The Office of the National Coordinator for Health Information Technology (ONC) released a new rural health information exchange (HIE) toolkit last week and included within it were privacy and security requirements for organizations participating in an HIE.
Healthcare organizations should be interested the guidelines that ONC offered related to individual participation and control of information posted to a Record Locater Service (RLS). The purpose of this portion of the toolkit is to improve individual control over the collection and use of health information in rural settings and ensure that patient preferences are considered as well. The guidelines include:
1. Choice Not to Have Information Included in the RLS: All individuals may choose not to have information about them included in or made available through the RLS.
2. Effect of Choice: An individual’s choice not to have information about him or her included in or made available through the RLS shall be exercised through the Participant, as described in the institution’s Notice, after which time the institution shall no longer include the individual in the RLS. Participants shall develop and implement appropriate mechanisms to remove information about an individual from the RLS if the individual chooses to have such information excluded from the RLS.
3. Revocation: An individual who has chosen not to make information concerning him or her available through the RLS subsequently may be included in the RLS only if the individual revokes his or her decision or subsequently chooses to renew participation in the RLS.
4. Documentation: Each Participant shall document and maintain documentation of all patients’ decisions not to have information about them included in the RLS.
5. Participant Choice: Participants will establish reasonable and appropriate processes to enable the exercise of a patient’s choice not to have information about him or her included in the RLS. Each Participant retains the authority to decide whether and when to obtain patient consent prior to making information available through the RLS.
6. Provision of Coverage or Care: A Participant shall not withhold coverage or care from an individual on the basis of that individual’s choice not to have information about him or her included in the RLS.
Rural HIE privacy and security doesn’t seem to get a great deal of press, so having these tips in place helps set standards going forward for rural healthcare organizations that collect and transmit patient data. It will be interesting to see if, beyond RLS regulations, ONC continues to pay more attention to rural HIEs and how organizations secure their data this year.