receiving documentation from the patient exist, the health information organization is permitted to utilize such electronic documentation. F. If the patient chooses to Opt-Out of the health information organization, the patient's personal health information shall not be accessible through the health information organization no later than thirty days after the patient opts out. G. If there is a material change to a health information organization's notice of health information practices, a health care provider must redistribute the notice of health information practices at the next point of contact with the patient or in the same manner and within the same time period as is required by 45 Code of Federal Regulations section in relation to the health care provider's notice of privacy practices, whichever comes first Disclosure of individually identifiable health information A. A health information organization may disclose an individual's individually identifiable health information only if: 1. The individual has not opted out of participating in the health information organization. 2. The type of disclosure is explained in the health information organization's current notice of health information practices. 3. The disclosure complies with the health insurance portability and accountability act privacy rule, 45 Code of Federal Regulations part 164, subpart E. B. A health information organization may not sell or otherwise make commercial use of an individual's individually identifiable health information without the written consent of the individual. C. A health information organization may not transfer individually identifiable health information or deidentified health information to any person or entity for the purpose of research or using the information as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer. A health care provider must document that it has provided a notice of transfer to the individual and that the individual has received and read and understands the notice. Documentation must be in the form of a signature by the individual indicating the individual has received and read and understands the notice and Patient Notification Process_

19 that the patient gives consent to the transfer of information. For the purposes of this subsection, "consent" means that a health care provider participating in a health information organization has provided a notice to the individual that is in at least twelvepoint type and that describes the purposes of the transfer. D. This chapter does not interfere with any other federal or state laws or regulations that provide more extensive protection of individually identifiable health information than provided in this chapter Required policies A health information organization must implement and enforce policies governing the privacy and security of individually identifiable health information and compliance with this chapter. These policies must: 1. Implement the individual rights prescribed in section Address the individual's right to Opt-Out of participating in the health information organization pursuant to section Address the content and distribution of the notice of health information practices prescribed in section Implement the restrictions on disclosure of individually identifiable health information prescribed in section Address security safeguards to protect individually identifiable health information, as required by the health insurance portability and accountability act security rule, 45 Code of Federal Regulations part 164, subpart C. 6. Prescribe the appointment and responsibilities of a person or persons who have responsibility for maintaining privacy and security procedures for the health information organization. 7. Require training of each employee and agent of the health information organization about the health information organization's policies, including the need to maintain the privacy and security of individually identifiable health information and the penalties provided for the unauthorized access, release, transfer, use or disclosure of individually identifiable health information. The health information organization must provide this training before an employee or agent may have access to individually identifiable health information available to the health information organization, and twice a year for all employees and agents Implementing individual preference for sharing individually identifiable health information A health information organization must have technology capability to implement individual preferences for sharing or segregating individually identifiable health information within three years after the effective date of this section. After the health information organization obtains the technology capability to implement individual preferences for sharing or segregating individually identifiable health information, the health care provider must provide notice to the patient of the change pursuant to section , subsection G Subpoenas; certification requirements A. Individually identifiable health information that is maintained by a health information organization is not subject to a subpoena directed to the health information organization unless section is followed and a court has determined on motion and notice to the health information organization and the parties to the litigation in which the subpoena is served that the information sought from the health information organization Patient Notification Process_

20 is not available from the original source and either is relevant to the subject matter involved in the pending action or is reasonably calculated to lead to the discovery of admissible evidence in the pending action. B. A person who issues a subpoena to the health information organization pursuant to this section must certify before the issuance of the subpoena that the requirements of subsection A of this section have been met Health care providers; duty to maintain medical records A. A health care provider who participates in a health information organization is responsible for maintaining the provider's own medical records pursuant to title 12, chapter 13, article 7.1. B. Participation in a health information organization does not impact the content, use or disclosure of medical records or information contained in medical records that are held in locations other than the health information organization. C. This chapter does not limit, change or otherwise affect a health care provider's right or duty to exchange medical records or information contained in medical records in accordance with applicable law. Patient Notification Process_

21 Appendix A Patient Notification Process Patient Notification Process_

22 Notice of Health Information Practices You are receiving this notice because your health care provider participates in an electronic information service offered by The Network, a nonprofit 501(c)(3) non-governmental organization operated by Arizona Health-e Connection (AzHeC). This service does not cost you anything and can help your doctor and health care providers better coordinate your care by securely sharing your health information. This notice explains how electronic information sharing works and will help you understand your rights regarding this service under Arizona law. If you would like your doctor and other health care providers to electronically and securely share your health information to better coordinate your care, YOU DO NOT NEED TO DO ANYTHING. Your information will automatically be shared with your health care providers, unless you decide to Opt-Out. (See Your Rights Regarding Electronic Information Sharing) What does it mean to securely share information and how can it help you get better care? In a paper-based medical system, your medical tests or lab results are either mailed or faxed to your primary care doctor. But sometimes paper or faxed records are lost or don t arrive in time for your doctor visit. With electronic information sharing, your doctors and other health providers are able to securely share your health information with each other in a safe and timely manner. What medical information is available to be securely shared? Authorized medical practices will be able to share several types of health information about you, including but not limited to: Hospital: Admission and discharge information from hospitals that use the service Medical history Medicines you take Allergies including allergies to medicines Lab test results and radiology reports Doctor visit information Health plan enrollment and eligibility Who can view your medical information electronically? Only people involved in your care have access to your information. This may include doctors, nurses, and other care providers who are providing and coordinating your care. Your health insurer may also view your information to help coordinate or manage your care. How is your medical information protected? The Network is required to follow federal law the Health Insurance Portability and Accountability Act or HIPAA to protect your private health information. People with access have a unique username and password and get training before they can see your information, so that they know how to protect it. In addition, the system records every time someone looks at your medical information, and you can ask for a list of who has viewed your information and when. Are there additional security measures? Information is shared using secure, encrypted transmission. Patient Notification Process_

23 Your Rights Regarding Secure Electronic Information Sharing If you do nothing, your information may be securely shared with your health care providers. You have the right to: 1. Ask for a copy of your medical information that is available to be shared. Just ask your health care provider and you can get a copy within 30 days or sooner. 2. Request to have any information corrected. If any information in the system is incorrect, you can ask that provider to correct the information. 3. Ask for a list of providers who have viewed your information. Contact The Network for a list of people who have viewed your information in the system. Please let The Network know if you think someone has viewed your information who should not have. You have the right under article 27, section 2 of the Arizona Constitution to keep your medical information from being shared electronically through The Network. Specifically, you may: 1. Opt-Out of having your information available for sharing. To Opt-Out, you must ask your provider for the Opt-Out Change Form. After you submit the form, your information will not be available for sharing. Caution: There are risks in preventing your health care providers from sharing your health care information, especially in an emergency. 2. Choose to exclude some information from being shared. For example, if you see a clinician and you do not want that information shared, you can prevent it. On the Opt-Out Change Form, fill in the information and name of the provider for the information that you do not want shared. Caution: If that provider works for an organization (like a hospital or a group of physicians), all your information from that hospital or group of physicians may be blocked from view. 3. Change your mind at any time. If you say no today, you can change your mind at any time. If you do nothing today and allow your health records to be shared, you may Opt- Out in the future. For questions or further information: Call (602) thenetwork@azhec.org Visit N. 7th Street, Suite 130 Phoenix, Arizona Patient Notification Process_

24 Aviso Sobre Prácticas de Información Médica Usted recibe este aviso porque su proveedor de atención médica participa en un servicio de información electrónica que ofrece La Red de información médica (The Network), organización no gubernamental y sin fines de lucro 501(c)(3) operado por by Arizona Health-e Connection (AzHeC). Este servicio no tiene costo y puede ayudar a su médico y a los proveedores de atención médica a coordinar mejor su atención al compartir de forma segura su información médica. Este aviso explica cómo se hace el intercambio de información electrónica y le ayudará a entender sus derechos con respecto a ese servicio según la ley de Arizona. Si usted desea que su médico y otros proveedores de atención médica intercambien de forma segura y electrónica su información médica para coordinar mejor su atención médica, NO NECESITA HACER NADA. Se compartirá automáticamente su información entre sus proveedores de atención médica, a menos que usted decida no hacerlo. (Consulte Los Derechos sobre el Intercambio de Información Electrónica en la última página de este aviso). Qué significa compartir de forma segura la información y cómo puede ayudarle esto a recibir una mejor atención? En un sistema médico de registro en papel, las pruebas médicas o los resultados de laboratorios se envían por correo o fax al médico de atención primaria. Pero, a veces los registros en papel o fax se pierden o no llegan a tiempo para la visita al médico. Con el intercambio electrónico, los médicos y los proveedores de atención autorizados podrán compartir la información médica de forma segura y a tiempo. Qué información médica se puede compartir de forma segura? Las clínicas autorizadas podrán intercambiar varios tipos de información médica sobre usted, que incluye, pero no se limita a: Hospital: información sobre admisiones y altas de hospitales que usan el servicio Historial medico Medicamentos que toma Allergies: incluidas alergias a medicamentos Resultados de pruebas de Doctor laboratorio e informes de radiología Información sobre las consultas con el medico Inscripción en el plan médico y elegibilidad Quién puede ver su información médica de forma electrónica? Solo las personas involucradas en su atención tienen acceso a la información. Esto puede incluir a médicos, enfermeras y otros proveedores de atención que brindan y coordinan su atención. Su empresa de seguro médico también puede ver la información para coordinar y gestionar su atención. De qué manera se protege su información médica? Bajo la ley federal (Ley de Transferibilidad y Responsabilidad de Seguros Médicos o HIPAA), La Red debe proteger su información médica privada. Cada persona con acceso autorizado tiene un nombre de usuario único y una contraseña, y recibe capacitación antes de poder acceder a su información, para que sepa cómo protegerla. Además, el sistema registra cada vez que alguien consulta su información médica y usted puede pedir la lista de personas que vieron su información y cuándo lo hicieron. Además, hay una medida de seguridad adicional. La información se comparte mediante una transmisión segura y codificada. Patient Notification Process_

25 Derechos sobre el Intercambio de Información Electrónica Si usted no hace nada y su información se comparte de forma segura con los proveedores de atención médica, usted puede: 1. Pedir una copia de la información médica disponible para intercambio. Pedirle a su proveedor de atención médica que le dé una copia dentro de 30 días o antes. 2. Pedir que se corrija cualquier información. Si sabe qué proveedor incluyó información incorrecta en la información de intercambio con otros proveedores, puede pedirle al proveedor que la corrija. 3. Pedir una lista de los proveedores que han visto su información. Comunicarse con The Network para obtener una lista de las personas que han visto su información. Infórmele a The Network si usted cree que alguien ha visto su información indebidamente. Usted tiene el derecho, de acuerdo con el artículo 27, sección 2 de la Constitución de Arizona, de impedir que su información se comparta de forma electrónica. Específicamente, usted puede: 1. Optar por no compartir su información para intercambio. Si decide no compartir su información, debe pedirle a su proveedor Opt-out Formulario de Cambio (Opt-Out Change Form). Después de enviar el formulario, su información ya no estará disponible para intercambio; pero existen riesgos, especialmente en caso de una emergencia, si usted no permite que los proveedores de atención médica compartan la información médica de forma segura. 2. Decidir que se excluya alguna información del intercambio. Por ejemplo, si consultó con un clínico y no desea compartir esa información, puede prevenirlo. En el Opt-out Formulario de Cambio, complete la información y el nombre del proveedor para la información que no desea compartir. Atención: Si ese proveedor trabaja para una organización (como un hospital o grupo de médicos), es posible que se bloquee toda la información de ese hospital o grupo de médicos. 3. Cambiar su decisión, en cualquier momento. Si usted hoy dice que no, puede cambiar su decisión, en cualquier momento. Si usted no hace nada y permite que se compartan los registros médicos, puede decidir no hacerlo mediante el formulario Cambio de Consentimiento del Paciente al Intercambio de Información Médica. Si tiene preguntas o desea obtener más información: Llame al (602) Envíe un correo electrónico a thenetwork@azhec.org Visite N. 7th Street, Suite 130 Phoenix, Arizona Patient Notification Process_

26 OPT OUT CHANGE FORM Participant logo or Patient label Please fax this completed form to AzHeC s Secure Fax: (602) or (520) Please check the box next to your choice regarding the secure sharing of your health information among your health care providers. Be sure to sign the form at the end. Each family member should fill out and submit a separate form. Choice 1: I do not agree to have my medical information securely shared among my health care providers. I understand and accept the risks associated with denying any access by anyone under any circumstances including medical emergencies Choice 2: I agree to have my information shared among my health care providers EXCEPT information from the health care provider(s) listed below. This means others will not see information about me from this health care provider. Caution: If that provider works for an organization (like a hospital or a group of physicians), all your information from that hospital or group of physicians may be blocked from view. You must provide the full name, address and phone number of each health care provider you wish to exclude from sharing your health information. Incomplete information cannot be implemented. Submit one form for each provider. Health Care Provider Full Name Address Phone Number Signature: Print Full Name: Date of Birth: Patient ID/MRN: Date: Complete this section only if you are signing the form for another person Do you have the authority to make health care decisions on behalf of the patient? Yes No Patient Notification Process_

27 Formulario de Exclusión Cambio Participant logo or Patient label Por favor fax este forma completado a AzHeC s fax seguro: (602) or (520) Por favor marque el cuadro al lado de su elección con respecto a la distribución de su información de salud en forma segura entre sus proveedores de atención médica. Asegúrese de firmar la forma al final. Cada miembro de la familia debe llenar y presentar esta forma por separado. Opción 1: No estoy de acuerdo en que mi información médica sea compartida en forma segura a mis proveedores de atención médica. Entiendo y acepto los riesgos asociados a negar cualquier acceso por cualquier persona en cualquier circunstancia, incluyendo emergencias médicas. Opción 2: Acepto que mi información sea compartida entre mis proveedores de atención médica EXCEPTO la información del proveedor (es) de atención médica que se enumera a continuación. Esto significa que otros no verán información sobre mí de este proveedor de cuidado de la salud. Atención: Si ese proveedor trabaja para una organización (como un hospital o grupo de médicos), es posible que se bloquee toda la información de ese hospital o grupo de médicos. Usted debe dar el nombre completo, dirección y número de teléfono de cada proveedor de atención médica que desea excluir de compartir su información de salud. La información incompleta no puede ser implementada. Presentar un formulario por cada proveedor. Proveedor de Atención Médica Nombre Completo Dirección Número de Teléfono Favor de firmar aqui: Nombre Completo: Firma Fecha: Fecha de Nacimiento: Identificación de Pacientes / MRN: Complete esta sección sólo si usted va a firmar la forma para otra persona Tiene la autoridad para tomar decisiones de atención médica en nombre del paciente? Sí No Cuál es su relación con el paciente? Patient Notification Process_

28 OPT BACK IN CHANGE FORM Participant logo or Patient label Please fax this completed form to AzHeC s Secure Fax: (602) or (520) Please check the box next to Yes: Opt Back In ONLY if you have previously opted out of the secure sharing of your health information among your health care providers. Be sure to sign the form at the end. Each family member should fill out and submit a separate form. Yes: Opt Back In. I want to change an earlier decision not to have my medical information shared among health care providers. I now agree to have my medical records securely shared. This may include health information gathered prior to the date I signed this form. Signature: Print Full Name: Date of Birth: Patient ID/MRN: Date: Complete this section only if you are signing the form for another person Do you have the authority to make health care decisions on behalf of the patient? Yes No What is your relationship with the patient? Patient Notification Process_

29 Formulario para volver a Cambio Partícipe logo o Paciente la etiqueta Por favor fax este forma completado a AzHeC s fax seguro: (602) or (520) Por favor marque la casilla junto a Sí : para volver a participar SOLAMENTE si ha optado previamente fuera del intercambio seguro de su información de salud entre sus proveedores de atención médica. Asegúrese de firmar la forma al final. Cada miembro de la familia debe llenar y presentar esta forma por separado. Sí : Para Volver a Participar: Quiero cambiar una decisión anterior de no tener mi información médica compartida entre los proveedores de atención médica. Ahora acepto que mis registros médicos sean compartidos en forma segura. Esto puede incluir la información de la salud recibida antes de la fecha de mi firma de esta forma. Favor de firmar aqui: Nombre Completo: Fecha de Nacimiento: Firma Fecha: Identificación de Pacientes / MRN: Complete esta sección sólo si usted va a firmar la forma para otra persona Tiene la autoridad para tomar decisiones de atención médica en nombre del paciente? Sí No Cuál es su relación con el paciente? Patient Notification Process_

30 RELEASE OF INFORMATION REQUEST Please fax this completed form to AzHeC Secure Fax: (602) or (520) Requestor s First Name: Requestor s Last Name: Requestor s Date of Birth: Phone: I am an individual who has received medical care in the State of Arizona and have not opted out of my medical data being accessed for legitimate purposes through The Network. I request the following information from The Network. (Please check all boxes that apply) All of the clinical information about me that The Network has available to its users. A list of all Entities and Providers who have accessed my medical information through The Network in the past three years. I understand in some instances, I may have to obtain a more complete listing from the Participating Entity as it may not be available in The Network. I would like to have this information provided to me by mail at the address indicated below. Street Address: Street Address #2: City: State: Zip: I understand that the information will be provided to me at the address listed above within 30 days. Complete the information below only in you have signed the form for another person Do you have the authority to make health care decision on behalf of the patient? Yes What is your relationship with the patient? Signature: No Print Full Name: Date: For office use only Signature: Print Name: Position: Patient Notification Process_

31 Forma de Solicitud Para Divulgación de Información Por favor fax este forma completado a AzHeC fax seguro: (602) or (520) Nombre del Solicitante: Apellido del Solicitante: Fecha de Nacimiento: Número de Teléfono:: Yo soy una persona que ha recibido atención médica en el Estado de Arizona y que no ha optado por dejar que mis datos médicos sean accedidos con fines legítimos a través de la Red de Información de Salud de The Network Solicito la siguiente información de The Network. (por favor marque todos los cuadros que correspondan) Calle: Calle #2: toda la información clínica sobre mí que The Network tiene a disposición para sus usuarios una lista de todas las entidades y proveedores que han tenido acceso a mi información médica a través de The Network en los últimos tres años. Entiendo que en algunos casos puede que tenga que obtener una lista más completa de la Entidad Participante. Me gustaria que esta información sea proporcionada a mí por correo a la dirección que se indica a continuación. Ciudad Estado: Código Postal: Entiendo que la información será proporcionada a mí a la dirección que aparece más arriba dentro de los 30 días. Complete la siguiente información sólo si ha firmado para otra persona: Tiene la autoridad para tomar decisiones de atención médica en nombre del paciente? Si No Cuál es su relación al paciente? Firma: Fecha: For office use only Signature: Print Name: Position: Patient Notification Process_

32 Appendix B Patient Education Materials Patient Notification Process_

33 Frequently Asked Questions What is a Health Information Organization (HIO)? An HIO is an organization that oversees and governs the exchange of health information. (See Arizona Revised Statutes, Section ) This doesn t include health care providers or an electronic health record maintained by a health care provider or a health plan. It also doesn t include direct provider-to-provider exchanges. The Network, operated by the Arizona Health-e Connection is an example of an HIO. Is The Network a part of The State of Arizona government or funded by the State of Arizona? No. The Network is a program of Arizona Health-e Connection, a private, non-profit organization. Providers participating in The Network are required to notify their patients of their participation in The Network and give patients the right to opt-out. When is this patient notification and opt-out required? Network participants should have a process in place to provide their patients with The Network Notice of Health Information Practices (HIO Notice) before the participants begin to access health information in The Network or share health information with other providers through The Network. What does the Patient Notification and Opt-Opt process require? Providers participating in The Network must have key documents, staff assignments, and workflow in place to support the three-step process described below: 1. Providing the Notice of Health Information Practices (HIO Notice) to each patient at a patient s first encounter after the health care provider begins participating in the HIO. 2. Obtaining the patient s (or the patient s health care decision maker s) signature acknowledging that the patient or health care decision maker has received, read, and understands the HIO Notice. 3. If the patient does not want to participate in The Network, give the patient the Opt-Out Change Form. A provider participating in The Network must get approval of its notice and opt-out process from The Network. What patient health information are Network participants allowed to send to The Network? Can patient health information be sent to the Network before a patient has been given the opportunity to Opt-Out? Health care providers are permitted by federal and state health information privacy laws to disclose health information to a business associate operating under a business associate agreement, including The Network. If a patient has opted-out, The Network may not allow anyone to see that patient s information in The Network. After a patient has opted-out, a provider may share that patient s information with The Network, but The Network cannot further share that information with anyone else. Patient Notification Process_

34 Is a provider required to provide the Notice of Health Information Practices (HIO Notice) and Opt-Out Form at every visit? No. A provider is required to provide The HIO Notice at the first encounter after the provider begins participating in The Network. If a patient opts-out for a particular health care provider, how is that managed? If a patient opts-out only for a particular health care provider, The Network will screen that information from viewing. If a patient opts-out, a participating provider may still provide information to The Network, and The Network will screen it on behalf of the provider. How is the opt-out for a single provider implemented when the provider works for a hospital or a physician group? If a particular health care provider is employed by a hospital or physician group, The Network may have to screen all of the employing organization s health information from viewing through The Network. (It may not be possible to segregate a particular provider s information in The Network.) This is permitted by Arizona law. Can a patient change his or her mind about participating in The Network? Yes. A patient that initially opts-out of The Network can opt back in. During the time in which a patient has opted-out of the Network, a patient s information can continue to flow to The Network, but The Network screens it from view. If a patient opts back in, all of that information would be made available for viewing through The Network. When patients Opts-Out or when they opt back in, their decision applies to all of the individual s information in the Network, regardless of when the individual opted out or opted back in. What information are health plans able to view in The Network? Health plans are able to view information about their current members that is relevant to the health plan s care coordination and case management activities for its members. Of course, if a person has opted-out of The Network, that person s information is not available for viewing by anyone, including health plans. Can a patient restrict access to health information by his or her health plan? Yes, if a patient pays in full out-of-pocket for a service, a patient can request a health care provider to withhold information solely related to that service, from the individual s health plan. If a patient makes that request, a health care provider should withhold that information from The Network. If that is not possible, the provider should contact The Network about how to implement the patient s request. What are the rights of state, county or city detainees or incarcerated individuals different regarding the sharing of their health information through The Network? People who are inmates do not have the individual rights provided by the Arizona HIO statute. That means they do not have the right to Opt-Out of having their information available for sharing among authorized providers. Are minors (individuals under the age of 18) allowed to make their own decision to optout? Are emancipated minor afforded different rights? The Arizona HIO statutes do not change existing Arizona law with respect to health care decision makers. The Network participants must default to the Arizona laws already in place that govern when and in what circumstances minors may make decisions about their own health care, including their participation in an HIO. Patient Notification Process_

35 Sample Script for Patient Notification You may have noticed that health care providers no longer keep paper records. Just like in banking and shopping, your medical records are routinely kept securely in computers. Electronic medical records allow your doctors and nurses to better coordinate your care by securely sharing those electronic medical records with your other health care professionals at different locations. If your doctors and nurse have better information, you and your family can get better care, especially in emergencies. [HAND THE NOTICE OF HEALTH INFORMATION PRACTICES (HIO NOTICE) TO THE PATIENT/GUARDIAN] This HIO Notice explains how The Network works. If you like this idea, you simply sign to indicate that you have received, read, and understand the HIO Notice. If you do not want your health care professionals to securely share information through the Network, just sign what s called an Opt-Out Change Form. You can later change your mind. A few more things to consider: 1. You can prevent a particular doctor from sharing your information through The Network. But if that doctor is an employee of a physician group or a hospital that might mean none of the doctors and nurses employed by that physician group or hospital will be able to share your information through The Network. 2. You can ask to see which doctors and nurses looked at your information, and you can ask to have any incorrect health information in the Network corrected. Your health care professionals want the best and most complete information when caring for you. The choice is up to you and will not affect your ability to seek medical care here. [OBTAIN PATIENT SIGNATURE ON YOUR HIPAA NOTICE OF PRIVACY PRACTICES FORM OR YOUR CONDITIONS OF ADMISSIONS FORM THAT REFERENCES PARTICIPATION IN THE NETWORK. IF PATIENT SAYS NO, OBTAIN SIGNATURE ON THE OPT-OUT CHANGE FORM] Patient Notification Process_

36 Nurse Video Link English Patient Notification Process_

37 Nurse Video Link Spanish Patient Notification Process_