1. (a) Scope and applicability. This policy applies to all participating entities.
2. (b) Recipient responsibility. A participating entity, when accessing the State Health Alliance for Records Exchange shall not be expected to know of or comply with a restriction on use or disclosure agreed to by a participating entity that provides data.

3. (c) Data provider responsibility.

   1. (1)

      1. (A) If a participating entity agrees to an individual's request for restrictions, as permitted under the HIPAA privacy rule, such participating entity shall ensure that it complies with the restrictions when releasing information through the State Health Alliance for Records Exchange.
      2. (B) This shall include not exchanging the individual's protected health information through the State Health Alliance for Records Exchange and opting the individual out of the State Health Alliance for Records Exchange, if required by the restriction.
      3. (C) Participating entities should advise individuals that opting out only affects access, use, and disclosure of their protected health information through the State Health Alliance for Records Exchange.
   2. (2) If an agreed-upon restriction will or could affect the requesting institution's uses and/or disclosures of health information, at the time of disclosure, the participant disclosing such health information shall notify the requesting institution of the fact that certain information has been restricted, without disclosing the content of any such restriction.
   3. (3) When evaluating a request for a restriction, the participating entity shall consider the implications that agreeing to the restriction would have on the accuracy, integrity, and availability of information through the State Health Alliance for Records Exchange.

Codification Notes: This section, as promulgated prior to codification in the Code of Arkansas Rules contained a footnote to 25 CAR §§ 20-112(c)(1)(A) and (c)(3) as follows: “45 C.F.R.§164.522”. This section, as promulgated prior to codification in the Code of Arkansas Rules contained a footnote to 25 CAR § 20-112(c)(3) as follows: "Under the HIPAA privacy rule, individuals have the right to request restrictions on the use and/or disclosure of health information about them. For example, an individual could request that information not be used or disclosed for a particular purpose or that certain information not be disclosed to a particular individual." "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191.