5 CCR 1006-3
DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT ADVANCED DIRECTIVES REGISTRY 5 CCR 1006-3 [Editor’s Notes follow the text of the rules at the end of this CCR Document] _________________________________________________________________________ Adopted by the Board of Health on May 19, 2021, effective July 15, 2021.
I. General Purpose for Establishing Rules and Regulations The general purpose of this regulation is for the Colorado Department of Public Health and Environment (herein referred to as CDPHE) to facilitate the creation of a statewide electronic registry of Advance Directives, pursuant to Section, 25-54-101 of the Colorado Revised Statutes.
II. Definitions The following terms, whenever used in or referred to in these regulations, shall have the following respective meanings, unless a different meaning clearly appears from the context:
1. “Advance Care Planning (ACP)” means the process of an individual learning about, making, and documenting decisions to be implemented in the event of a medical crisis or a need for end-of-life care.
2. “Advance Health Care Directive” or “Advance Directive” means a legal document in which an individual specifies their wishes relating to medical treatment, cardiopulmonary resuscitation, or medical durable power of attorney, per the requirements established in § 25-54-101.1(a), CRS. These documents include, but are not necessarily limited to:
3. “Advance Directive Registry” (ADR or “Registry”) means the system of Advance Directive documents being established in § 25-54-101.1(a), CRS. This system specifically references the statewide registry being established through the relevant legislation, and does not reference other organizational or regional registries that may include health directives.
4. An “Authorized Surrogate Decision Maker” (or “authorized surrogate”) means a person appointed pursuant to the means stated in § 25-54-101.2, CRS.
5. A “Qualified Provider” (or “Provider”) is a person or entity that may use or disclose protected health information in accordance with guidelines under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, including all accompanying regulations. For the purposes of these rules, a Qualified Provider includes any staff member at a HIPAA-covered entity who has approval from their HIPAA-covered employer to access patient Protected Health Information (PHI), where the covered entity has a treatment relationship with the patient whose Advance Directives are being uploaded or accessed in the Registry.
6. A “Qualified Individual” is a person or entity authorized to access the Registry. Qualified Individuals include both Qualified Providers (as defined above) and individual patients and their authorized surrogate decision maker who have Advance Directive documents existing in the Registry.
7. A “Health Information Organization Network” means a Colorado organization that has experience overseeing and governing Health Information Exchange among organizations according to state and federal law.
III. Criteria for Qualified Individuals to Have Access to the System and Advance Medical Directives 1. HIPAA-covered entities (i.e., hospitals, health systems, clinics, etc.) may designate criteria for qualified individuals to access the Registry following the organizational policies for staff accessing patients’ medical records and Protected Health Information (PHI). Entities must ensure that only appropriate staff members access the system. These staff members are considered Qualified Providers in the context of these rules, as defined above.
2. A Qualified Provider is not required to enter into an HIE Services Agreement with a state- recognized HIE in order to access the Registry. Instead, a Qualified Provider need only comply with the access requirements outlined in this rule and the associated statute, and any contractual obligations required to facilitate access to the Registry.
3. Individuals (i.e., patients or their authorized surrogate decision makers) may access the Registry to view and verify their Advance Directive documents. Only a Qualified Provider may upload or remove documents from the Registry.
IV. Criteria in Which an Electronic Affidavit is Required 1. An Electronic Affidavit, signed by the individual or their authorized surrogate, is required for newly executed documents that require both individual and authorized provider signature. These documents include a Colorado Medical Order for Scope of Treatment (MOST) form/Physician Orders for Life-Sustaining Treatment (POLST) form, and a Colorado CPR Directive.
i. Existing, executed documents do not require a new Electronic Affidavit. These documents may be uploaded to the Registry following the procedures outlined below.
ii. It is not required for signatures from the individual and the authorized provider be collected simultaneously.
iii. In situations in which an Electronic Affidavit is required, individuals may submit the affidavit either through the Registry or by electronic or physical signature. If an affidavit is signed outside of the Registry, it must be submitted to the Qualified Provider via physical mail, email, or fax. It is the responsibility of the individual to ensure that their affidavit has been received by the Qualified Provider and appropriately uploaded to the Registry.
2. Other documents that pertain to advance care planning, but do not require physician signature, require only a patient signature (electronic or written) and do not require an Electronic Affidavit for upload. These documents include, but are not limited to, a Medical Durable Power of Attorney or a Living Will.
V. Procedures by Which a Qualified Individual May Add or Remove an Advance Medical Directive To or From the System 1. The Registry shall provide a free flow of information between patients, health care providers, and their associated HIPAA-covered entities.
2. The Registry shall collect individuals’ name and email address, where available. It is the responsibility of the individual to ensure their contact information is up-to-date.
3. Existing Advance Directive documents electronically hosted in Health Information Exchange or Electronic Health Record systems remain binding and in effect. It is not a requirement for an Advance Directive document to be uploaded to the Registry in order to be considered binding.
i. Other sources of Advance Directives documents should be considered in addition to the Registry. The Registry is not comprehensive and valid documents may exist elsewhere.
ii. Existing documents may be uploaded to the Registry from the Health Information Exchange, Electronic Health Records systems, or paper documents on file with a HIPAA- covered entity may be scanned and uploaded into the Registry following its launch.
iii. Valid, properly executed, self-uploaded documents, such as those uploaded to Electronic Health Records systems, may be uploaded to the Registry by a Qualified Provider.
4. Qualified Providers must collect a signed affidavit in some cases. Please see Section IV, Criteria in Which an Electronic Affidavit is Required, above.
5. A Qualified Provider may remove documents from the Registry upon request from the individual or their authorized surrogate. If an individual requests document removal, the Qualified Provider must act to remove the document in a timely manner. However, it is the responsibility of the individual or their authorized surrogate to confirm removal.
6. The Registry shall provide an annual reminder to individuals with documents in the Registry via email, where available, to verify their documents. It is the responsibility of the individual to ensure their contact information in the Registry is up-to-date.
7. It is the responsibility of the individual or their authorized surrogate to ensure the documents included in the Registry are appropriately executed, accurate, and current.
i. If an Advance Directive document is executed in another state, it is the responsibility of the individual to ensure their document is properly executed according to that state’s laws.
8. A Qualified Provider and their associated HIPAA-covered entity may not bill individuals an additional fee to upload documents to the Registry in excess of allowable Advance Care Planning services.
VI. Procedures by Which a Qualified Individual May Access and Download an Advance Medical Directive from the System 1. A Qualified Provider may access and download Advance Directives from the Registry at any time, including, but not limited to, the following purposes:
i. During a medical crisis;
ii. In a situation in which decisions about an individual’s end-of-life care are needed;
iii. At request of an individual or their authorized surrogate;
iv. During a medical visit with an individual in which advance care planning is being discussed.
VII. Procedures and Safeguards for Ensuring the Confidentiality and Secure Storage of the Information Contained in an Advance Medical Directive that is Added To and Maintained in the System 1. All documents uploaded to the Registry shall be and remain strictly privileged and confidential as electronic medical records, pursuant both to § 25-1-1203, CRS, Electronic storage of medical records, and federal law, specifically the Health Information Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules.
VIII. Special Considerations for Telehealth 1. For situations in which an Electronic Affidavit is required:
i. An individual or their authorized surrogate may sign the affidavit in the presence of a Qualified Provider either in person or via telehealth (over video or telephone).
ii. In situations in which an individual is not able to access the Electronic Affidavit in the Registry, the individual may either electronically or physically sign the affidavit in the presence of a Qualified Provider either in person or via telehealth (over video or telephone).
iii. A signed affidavit must be submitted to the Qualified Provider by the individual either via mail, email, or fax to the Qualified Provider in a timely manner.
iv. It is the responsibility of the individual to ensure their documents have been received and appropriately uploaded to the Registry.
v. If the visit occurs via telehealth, a Qualified Provider must follow their existing organizational telehealth policies to ensure identity verification and adequate privacy and confidentiality.
2. For situations in which an Electronic Affidavit is not required:
i. An individual or their authorized surrogate may elect to meet with a Qualified Provider to discuss Advance Care Planning in person or via telehealth, but it is not required.
ii. If an individual or their authorized surrogate elects not to discuss their documents at a visit with a Qualified Provider, the Provider is responsible for uploading their documents to the registry in a timely manner. However, the individual or their authorized surrogate are responsible for ensuring that the provider has received their documents (electronically or in hard copy) and that their Provider has uploaded their documents to the Registry.
_________________________________________________________________________ Editor’s Notes History New rule eff. 07/15/2021.