25 CAR § 20-104 – Notice of privacy practices

(a) Scope and applicability.
1. (1) This policy applies to all participating entities.
2. (2)
  1. (A) Each participating entity that is a covered entity under HIPAA shall develop and maintain a notice of privacy practices, known as “notice”, that complies with applicable law and this policy.
  2. (B) The notice must describe the uses and disclosures of protected health information contemplated through the participating entity’s participation in the State Health Alliance for Records Exchange.
(b) Content.
1. (1) The notice must meet the content requirements set forth under the HIPAA privacy rule and comply with applicable laws and regulations.
2. (2) The notice also shall include a description of the State Health Alliance for Records Exchange and inform individuals regarding:
  1. (A) What information the institution may include in and make available through the State Health Alliance for Records Exchange;
  2. (B) Who is able to access the information available in the State Health Alliance for Records Exchange;
  3. (C) For what purposes such information can be accessed; and
  4. (D) How the individual can have his or her information removed from the State Health Alliance for Records Exchange.
3. (3) The Office of Health Information Technology provides the following sample language for participating entities who elect to amend their notice: “We may make your Protected Health Information available electronically through SHARE, an electronic health information exchange, to other health care providers and health plans that request your information for their treatment, payment, operations and public health reporting purposes. Participation in an electronic health information exchange also lets us see their information about you for our treatment, payment and operations purposes or for public health reporting. As a patient, you must 'opt out', if you choose not to have information about you made available through SHARE."
(c) Provision to individuals.
1. (1) Each participating entity shall have its own policies and procedures governing distribution of the notice to individuals, which policies and procedures shall be consistent with this policy and comply with applicable laws and regulations.
2. (2) For participating entities that are healthcare providers, the notice shall be:
  1. (A) Available to the public upon request;
  2. (B) Posted on all websites of the participating entity and available electronically through such sites;
  3. (C) Provided to a patient at the date of first service delivery;
  4. (D) Available at the institution; and
  5. (E) Posted in a clear and prominent location where it is reasonable to expect individuals seeking service to be able to read the notice.
3. (3) For participating entities that are health plans, the notice shall be:
  1. (A) Available to the public upon request;
  2. (B) Provided to new enrollees at the time of plan enrollment;
  3. (C) Provided to current plan enrollees within sixty (60) days of a material revision; and
  4. (D) Posted on the plan's websites and available electronically through such sites.
4. (4) Participating health plan institutions also shall notify individuals covered by the plan of the availability of the notice and how to obtain a copy at least once every three (3) years.
(d) Individual acknowledgement.
1. (1) Each participating entity that is a healthcare provider shall make a good faith effort to obtain the individual's written acknowledgement of receipt of the notice or to document their efforts and/or failure to do so.
2. (2) The acknowledgement of the notice shall comply with all applicable laws and regulations.
3. (3) Each participating entity shall have its own policies and procedures governing obtaining an acknowledgement, which policies and procedures shall be consistent with this policy and comply with applicable laws and regulations.
(e) Participating entity choice.
1. (1) Participating entities may choose a more proactive notice distribution process than provided herein and may include more detail in their notice of privacy practices.
2. (2) Possible additional protections for individuals whose information may be made available through the State Health Alliance for Records Exchange, not all of which pertain to notice policies alone, could include:
  1. (A) Mailing the revised notice or a notification letter allowing for removal or exclusion of the information about that individual from the State Health Alliance for Records Exchange to every individual prior to loading the information into the State Health Alliance for Records Exchange or shortly thereafter;
  2. (B) Loading individual information into the State Health Alliance for Records Exchange on a going-forward, new individual encounter basis only; or
  3. (C) Developing a method for time-stamping State Health Alliance for Records Exchange records to indicate when the record was loaded into the index.

Codification Notes: This section, as promulgated prior to the codification of the Code of Arkansas Rules, provided a footnote to 25 CAR § 20-105(b)(1) as follows: “45 C.F.R. § 164.520 (b)”. This section, as promulgated prior to the codification of the Code of Arkansas Rules, provided a footnote to 25 CAR § 20-105(c)(1)(E) as follows: "45 C.F.R. § 164.520 (c)(2),(3)". This section, as promulgated prior to the codification of the Code of Arkansas Rules, provided a footnote to 25 CAR § 20-105(c)(4) as follows: "45 C.F.R. § 164.520 (c)(1),(3)". This section, as promulgated prior to the codification of the Code of Arkansas Rules, provided a footnote to 25 CAR § 20-105(d)(2) as follows: "45 C.F.R. § 164.520 (c)(2)(ii)". "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. "SHARE" means the State Health Alliance for Records Exchange.