Current through Register Vol. XLI, No. 21, May 23, 2024
Section 65-28-6 - Patient Rights6.1. The Network shall develop, implement, and operate its health information exchange in a manner that is both transparent and patient-centered; 6.1.a. All of the Network's forms and educational materials shall be written in plain language;6.1.b. All of the Network's forms and educational materials shall be made readily accessible to patients free of charge either electronically, or at the request of the consumer, in paper format; and6.1.c. All meetings of the Network's board of directors shall be conducted in compliance with the West Virginia Open Governmental Proceedings Act in W. Va. Code § 6-9A-1 et seq.6.2. A participating organization shall not deny care to any patient solely because he or she elects to opt-out of the health information exchange.6.3. A patient may register for access to the Network's patient portal with a cooperating participating organization. A patient portal may be used by the patient to directly access the health information exchange and view his or her protected health information from a participating organization or data supplier.6.4. Absent a patient portal, a patient may access his or her protected health information consistent with the requirements of the HIPAA privacy rules, the HITECH Act, and W. Va. Code § 16-29-1et seq. Participating organizations are the originators of the protected health information, and maintain the designated record sets in which the protected health information resides. Accordingly, the participating organization whose designated record set is subject to a request for access by a patient is responsible for evaluating and responding to the request. The Network shall direct the patient to present the request for access to the applicable participating organization for processing. 6.4.a. The participating organization is solely responsible for making all determinations regarding the grant or denial of the patient's request for access.6.4.b. If access is granted, the participating organization is responsible for providing access from its own designated record set.6.5. A patient may amend his or her protected health information consistent with the requirements of the HIPAA privacy rules and the HITECH Act. Participating organizations are the originators of the protected health information, and maintain the designated record sets in which the protected health information resides. Accordingly, the participating organization whose protected health information is subject to a request for amendment by a patient is responsible for evaluating, responding to, approving, or disapproving any request. The Network shall direct the patient to present the request for amendment to the applicable participating organization for processing. An amendment cannot be accomplished via the patient portal. 6.5.a. The participating organization is solely responsible for making all determinations regarding the grant or denial of the patient's requested amendment, and for ultimately providing for the amendment within its own designated record set; and6.5.b. Any participating organization that agrees to an amendment shall make it available to the Network for the purposes of the health information exchange.6.6. A patient has a right to an accounting of disclosures of his or her protected health information consistent with the requirements of the HIPAA privacy rules and the HITECH Act. The Network shall track electronically all disclosures made through its health information exchange.6.6.a. If a request for an accounting of disclosures is received by the Network from a patient or participating organization, the Network shall prepare the accounting from it health information exchange consistent with the requirements of the HIPAA privacy rules and the HITECH Act, and deliver the accounting to the applicable participating organization.6.6.b. The participating organization is responsible for delivering the Network's accounting of disclosures, along with the participating organization's own accounting of disclosures, to the patient. An accounting of disclosures cannot be accomplished via the patient portal.6.7. A patient may request a restriction on the disclosure of any protected health information for the permissible purposes of payment and health care operations relating to goods or services for which a patient has paid a participating organization out-of-pocket, in full, in accordance with the requirements of the HITECH Act. In addition, a patient may request other restrictions upon the use and disclosure of his or her protected health information subject to the agreement of the patient's participating organization in accordance with the HIPAA privacy rules. The Network shall comply with any and all restrictions by accepting a participating organization's classification of the protected health information as sensitive health information pursuant to Section 7 of this rule. 6.7.a. The participating organization is responsible for identifying, classifying, segregating, and blocking any protected health information relating to out-of-pocket goods and services as sensitive health information; and6.7.b. Patient restricted information shall likewise be identified, classified, segregated, and blocked by the participating organization as sensitive health information.6.8. A patient has the right to be notified of a breach of his or her unsecured protected health information consistent with the requirements of the HITECH Act and W. Va. Code § 46A-2A-1et seq. The Network shall comply fully with its notification obligations under these federal and state laws.6.9. The Network shall affiliate with at least one vendor of a personal health record product. If a patient establishes a personal health record, that personal health record may contain protected health information obtained from his or her patient portal. Absent access to a patient portal, a patient may instead seek access to his or her protected health information from each participating organization in accordance with Section 6.4 for inclusion in his or her personal health record.