State HIE Consent Policies: Opt-In Or Opt-Out

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyConnecticut(CT)Opt-out forregular PHI;Opt-in forsensitive PHIState PolicyDelaware(DE)Opt-outRegulationState involvement increating consent policy ifsource is not astatute/regulationHealth InformationTechnology Exchange ofConnecticut (HITE-CT) is anonprofit quasi-state agency.--StatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicyNApplies to HITE-CT and to allpersons and organizations whohave access to HITE-CTmanaged health records.NApplies to all individuals withhealth information in DHIN.Health Information TechnologyExchange of Connecticut, ConsumerAuthorization and Consent Policy 3(2011) - HITE-CT's consumerauthorization and consent policy givespatients the option to opt out of havingtheir PHI disclosed through HITE-CT. If apatient has not opted out, HITE-CT willdisclose all non-sensitive PHI for thepurposes of treatment, payment and healthcare operations as permitted by HIPAA,unless the patient and provider haveagreed upon a specific restriction ondisclosure. Sensitive PHI is PHI that is"subject to heightened confidentialityrequirements in compliance with allfederal and state laws as amended fromtime-to-time (HIV, substance abuse andmental health records)." Patients mustspecifically authorize disclosures ofsensitive PHI. A patient’s opt-out ofHITE-CT is global, which means that noPHI will be disclosed to any party byHITE-CT, except as required by law (suchas public health reporting requirements,etc.). However, even if a patient has optedout, HITE-CT may allow for disclosuresof PHI in emergency treatment situations,but such disclosures will be audited strictlyto make sure that there was a legitimateemergency requiring disclosure.1-100-102 Del. Code Regs. § 7.2 (2009) DHIN regulations on participation givespatients the right to be informed of and theoption of choosing to prohibit a search fortheir PHI in the DHIN Interchange uponconsultation with their health n in DHINby healthcare entities isvoluntary.5Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyDistrict ofColumbia(DC)Opt-outState PolicyFlorida(FL)Opt-in foreach time anew providerwants toaccess PHIState PolicyGeorgia(GA)No policy--Hawaii(HI)No policyIdaho(ID)No policyState involvement increating consent policy ifsource is not astatute/regulationThe District of ColumbiaDepartment of Health CareFinance (DHCF) wasawarded a grant from theOffice of the NationalCoordinator for HealthInformation Technology(ONC) to create DC HIE.DC HIE is staffed andmanaged by DHCF.Florida HIE is run by theAgency of Health CareAdministration, whichprovides guidance throughthe Florida HealthInformation Network.StatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicySupplementalInformationNApplies to all patients andparticipants enrolled in DCHIE.District of Columbia HealthInformation Exchange Policy Board,Monthly Meeting Minutes 3 (2013) - TheDC HIE Policy board adopted a motion toimplement an opt out consent model forthe DC HIE. Further details about thepolicy can be found here.--YApplies to all providersparticipating in Florida HIE.Additional details onhow patientauthorization works inFlorida HIE areavailable here.------Florida Health Information Network,Patient Authorization - FHIN’sdocuments discussing patient authorizationof exchange of health information in FLstates that patients have to authorize boththe search for and access to medicalrecords. However, Florida allowsexceptions to the rule requiring patientauthorization in cases of medicalemergency and when disclosure is requiredfor public health reporting purposes.----------------------------6Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateIllinois(IL)Type ofConsentPolicy(1) Opt-outfor mentalhealthinformationSource ofConsentPolicyStatuteState involvement increating consent policy ifsource is not cope of Consent PolicyThis rule is binding upon allHIEs as defined in the statute.Details about Consent PolicySupplementalInformation740 Ill. Comp. Stat. 110/9.6 - Illinois lawrequires that all HIEs require thatparticipating healthcare providers givepatients whose mental health informationis on the HIE the opportunity to prohibitfurther disclosure of the record by the HIEto third parties, except in cases where suchdisclosure is permitted by law such as forpurposes of public health reporting.The statute defines HIEas a "health informationexchange or healthinformationorganization thatoversees and governsthe electronic exchangeof health informationthat (i) is establishedpursuant to the IllinoisHealth InformationExchange andTechnology Act ; or(ii) has established adata sharingarrangement with theIllinois HealthInformation Exchange;or (iii) wasdesignated by theIllinois HealthInformation ExchangeAuthority Board as amember of, or wasrepresented on, theAuthority Board'sRegional HealthInformation ExchangeWorkgroup; providedthat such designationshall not require theestablishment of a datasharing arrangement orother participation withthe Illinois HealthInformation Exchangeor the payment of anyfee."7Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicy(2) Opt-outfor all PHI;Opt-in forspecial PHIState PolicyIndiana(IN)No policy--Iowa(IA)Opt-outStatuteState involvement increating consent policy ifsource is not astatute/regulationPolicy adopted by the ILHIEAuthority - Instrumentalityand an administrative agencyof the State of Illinois.StatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicySupplementalInformationNApplies to all patients whoseproviders participate in ILHIE.ILHIE's opt-in policyfor specially protectedhealth information canbe found here. Thedefinition of speciallyprotected healthinformation can befound here.------Illinois Health Information ExchangeAuthority, Patient Choice andMeaningful Disclosure 1 (2015). ILHIE'spatient choice policy allows automaticaccess to PHI maintained by participatinghealthcare providers unless a patient optsout and prohibits access to his/her PHIthrough the exchange. Patients have theoption of revoking their decision to optout. However, access to "speciallyprotected health information" is notautomatic and disclosure of such PHIrequires specific consent from theindividual. Specially protected healthinformation is defined as: "certain alcoholand substance abuse treatmentinformation; child abuse and neglectreports and records; sexual assaultevidence and information; veteran’s homesresident records; and any other healthinformation that requires [individual]consent in order to be disclosed underFederal or State law."----NThe Iowa Department of Healthis responsible for making surethat all patients participating inIHIN have the opportunity toopt out, and these requirementsare not intended for otherregional, population-specific orlocal health informationnetworks.Iowa Code § 135.156E (2016) - Iowa lawgives patients the ability to opt out of theexchange of PHI through IHIN's recordlocator service. This opt-out decision isglobal and none of the patient's PHI willbe accessible through the record locatorservice unless otherwise authorized by thelaw. A patient who has opted out has theability to opt back into IHIN.----8Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyState involvement increating consent policy ifsource is not ope of Consent PolicyDetails about Consent PolicyYThe Department of Healthestablishes opt-outrequirements that all approvedHIOs in participationagreements with coveredentities have to follow. HIOsmust approved to operate in thestate of Kansas.Kan. Stat. Ann. § 65-6832 - Kansas lawrequires the Kansas Department of Healthto establish certain requirements forapproved HIOs to use in their participationagreements with health care providers.These requirements include details aboutthe written notice that a health careprovider has to give to a patient explaininghow and what PHI will be shared with theapproved HIO. The law requires that thewritten notice specifically state that thepatient has the right to request in writingthat his/her PHI not be disclosed by theHIO and the HIO must comply with therequest in all cases except in cases whendisclosure is permitted for emergencies oras required by law.Governor's Office of Electronic HealthInformation, First Update: KentuckyStrategic and Operational Plan forHealth Information Exchange 24 (2014)- GOEHI states that because health careproviders are allowed to share PHI withoutpatient consent for the purpose oftreatment under HIPAA, no furtherconsent is required for exchange of PHIthrough KHIE. GOEHI further states thatit requires no prior consent is required fordisclosures for the purposes of paymentand health care operations.--Kansas(KS)Opt outStatuteKentucky(KY)No furtherconsentState HIEPlanKY Strategic andOperational Plan for KHIEby the Governor's Office ofElectronic HealthInformation (GOEHI). KHIEis administered by theDivision of KentuckyElectronic HealthInformation in the Cabinetfor Health and FamilyServices.NApplies to all participants inKHIE.Louisiana(LA)No ly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyMaine(ME)Opt-outStatuteState involvement increating consent policy ifsource is not ope of Consent PolicyDetails about Consent s(MA)Opt-inStatute--NMichigan(MI)No policy------NApplies to the state-designatedstatewide HIE.--Applies to all HIEs, not just thestate designated exchange. MDstatute defines HIE as "aninfrastructure that providesorganizational and technicalcapabilities for the exchange ofprotected health informationelectronically among entitiesnot under common ownership."Applies to any plan thatreceives funding from theMassachusetts eHealth Instituteor the MA HIE Fund.Me. Rev. Stat. Ann. tit. 22, § 1711C(18)(C) - Maine law requires that thestate-designated statewide HIE providepatients the ability to opt out fromparticipation in the HIE and to prohibit thestate-designated statewide HIE fromdisclosing the patient's PHI to a health careprovider.Md. Code Regs. 10.25.18.03 - Marylandregulations give patients participating inan HIE a number of rights including theright to opt out of the HIE at any time andto refuse access to the patient’s PHIthrough an HIE, except in certain specificcircumstances.Mass. Gen. Laws ch. 118I §§ 11, 13 Massachusetts law requires that any planthat has received funds from the eHealthInstitute Fund or the Massachusetts HealthInformation Exchange Fund is required toestablish a mechanism allowing patients toopt-in to the HIE and to subsequently optout at any time.------SupplementalInformation----10Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyMinnesota(MN)Opt-outStatuteState involvement increating consent policy ifsource is not ope of Consent PolicyDetails about Consent PolicySupplementalInformationYAll providers and entities inMN operating a record locatorof patient information servicehave to give patients the abilityto opt out. Burden is onproviders to get patients' inforemoved from HIE service.Mississippi(MS)No policy--------Minn. Stat. § 144.293(8)(d) (2015) Minnesota law requires that health careproviders or entities operating a recordlocator service or a patient informationservice must give patients the opportunityto exclude their identifying informationand information about the location of theirrecords from such a record locator orpatient information service. Providersparticipating in a HIE with a record locatoror patient information service who receivea patient's opt-out request to exclude all ofhis/her information from the service or tohave a specific provider excluded from theservice are responsible for removing thatinformation from the service.----Missouri(MO)No policy------------Montana(MT)No policy------------Nebraska(NE)No policy--------------11Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyNevada(NV)Opt-inStatuteState involvement increating consent policy ifsource is not e--StatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicyYIn Nevada, HIEs can't operatewithout state certification. Toreceive certification, HIEs haveto demonstrate their adherenceto patient consent standardsdescribed in the language ofconsent policy. Therefore, thisstatute requiring consentapplies to all HIEs operating inNevada.NApplies to state-created NHHIO only.Nev. Rev. Stat. § 439.589 - Nevada lawrequires that the director of theDepartment of Health and Human Servicesput forward regulations establishingstandards for obtaining consent from apatient before retrieving the patient’shealth records from an HIE. The lawfurther requires that these standardsinclude requirements for how a patientmay revoke his/her consent for a healthcare provider to retrieve his/her healthrecords from the HIE.N.H. Rev. Stat. Ann. § 332-I:3 - NewHampshire law gives patients the right toopt out of sharing his/her name andaddress and his/her PHI through NH-HIO.The law requires that the patient be giventhis opportunity to opt out in a clear andconspicuous manner.SupplementalInformation----12Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateNew Jersey(NJ)No policy--State involvement increating consent policy ifsource is not astatute/regulation--New Mexico(NM)Opt out fordemographicinformationandinformationabout locationof EHR, butconsent isrequired toaccess theEHRsthemselvesStatute1--1Type ofConsentPolicySource ofConsentPolicyStatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicySupplementalInformation--------YApplies to all record locatorservices or HIEs.N.M. Stat. § 24-14B-6 (2009) - NewMexico law requires that record locatorservices provide patients the option ofexcluding their demographic informationand information about the location of theirelectronic medical records from the recordlocator service. The person at a recordlocator service or HIE who receives apatient's request to exclude all of his/herinformation from the record locator serviceis responsible for removing thatinformation from the service. The lawallows for access to a patient's medicalrecord in case of a medical emergencyeven if the patient has opted out.--The link provided will direct user to a general state landing page from which user may search for the statute/regulation using identified citation.13Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyNew York(NY)Opt-inRegulationState involvement increating consent policy ifsource is not te--StatewideApplicability(Y/N)Scope of Consent PolicyDetails about Consent PolicyNApplies only to qualifiedentities certified by the state ofNew York to participate in theStatewide Health InformationNetwork for New York (SHINNY).NGives all individuals with PHIin the NC HIE the right to optout.N.Y. Comp. Codes R. & Regs. tit.10, §300.5(a) (2016) - New York requires thatqualified entities only allow access topatient information by participatinghealthcare providers with a writtenauthorization from the patient or someonequalified to consent on behalf of thepatient if the patient lacks capacity. Thewritten authorization must specify who isauthorized to access the information. Theregulation states that qualified entities mayallow access to patient informationwithout written authorization when:(1)Prior consent has already been obtainedfor the disclosure and no provision of lawrequires any additional writtenauthorization; (2)Disclosure is required orauthorized by law; or (3) The patient is inneed of emergency medical care as long asthe health care provider documents thesituation and states that attempting tosecure consent would result in delay oftreatment resulting in increased medicalrisk to the patient.N.C. Gen. Stat. § 90-414.10 - NorthCarolina law gives each patient the right toopt out of having their PHI shared throughthe NC HIE and to revoke his/her decisionto opt out. However, PHI must bedisclosed in order to provide emergencymedical services even when a patient hasopted out , as long as certain criteria aremet.SupplementalInformation----14Commonly Used Acronyms:HIE – Heath Information Exchange; HIN – Health Information Network; HIO – Heath Information Organization; PHI – Protected Health Information(Note: State initial appearing before one of the above acronyms indicates the state name. For example: DHIN - Delaware Health Information Network.)

HealthInfoLaw.orgStateType ofConsentPolicySource ofConsentPolicyNorth Dakota(ND)Opt-outStatuteState involvement increating consent policy ifsource is not ope of Consent PolicyDetails about Consent PolicyNGives all individuals the rightto opt out of participating in thestate HIO.N.D. Cent. Code § 23-12-19 - NorthDakota law gives patients the right to optout of participating in the state-run HIO byproviding notice to the HIO. Further, thelaw gives patients the option of either fullyopting out or conditionally opting out(which means that the patient's PHI willonly be accessible to a health care providerin cases of medical emerg

HealthInfoLaw.org State HIE Consent Policies: Opt-In or Opt-Out Last Updated September 2016 The State HIE Consent Policies: Opt-In or Opt-Out table provides a 50 state plus the District of Columbia comparative overview of patient consent policies, enacted either through legislation or agency guidance, that may govern health information exchanges (HIE) operating in each state.