1. (a) Scope and applicability. This policy applies to the Office of Health Information Technology and all participating entities.

2. (b) Special protection.

   1. (1) The operation of the State Health Alliance for Records Exchange and these policies are intended to comply with the HIPAA privacy standards.
   2. (2) Some health information may be subject to special protection under federal, state, and/or local laws and rules.
   3. (3) Each participating entity shall determine and identify what information is subject to special protection under applicable law prior to disclosing any information through the State Health Alliance for Records Exchange.
   4. (4) Each participating entity is responsible for complying with such laws and rules.
   5. (5) Participating entities should not make protected health information requiring special protection available to the State Health Alliance for Records Exchange.

3. (c) Information not furnished.

   1. (1) For the State Health Alliance for Records Exchange to be useful, the participating entities accessing health records must know if a patient's health record is complete or whether certain information has been withheld due to more stringent state and federal laws or participating entity policies.

   2. (2)

      1. (A) Accordingly, participating entities accessing and using another participating entity’s information obtained through the State Health Alliance for Records Exchange should assume that the information made available does not include any of the following:
4. (i)
5. (a) (a) Alcohol and substance abuse treatment program records;

6. (b) (b) See 42 C.F.R. Part 2.

   1. (ii)
7. (a) (a) Records of predictive genetic testing performed for genetic counseling purposes.

8. (b) (b) See The Genetic Information Nondiscrimination Act of 2008 (Pub. L. 110-233, 122 Stat. 881, enacted May 21, 2008); and

   1. (iii) Certain records of minors including the following: diagnosis and treatment of suspected abuse by a parent, guardian, or personal representative;

      1. (B) This list is suggestive only.
      2. (C) Other records may be added to the list.

   2. (5) Participating entities should assume the above listed records are not included in the State Health Alliance for Records Exchange.

      1. (d) Application to BAs and contractors. Participating entities shall make this policy applicable to their BAs and to the contractors and subcontractors of their BAs as they deem appropriate through the terms of their BA agreements.

Codification Notes: "HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. "BA" means business associate.