[{"state":"Alabama","state_abbreviation":"AL","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"One Health Record ® (OHR) Alabama (Alabama Health Information Exchange - AHIE) (2012)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Individuals may choose to not participate in the electronic sharing of his/her protected information. By opting-out, no information regarding the patient/consumer will be exchanged or made available from any Participant, unless required by law. Patient/consumer must provide notice of opt-out to provider in writing or in a manner/form determined by the provider. The provider will, within 2 business days, take the appropriate steps to ensure the individual's information is no longer available through AHIE and notify OHR to an individual's changed status. Each provider/participant must develop and implement the appropriate measures/mechanisms to ensure no information about an individual who has opted-out shall be included in or made available through AHIE. If the patient/consumer wants to opt back into the OHR, they must make a request in writing, or form determined by provider/participant, to make their information available through AHIE. Each provider/participant shall document and maintain documentation of all written Opt-Out requests or revoke Opt- Out decisions from individuals.","patient_notification_methods":"","additional_information":"Alabama's One Health Record® connected with Georgia Health Information Network in October 2015. One Health Record® created the infrastructure for exchanging health information in Alabama through a grant awarded to Medicaid in 2009 by the Office of the National Coordinator (ONC). Under the guidance of the Alabama HIE Commission, Alabama has stood up an interoperable, two-way data exchange system between physicians, hospitals and others. One Health Record®, Alabama's statewide Health Information Exchange, is committed to connecting Alabama medical providers so that they can securely share patient information electronically. One Health Record® is a DirectTrust member and allows for both Direct and bi-directional exchange of information through their HIE that is supported by Truven Health Analytics. The state does not charge any provider to connect using the One Health Record® system.","websites_and_publicly_available_resources":"http://onehealthrecord.alabama.gov/;http://onehealthrecord.alabama.gov/wp-content/uploads/AHIE-Policies-and-Procedures-Revised-3-24-15.pdf;http://www.gahin.org/media/press-release/georgia-completes-connection-alabama-support-state-state-exchange-health","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alaska","state_abbreviation":"AK","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Alaska eHealth Network (AeHN)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients/consumers have the option to completely or partially opt-out. If a patient partially opts-out, their health information can be accessed in an emergency situation. If patient completely opts-out, their information cannot be accessed at any time. At either opt-out level, it is legally required that the HIE contribute to public health reporting. Limited information available for both patients and providers. Consent and disclosure forms are available for patients to access with education on HIE.","patient_notification_methods":"","additional_information":"Selected by the state of Alaska as the state's official HIE management entity.","websites_and_publicly_available_resources":"http://www.ak-ehealth.org;http://www.ak-ehealth.org/wp-content/uploads/2.100-Consumer-Opt-Out-Election-Policy.pdf;http://www.himss.org/news/alaska-selects-alaska-ehealth-network-aehn-its-hie-network;","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arizona","state_abbreviation":"AZ","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Arizona Health e- Connection - The Network (AzHeC) (2007)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients can make the choice to withhold consent and AzHeC will not allow access to that individual's clinical information to anybody other than emergency care providers.","patient_notification_methods":"Arizona law requires that once a provider begins to participate in an HIO, the provider must provide patients a copy of the Notice of Health Information Practices in each patient encounter and provide an Opt-Out Change Form (opt out) or Opt Back in Change Form (opt back in). The Network helps providers comply with Arizona law to have in place a patient notification and opt-out process.","additional_information":"The Network is the only statewide (PUBLIC) HIO in Arizona.","websites_and_publicly_available_resources":"http://azhec.org/the-network/;https://azhec.org/information-center/health-info-exchange/;http://azhec.org/the-network/patient-rights/;http://hie.az.gov/docs/app_plans/AZHIE_082310_StrategyUpdate.pdf;http://hie.az.gov/docs/app_plans/ARIZONA%20Response%20-%20PIN%20003%20-%20Privacy%20Security%20-%202013%20Submission%20-%20Final%20-%2005-29-2013.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arkansas","state_abbreviation":"AR","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Arkansas State Health Alliance for Records Exchange (SHARE) (2011)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients have the opportunity to opt-out, if they wish, at their first appointment after the facility activates SHARE, and periodically thereafter. Patients do not need to do anything, no boxes to check, or papers to sign.","patient_notification_methods":"Participating providers must provide patients with the opportunity to opt-out. A form is to be completed and returned to the healthcare provider. Patients can also opt-out their minor children using the same process.","additional_information":"","websites_and_publicly_available_resources":"http://www.sharearkansas.com/resources/faq;http://www.ohit.arkansas.gov/share","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"California","state_abbreviation":"CA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"California HIE (CAHIE) (2013)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"In California, you must technically give specific permission for your medical information to be exchanged electronically. California's opt-in consent requirement applies only to sharing your medical records electronically. It does not supersede the HIPAA regulations or their presumption of consent for the use of your medical information for purposes of treatment, payment, and routine business operations. For more about consent, see PRC's California Medical Privacy Fact Sheet C2: Uses and Disclosures of Medical Information - With and Without Consent. There are some exceptions to the opt-in consent to HIE, including emergency situations, referred to as 'break the glass' when the patient/representative cannot give consent for electronic access to records. Mandatory public health reporting is also another exception. California regulations also allow you to revoke HIE consent - the revocation becomes effective on the date it is made and does not apply to health information already exchanged prior to the revocation.","patient_notification_methods":"","additional_information":"Founded under the direction of the California Health and Human Services Agency, California Office of Health Information Integrity with seed funding from the federal ARRA grant. California policymakers determined that the statewide health information exchange would be developed through private non-profit initiatives rather than establishing a single state run organization. California includes several enterprise and community based health information organizations.","websites_and_publicly_available_resources":"http://www.ca-hie.org;https://www.privacyrights.org/consumer-guides/health-information-exchange-your-privacy-protected-california-medical-privacy-series#required-consent","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Colorado","state_abbreviation":"CO","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Colorado Regional Health Information Organization (CORHIO) (2007)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients have the opportunity to opt-out and will ensure that their information is not searchable in the HIE. Patient participation is voluntary. When a patient opts out, their information will not be searchable, but their provider can still use the CORHIO network to issue electronic orders for lab tests, prescriptions and other directed healthcare services. They may also receive lab results, x-rays, and other information sent directly to them electronically. The service is no different from provider using mail/fax to receive information. If provider is not participating in HIE, then their patient's information is not available in the HIE.","patient_notification_methods":"If healthcare provider is participating in the HIE, they are required to notify patient of their participation during the patient's visit or at the time of registration. Patients have the right to opt-out at this time or anytime thereafter.","additional_information":"CORHIO has built-in support for HIPAA and other privacy and security laws. Health information including mental health notes, substance abuse and genetic testing information are subject to additional legal protections. Protection includes a requirement that written consent be obtained for each release of protected information. Patients can request revisions and corrections to their health records by talking to the healthcare provider who is the owner/creator of the records.","websites_and_publicly_available_resources":"http://www.corhio.org;http://www.corhio.org/for-patients/faqs-for-patients;https://www.healthit.gov/policy-researchers-implementers/state-health-information-exchange;http://www.hieanswers.net/colorado-state-health-information-exchange/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Connecticut","state_abbreviation":"CT","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Health Information Technology Exchange of Connecticut (HITE-CT) (2010 – 2014)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Participation was voluntary and patients/consumers could choose whether they wanted their health information included. Opting-out restricted access of health information to emergency room doctors or other health care providers.","patient_notification_methods":"Healthcare providers were required to tell consumers/patients if they were participating in the Health Information Technology Exchange of CT (HITE-CT).  Providers needed to provide a notice, which could accompany the provider's HIPAA privacy notification.","additional_information":"HITE was a quasi-governmental agency of the State of Connecticut whose purpose was to create, maintain and make available information exchange technology to enrolled healthcare participants located in the State of Connecticut. HITE-CT HIE closed down effective 7/1/14 - after using $4.3 million in federal grants.","websites_and_publicly_available_resources":"http://www.fiercehealthcare.com/ehr/after-wasting-4-3-million-connecticut-shutters-state-hie;http://www.ct.gov/hitect/cwp/view.asp?a=4277&q=502942&hitectNav=|;http://medcitynews.com/2014/12/Connecticut-health-information-exchange-dissolved-forced-start/?rf=1;http://www.healthcare-informatics.com/article/connecticut-legislature-considers-giving-statewide-hie-another-try;http://www.ctnewsjunkie.com/upload/2014/12/Health_Information_Technology_Exchange_of_Connecticut_20141107_FY2012-2013.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Delaware","state_abbreviation":"DE","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Delaware Health Information Network (DHIN) (2007)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"No Consent: (Delivery Function) Opt-Out: (Patient Query Function) DHIN maintains a hybrid opt-out policy for patient participation. Patients may opt-out of the query functionality, but cannot opt-out of the results delivery functionality. Non-participation will result in personally identifiable health information not being available to users (including emergency personnel).  Their data remains in the system and is continually collected by results delivery function - but providers are blocked from viewing the data. Break the glass provisions are included for DHIN. Patients/consumers may decide to not participate in DHIN at any point and can choose to join again at any point. No requirements for how often consent is to be discussed/revisited. Theoretically, a provider could discuss consent once (if at all) with a patient, then never again. Currently, no granular consent for DHIN - patients are all in or all out. DHIN currently working with the technology vendor MEDICITY on developing more granular opt-out options rather than the current purely binary (in-out) approach. This option will be critical to expanding DHIN services to include more mental/behavioral health organizations, State administrative oversight organizations, and a patient portal which will foster consumer engagement. (Reference: AHRQ report on DHIN)","patient_notification_methods":"At the point-of-care, providers must educate the patient on DHIN and on the opt-out procedure. DHIN offers talking points and forms to help providers educate patients.  Providers and data senders include a disclosure in their HIPAA-required privacy policies that the patient's clinical data is sent to the DHIN - at this time they also offer the patient the choice to opt-out.  Non-Participation Request Cover Letter and Form is available for patients to review and complete (must be notarized by pubic notary or signed by provider to validate the patient's identity).  A Cancellation Request form is available to patients if they wish to participate in the future.","additional_information":"Conduit of Health Information; facilitates movement and delivery of patient health information. First state-wide HIE and enacted by the Delaware General Assembly.","websites_and_publicly_available_resources":"http://dhin.org/resources;http://dhin.org/wp-content/uploads/2015/06/3-DHIN-Access-to-Info-Policy-3.17.11-Final-new-logo-added-4-10-12.pdf;https://healthit.ahrq.gov/sites/default/files/docs/citation/state-regional-demonstration-hit-de-final-report.pdf;http://www.pillsburylaw.com/siteFiles/Events/NewPatientPrivacyandConsentStandardsforaConnectedWorld.pdf;http://www.hieanswers.net/delaware-state-health-information-exchange/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"District of Columbia","state_abbreviation":"DC","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Chesapeake Regional Information System for our Patients (CRISP)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"All patients are notified about the existence of CRISP and will be included in the exchange unless they opt-out of exchange participation. Opt-out option by patient is kept confidential and not shared; all are prevented from accessing patient information. Patients may revoke participation in the exchange at any time and can alter status in either direction. Information can be shared, in accordance with the law, for public health reporting, even if the patient decides to opt-out. Information including name, address and date of birth are kept in the system (separate data repository used for master patient index) to ensure records are blocked. The existing data will remain in the exchange, but sequestered from further circulation unless required by law. No 'break the glass' provisions are available for a non- participant. Limited situations exist where for legal reasons CRISP is required to share limited data about patients who have opted-out - medical information communicated by public health officials by Maryland law. CRISP does not recommend granular control for exclusion by data type/provider organization. But, hospitals/providers may allow patients greater control over what is published to the exchange; Health Record Banks and PHRs will be an exception to the all-in or all-out principal.","patient_notification_methods":"Patients can choose to opt-out via the secure website, phone, fax and mail  Patients are also notified on the web of the consequences of opting-out.","additional_information":"Regional HIE that serves Maryland and DC","websites_and_publicly_available_resources":"https://crisphealth.org;https://crisphealth.org/for-patients/;https://www.healthit.gov/sites/default/files/privacy-security/appendix-a-state-model-table.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Florida","state_abbreviation":"FL","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Florida Health Information Exchange (FHIE)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Florida requires patient authorization for the disclosure of health information. A 'Full Disclosure Authorization Form' allows a patient to choose which providers may access their health information. This form or its equivalent must be used by providers participating in the Florida HIE.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"http://www.fhin.net/privacyRegulations/index.shtml;http://fhin.net/privacyRegulations/docs/ForPatients.pdf;https://www.florida-hie.net/patients/index.html;http://medicaleconomics.modernmedicine.com/medical-economics/content/tags/health-information-exchange/health-information-exchanges-introduce-pa?page=full","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Georgia","state_abbreviation":"GA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Georgia Health Information Network (GaHIN) (2015)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Providers are required to notify patients of their participation at the time of registration or at their appointment. Patients have the right to opt-out at any time and can do so by filling out a form with their provider. If a patient opts-out, no healthcare provider can share their health records with other providers through the GaHIN network. Patients can also opt back in at any time.","patient_notification_methods":"","additional_information":"The Georgia Health Information Network (GaHIN) serves with the Georgia Department of Community Health (DCH) and the Georgia Health Information Technology Regional Extension Center (GA-HITEC) in a public-private collaborative to establish Georgia's statewide health information exchange, to connect Service Area HIEs, large integrated health systems, payers, wellness partners and other health care stakeholders. Approved by CMS in September of 2015 to be the designated entity for the State of Georgia Health Information Exchange.","websites_and_publicly_available_resources":"http://www.gahin.org/patient-participate.html;http://www.gahin.org/patient-privacy-security.html;http://healthitinteroperability.com/news/gahin-named-georgia-entity-for-health-information-exchange","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Hawaii","state_abbreviation":"HI","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Hawaii Health Information Exchange (HHIE) (2006)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Forms for opting-out and opting back in are available on the website for patients/consumers.","patient_notification_methods":"","additional_information":"2009 Designated by HI as the statewide HIE. The Hawaii Health Information Exchange launched its 2015 General Workforce Security Awareness Training available to physicians and their staff members throughout Hawaii.","websites_and_publicly_available_resources":"https://hawaiihie.org;https://hawaiihie.org/sites/default/files/sites/default/files/New%20Opt%20Out%20II.pdf;https://www.hawaiihie.org/sites/default/files/sites/default/files/PDFs/HIE%20FILES/Request%20to%20Resume%20Individual%20Participation%20(Opt-Back%20In)%20Form.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Idaho","state_abbreviation":"ID","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Idaho Health Data Exchange (IHDE) (2008)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients may opt-out or request to restrict disclosure of health information.","patient_notification_methods":"","additional_information":"Patients are encouraged to read the "patient's benefits" page to ensure they understand the benefits of having patient information available through the IHDE. The forms are available to download, print, complete and mail/fax to the IHDE (address/fax is listed on the form). It will take 7-10 business days to process. Patients can use the same process to opt back in or request to rescind. All forms must be notarized to ensure identity.","websites_and_publicly_available_resources":"http://www.idahohde.org;http://www.idahohde.org/opt-out-or-opt-back-in/;http://gov.idaho.gov/pdf/HCC_health_data_exchange.pdf;http://www.healthandwelfare.idaho.gov/Portals/0/Medical/MedicaidCHIP/IHDEAnnualReportHQPC.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Illinois","state_abbreviation":"IL","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Illinois Health Information Exchange (ILHIE) (2014)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients/consumers can choose to opt-out of the ILHIE Connect, including the sharing of mental health information. Health records will not include HIV/AIDS information, genetic testing information, and/or sexual assault information through ILHIE unless consented. To be included in the HIE, patients do not need to do anything, unless the provider removes them from participation.","patient_notification_methods":"An ILHIE Connect Signage must be displayed by the doctor if he/she is an ILHIE Connect User  ILHIE Connect website contains a Patient Participation Video/PowerPoint","additional_information":"Resources including the Data Sharing Agreement; ILHIE Connect Flyer; ILHIE Connect Demonstration are all included on the website.","websites_and_publicly_available_resources":"http://www.illinois.gov/sites/ilhie/Pages/default.aspx;http://www.illinois.gov/sites/ilhie/Pages/patientconsumer.aspx;https://www.illinois.gov/sites/ilhie/archive/Pages/ILHIEPatientParticipation.aspx","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Indiana","state_abbreviation":"IN","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Indiana Health Information Exchange (IHIE) (2004)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Information on Consent Model is limited One site lists Indiana as an opt-out state as of 2014. http://medicaleconomics.modernmedicine.com/medical- economics/content/tags/health-information-exchange/health- information-exchanges-introduce-pa?page=full Another resource states that in Indiana health care providers manage the consent (opt-out) processes. Indiana follows HIPAA regarding consent. (Information from the State Consent Policy listing document). The HIMSS11 presentation lists IHIE as a No Consent State (Consent from patients is not required for participation in the HIE). No Consent - also federally funded substance abuse treatment programs do not provide data to HIO. Data is only used for purposes allowed under HIPAA. Patient's data is maintained in separate 'vaults' or clinical data repositories by the institution until one of the allowed uses is triggered. Then patient's data are merged virtually. Triggers are highly specific and tightly controlled.","patient_notification_methods":"","additional_information":"Non-profit organization that was designated by the state to receive the State HIE Cooperative Agreement to support and oversee implementation of the State Plan. Grantee pursuing market-based or capacity-building approach (NORC report). Based on the HIE Strategic and Operational Plan Profile - Indiana has five (5) major health information organizations (HIOs) that operate in the state including (Healthbridge, HealthLINC, Indiana HIE, Med-web, and Michiana Health Info Network) Website is limited with information for patients/consumers. Directed to providers primarily.","websites_and_publicly_available_resources":"http://www.pillsburylaw.com/siteFiles/Events/NewPatientPrivacyandConsentStandardsforaConnectedWorld.pdf;http://www.ihie.org;http://medicaleconomics.modernmedicine.com/medical-economics/content/tags/health-information-exchange/health-information-exchanges-introduce-pa?page=full;https://www.healthit.gov/sites/default/files/in_state_hie_profile.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Iowa","state_abbreviation":"IA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Iowa Health Information Network (IHIN)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Health information will be available to providers without having to take action. Patients can opt-out of having their information available and if this option is elected, providers will not be able to search the IHIN for health records - even in the case of an emergency. Patients can opt back-in with an opt-in form.","patient_notification_methods":"","additional_information":"Iowa e-Health will first connect Iowa providers and then will continue to be made to other states and Regional Health Information Networks (RHINs). Connected to networks in Missouri, Illinois and Kansas. Connections are being developed for Minnesota, South Dakota, and Wisconsin. Will eventually interconnect into the Nationwide Health Information Network (NHIN).","websites_and_publicly_available_resources":"http://www.iowaehealth.org/provider/;http://www.iowaehealth.org/provider/privacy-security/opt-out/;http://www.iowaehealth.org/provider/what-is-ihin/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Kansas","state_abbreviation":"KS","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Kansas Health Information Network (KHIN) (2011)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"The KHIN website provides a form for 'Patient Consent and Authorization Form for Point-of-Care Disclosures'.  This form states that by signing, patients authorize KHIN to disclose health information to a particular provider through KHIN. An Opt-Out form is available for sharing information on Substance Abuse. Opt-out forms are available for patients to submit electronically and via a paper form through the mail.","patient_notification_methods":"","additional_information":"Website does not offer much information for consent policy.","websites_and_publicly_available_resources":"http://khinonline.org;http://khinonline.org/for-patients2/patients;http://khinonline.org/for-providers/document-downloads;http://www.kanhit.org/participate.htm;http://www.kdheks.gov/news/web_archives/2012/05232012.htm;https://khap.kdhe.state.ks.us/public/hie/;https://ehrintelligence.com/news/muddled-kansas-hie-situation-serves-as-warning/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Kentucky","state_abbreviation":"KY","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Kentucky Health Information Exchange (KHIE)","type_of_consent_policy":"No Information Available","details_of_consent_policy":"No information could be found on the KHIE website regarding the consent model in place for patients/consumers.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"http://khie.ky.gov/Pages/index.aspx","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Louisiana","state_abbreviation":"LA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Louisiana Health Information Exchange (LaHIE) (2011)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Louisiana is considered an "opt-in" state. A patient's consent is required for his/her information to be accessed via LaHIE. If the consent has not been obtained and the patient presents in an emergency situation, his/her information may be accessed in LaHIE for emergency treatment purposes. If a patient explicitly opts out of LaHIE, his/her information cannot be accessed for any reason.","patient_notification_methods":"LaHIE providers/hospitals should include language in their privacy policies that references the exchange of health information through LaHIE","additional_information":"","websites_and_publicly_available_resources":"https://www.lhcqf.org/for-providers/lahie;http://lhcqf.org/lapost-old/faq","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Maine","state_abbreviation":"ME","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"HealthInfoNet (HIN)/Maine' s Regional Extension Center (MEREC) (2009)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Each time a patient visits a new participating medical provider, they are required to let the patient know they are participating in the HIE and to provide information on HealthInfoNet. Opt-in for mental health/HIV - If patient chooses to also share information related to HIV/mental health care, they will need to fill out a consent form. Patients can also opt back in at their choosing by filling out a form available online on their website.","patient_notification_methods":"Information on HealthInfoNet is also included in the provider's HIPAA privacy notice.","additional_information":"Maine-based independent nonprofit designated by the State of Maine to operate Maine's statewide eHealth information network.","websites_and_publicly_available_resources":"http://hinfonet.org;https://secure.hinfonet.org/PatientOptions/optin;https://secure.hinfonet.org/PatientOptions/optout;http://hinfonet.org/patients/your-choices/;http://www.maine.gov/dhhs/oms/HIT/hie.htm","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Maryland","state_abbreviation":"MD","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Chesapeake Regional Information System for our Patients (CRISP) (2010)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"See DC for CRISP Consent Policy details.","patient_notification_methods":"Patients can choose to opt-out via the secure website, phone, fax and mail.  Patients are also notified on the web of the consequences of opting-out.","additional_information":"CRISP is a Regional HIE that serves Maryland and DC. Formally designated by the Maryland Health Care Commission as Maryland's statewide health information exchange.","websites_and_publicly_available_resources":"https://crisphealth.org;https://crisphealth.org/for-patients/;https://www.healthit.gov/sites/default/files/privacy-security/appendix-a-state-model-table.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Massachusetts","state_abbreviation":"MA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Massachusetts Health Information HIway (Mass HIway) (2012)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Patient must opt-in before HIE participant can use the Mass HIway. Consent requirements apply only to Mass HIway and do not apply for mandatory reporting, including public health. Consent forms and language can be determined by participants of the HIE (providers) in accordance with local processes and patient needs. A Consent Policy Statement (available online) provides information to providers. Participants are required to allow patients to change their consent preferences and the participants are responsible for updating consent preferences with the Mass HIway. Participants are also required to provide an accounting of disclosures to patients as required under HIPAA. Patient is given option to participate when they visit a clinical entity for care - here they may opt-in all clinical data from each entity. Patient chooses which entity's records to make available to the network - and pre-defined data are then sent to the central server. A signed patient consent form is required for a patient's clinical data to be uploaded from their physician's office EHR to the exchange community's database.","patient_notification_methods":"A Consent Policy Statement is available online for HIE participant review - participant is responsible for obtaining patient permission to share information over the HIE. Patient permission is requested for direct messaging functionality as well as consent for query and retrieve.  Participants are accountable for educating their patients about consent. Education is also available including YouTube videos, slideshare and PDF.","additional_information":"No specific consent forms or language is prescribed by Mass HIway and HIE participants have flexibility in designing the consent processes in accordance with their local processes and patient needs. Templates are available to assist the HIE Participants (providers) with the development of their policies, processes, and materials. First state to receive approval for federal funding from CMS through the Medicaid agency to create a statewide HIE (Mass HIway).","websites_and_publicly_available_resources":"http://www.mass.gov/eohhs/gov/commissions-and-initiatives/masshiway/;http://www.masshiway.net/HPP/Resources/ConsentforMassHIway/index.htm;http://www.masshiway.net/HPP/PatientsandFamilies/AboutYourConsent/index.htm;http://www.masshiway.net/HPP/cs/groups/hpp/documents/document/c3rh/dgvt/~edisp/consent_policy_statement.pdf;http://www.masshiway.net/HPP/cs/groups/hpp/documents/document/zxzj/mdaw/~edisp/orion-mao-devc000439.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Michigan","state_abbreviation":"MI","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Michigan Health Information Network (MiHIN)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Michigan established and implemented an 'Informed Opt-out' policy as the method of consumer control for protected health information in an HIE.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"http://mihin.org/exchanges/;http://mihin.org/about-mihin/faqs/;http://mihin.org/exchanges/other-state-exchanges/;http://www.michigan.gov/documents/mdhhs/HIT_Commission_2015_Annual_Report_Final_Version_513877_7.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Minnesota","state_abbreviation":"MN","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"See Additional Information Column","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Minnesota has a standard consent form available on the MDH website. Patients can opt-out of having their information shared between providers.","patient_notification_methods":"Minnesota Notice of Privacy Practices (NPP) is provided on the following website:  http://www.health.state.mn.us/e-health/privacy/ps102114npp.pdf","additional_information":"Minnesota includes State-Certified Health Information Exchange Service Providers including Health Information Organizations (HIOs) and Health Data Intermediary (HDI)","websites_and_publicly_available_resources":"http://www.health.state.mn.us/divs/hpsc/ohit/certified.html;http://www.health.state.mn.us/e-health/hitimp/2015mandatefaq.pdf;http://www.health.state.mn.us/e-health/privacy/index.html","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Mississippi","state_abbreviation":"MS","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Mississippi Health Information Network (MS-HIN) (2010)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"If a patient decides they do not want their health information shared, the patient can complete a MS-HIN opt-out form and request to be opted-out from each care provider. The patient will follow the instructions on the MS-HIN Non-Participation Request Form and return to the MS-HIN Office. This disables the patient's information from being accessible in the MS- HIN Community Health Record System. If a patient wants his or her health information to be private, he or she must inform each healthcare provider to make the health information "confidential" and also complete the MS- HIN "Opt-Out" form. A patient may reinstate their participation at any time. To cancel Opt Out, patients are to complete the MS-HIN Reinstatement Form and return to the MS-HIN Office.","patient_notification_methods":"MS-HIN health care providers are responsible for letting patients know they participate in MS-HIN.","additional_information":"By completing the MS-HIN opt-out form patients are telling MS-HIN not to allow their information to be "searchable" within the Community Health Record. However, there are organizations that utilize MS-HIN for required transmission of medical records such as Mississippi Public Health, insurance providers, accountable care organizations and home health agencies that are exempt from the MS-HIN Opt-Out system. This is due to a patient's existing agreements and/or state and federal laws requiring the exchange of clinical data.","websites_and_publicly_available_resources":"http://www.ms-hin.ms.gov/Pages/default.aspx;http://www.ms-hin.ms.gov/Sub/Pages/FAQ.aspx;http://www.ms-hin.ms.gov/Sub/MSHINDocuments/non-participation_requests_procedure6-2012.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Missouri","state_abbreviation":"MO","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Missouri Health Connection (2009)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients can opt out by completing and notarizing a form, and then sending it to MHC. Patients can opt-in at any time.","patient_notification_methods":"","additional_information":"Non-profit organization that serves as Missouri's statewide health information network.","websites_and_publicly_available_resources":"http://www.missourihealthconnection.org/downloads/MHC%20FACT%20PATIENT%20SHEET%2001282015.pdf;http://www.missourihealthconnection.org/opt-out;http://www.missourihealthconnection.org/about-us","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Montana","state_abbreviation":"MT","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"HealthShare Montana","type_of_consent_policy":"No Information Available","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"Montana's Designated Health Information Exchange Organization","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nebraska","state_abbreviation":"NE","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Nebraska Health Information Initiative (NeHII)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Participation in NeHII is completely free. If any of healthcare providers are participating in the NeHII system, patients are automatically enrolled in the system. If patients decide to opt out of NeHII, providers will not have access to patient healthcare records. If patients choose to opt out, they can opt back into the system at any time.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"https://www.connectnebraska.net/index.php?option=com_content&view=article&id=121&Itemid=165;http://50.63.36.155","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nevada","state_abbreviation":"NV","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Nevada Health Information Exchange (NV-HIE) (2012) (Operations ceased in 2014)","type_of_consent_policy":"No Information Available","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"Established in September 2012 as a non-profit Nevada corporation and ceased operations by 2014.","websites_and_publicly_available_resources":"http://www.healthcare-informatics.com/article/what-caused-fall-nevada-hie","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nevada","state_abbreviation":"NV","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"HealtHIE Nevada HIE","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Patients can opt-in and participate by signing up at their provider or clinic. Patients have the right to participate and they have three choices on the consent form including: (1) I consent; (2) I consent only in case of emergency; (3) I do not consent. Patients must give their permission for health care provider to view their health information in the HIE. Consent can be changed at any time.","patient_notification_methods":"","additional_information":"Private, not-for-profit statewide health Information exchange The only HIE open throughout Nevada.","websites_and_publicly_available_resources":"http://healthienevada.org/how-do-i-sign-up/;http://healthienevada.org;http://healthienevada.org/patients/patient-faqs/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Hampshire","state_abbreviation":"NH","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"New Hampshire Health Information Organization (NHHIO) (2011)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Little information could be found aside from the legislative FAQs with information on patient opt-out.","patient_notification_methods":"","additional_information":"Non-profit organization - NHHIO reports that their membership has grown to over 65 participants, continuing their positive trend towards full financial sustainability. Over 340,000 public health transactions are being sent through the NHHIO monthly, and over 10,000 are occurring directly between providers for better patient care.","websites_and_publicly_available_resources":"http://nhhio.org/about-us/faqs;http://nhhio.org/about-us/overview;http://www.hieanswers.net/new-hampshire-state-health-information-exchange/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Jersey","state_abbreviation":"NJ","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"New Jersey Health Information Network (NJHIN) (2014)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Information available separately for each of the 6 regional HIOs that are associated with the NJHIN.","patient_notification_methods":"","additional_information":"Data is exchanged among 6 regional HIOs: Camden HIE; Highlander; Jersey Health Connect; NJSHINE; Trenton HIE; Virtua HIE Information is also exchanged with the Department of Health's Immunization Information System NJHIN is also the primary vehicle for New Jersey to exchange health information nationally with the eHealth Exchange.","websites_and_publicly_available_resources":"http://www.healthcare-informatics.com/news-item/nj-launches-statewide-hie;http://www.state.nj.us/health/njhit/network/;http://www.njhitec.org/index.php/services/hie/nj/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Mexico","state_abbreviation":"NM","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"New Mexico Health Information Collaborative (NMHIC) (2013)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"New Mexico law states that patients must give consent before authorized users may view and share information in the patient's NMHIC electronic medical record. If a patient chooses not to participate in the NMHIC, then a consent form is required. The patient's care team will not be able to access their personal health information in the NMHIC HIE. However, in the event of a life threatening situation where the patient is unable to give consent, a provider can "Break the Seal" and locate the patient's electronic medical record. Break the Seal access has a time- limit and is audited. Patients may request an "Opt Out – Opt Back In" form by contacting NMHIC.","patient_notification_methods":"Patients may choose to Opt Out of participating in the system entirely, meaning no one can view their name or electronic medical record in a NMHIC search, not even in an emergency situation. The Opt Out decision by a patient may possibly cause delays in treatment or require the patient to have repeat lab tests and x-rays if the needed information is not readily accessible through other methods.","additional_information":"Public Health Reporting – NMHIC has been authorized to provide hospitals' Reportable Lab Results reporting and Syndromic Surveillance reporting to NM Department of Health. In addition, NMHIC is working with other HIEs along the New Mexico state lines.","websites_and_publicly_available_resources":"http://www.nmhic.org/sites/default/files/patient-consent-form.pdf;http://www.nmhic.org/node/3","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New York","state_abbreviation":"NY","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"New York eHealth Collaborative (NYeC) (2006)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"NY refers to this as an 'affirmative consent model'. Consent is considered all or nothing - all data contributed to the exchange can be made available. State level policies are broad and allow for variation by region / HIO. Two approaches for obtaining/gaining consent - provider organizations can obtain consent at the point of service. Also, the RHIO can obtain consent through a RHIO multi-provider consent form, which can be accessed either at the point of service or online via the RHIO website. Patients have the ability to revoke their participation in the exchange at any time. In this case, existing data in the exchange will remain, but will be requested from further circulation unless required by law.","patient_notification_methods":"Patient Consent Policies and Procedures are defined within the NY Policies and Procedures document available online.","additional_information":"","websites_and_publicly_available_resources":"http://www.nyehealth.org/","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"North Carolina","state_abbreviation":"NC","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"North Carolina HIE Network (2016)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients have the right to opt-out of the NC HIE any time. Patients who have opted out have the right to opt back in any time. A downloadable form is available for patients to complete and mail to the NCHIA. The opt-out form is available in English and in Spanish.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"http://hiea.nc.gov/patients","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"North Dakota","state_abbreviation":"ND","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"North Dakota Health Information Network (NDHIN)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients have the right to opt out of participation in the NDHIN. Opt-out is when an individual provides a written decision that their protected health information cannot be shared through the HIE, except in the situation where required by law or authorized by the individual in an emergency. By default, an individuals' protected health information can be searched for through the NDHIN, per North Dakota Senate Bill 2250. Opt Out means an individual has made a written decision that their protected health information cannot be searched for through the health information network, except as required by law or as authorized by the individual in an emergency. The NDHIN offers many benefits to patients, but participation is voluntary. A patient can choose to opt out of participation in the NDHIN and will be required to sign the Opt Out/Revoke Opt Out form, either electronically or on paper.","patient_notification_methods":"Notice of Privacy Policies are available online  Forms can either be filled out and sent in or submitted online - both are available to download online. Additional information is also available to patients/consumers regarding FAQs and information to read before electing to opt-out.","additional_information":"","websites_and_publicly_available_resources":"https://www.nd.gov/itd/statewide-alliances/ndhin/consumers/opt-out-participation;https://www.nd.gov/itd/statewide-alliances/ndhin/consumers/faqs#16;https://www.nd.gov/itd/statewide-alliances/ndhin/about-us/policies;https://www.nd.gov/itd/statewide-alliances/ndhin/about-us/policies/notice-privacy-practices","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Ohio","state_abbreviation":"OH","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"CliniSync (2009)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"As of December 2015, it is not required to affirmatively obtain a patient's consent prior to accessing the patient's information. Patients may opt-out at any time by notifying the Health Information Management Services/Medical Records Department or office administrator. CliniSync policy requires that an organization have a mechanism for a patient to opt-out. If they opt-out, then this decision must be communicated to the Partnership as soon as possible and no later than 3 days after receipt of request.","patient_notification_methods":"The policy does not dictate language that needs to be used for the Notice of Privacy Practices (NPP).","additional_information":"Patients can opt out by 4 methods: 1. Organization sends CliniSync a flag in its ADT message 2. Organization's staff is trained on CliniSync Consent tool in the CliniSync web portal and uses it to change consent status 3. Organization sends CliniSync a support ticket requesting the patient to be opted-out 4. Patient contacts CliniSync directly and mails a completed and notarized opt-out form that is available on the CliniSync website under Member Resources, Policies and Documents","websites_and_publicly_available_resources":"http://www.clinisync.org;http://www.clinisync.org/fact-sheets-faqs;http://www.clinisync.org/member-resources/policies-documents;http://www.healthcare-informatics.com/article/ohio-s-statewide-hie-success-strategy-and-services","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oklahoma","state_abbreviation":"OK","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Oklahoma Health Information Exchange Trust (OHIET)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"In Oklahoma, health information is protected and patients must provide authorization. Patients are may opt-out of their health records being accessed or exchanged.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"http://www.healthsciences.okstate.edu/ruralhealth/documents/SchottOOA0112.pdf;http://www.himss.org/oklahoma-health-information-exchange-trust-overview;http://law.justia.com/codes/oklahoma/2014/title-63/section-63-1-132;http://www.healthsciences.okstate.edu/ruralhealth/documents/SchottOOA0312.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oregon","state_abbreviation":"OR","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Care Accord (Oregon's State Information Exchange)","type_of_consent_policy":"No Information Available","details_of_consent_policy":"Patient consent must be obtained before transmitting information in all situations as is required by state/federal law.","patient_notification_methods":"","additional_information":"No further information can be found on the website regarding the consent model or policy for Care Accord Oregon","websites_and_publicly_available_resources":"https://www.careaccord.org/hie-in-oregon/overview.shtml","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Pennsylvania","state_abbreviation":"PA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Pennsylvania Patient & Provider Network (P3N) (2016)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"If a patient's healthcare provider is connected to the P3N (Pennsylvania Patient & Provider Network) through a certified HIO, that patient's information is automatically available to other P3N-connected providers. A patient may opt-out of sharing his/her information in the P3N by completing the P3N opt-out form. A P3N Opt-Out Registry is maintained by the Pennsylvania eHealth Partnership Authority","patient_notification_methods":"Forms, brochures are available for patients, healthcare providers and HIOs regarding P3N.","additional_information":"Additional educational information is provided via a consumer media campaign by the Pennsylvania eHealth Partnership Authority about electronic Health Information Exchange (eHIE).","websites_and_publicly_available_resources":"http://www.paehealth.org/consent;http://www.paehealth.org/images/P3N_Opt-Out_Form_Fillable_PDF_December_2014.pdf;http://www.paehealth.org/health-care-professionals?id=246","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Rhode Island","state_abbreviation":"RI","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Rhode Island Quality Institute (CurrentCare) (2001)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Consent for exchange participation is all or nothing. There is no granularity of choice with respect to the type of data that can flow though the exchange. Once enrolled - the options for participation include: 1. All providers permitted access to information 2. Only certain provider organizations (as selected by patient) are authorized to access information 3. Default setting - providers have temporary access to information only in emergency or unanticipated event Patients have the ability to revoke their participation in the exchange at any time. If they do revoke participation, the existing data will remain but will be sequestered from circulation, unless required by law.","patient_notification_methods":"Patients must be walked through the consent process. To enroll, a patient is to complete an enrollment and authorization form for the exchange or they can enroll directly on the website. Patients need to call the designated hotline to indicate their provider preferences.  There is an online enrollment option on the website for CurrentCare Rhode Island along with information on benefits for patients, physicians, hospitals, labs, insurers.","additional_information":"Rhode Island passed the Health Information Exchange Act of 2008, a law designed to provide privacy protections. The law also ensures that participation in the HIE is voluntary for consumers and provider and places restrictions on the use of data. Consumers must consent to enroll in the statewide HIE and can stipulate who has access to their health information. Participation is voluntary and free for both patients and healthcare providers. Health information may only be available in CurrentCare with the consent of the patient. Information may only be released from CurrentCare with the consent of the patient: in an emergency - to a provider in order to provide treatment, or for purposes of public health.","websites_and_publicly_available_resources":"http://www.riqi.org/matriarch/MultiPiecePage-8.html;http://www.currentcareri.org;http://www.commonwealthfund.org/~/media/Files/Publications/CaseStudy/2010/Dec/1465_Chase_Rhode_Island_quality_inst_case_study.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Carolina","state_abbreviation":"SC","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"South Carolina Health Information Exchange (SCHIEx) (2008)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Participation is voluntary. Physicians are to provide patients the option to opt-out of the exchange.","patient_notification_methods":"","additional_information":"Forms are available to complete if patients wish to file a complaint.","websites_and_publicly_available_resources":"http://schiex.org;http://schiex.org/privacy.php","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Dakota","state_abbreviation":"SD","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"South Dakota Health Link","type_of_consent_policy":"No Information Available","details_of_consent_policy":"Information is limited and website is inaccessible.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Tennessee","state_abbreviation":"TN","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"CareSpark (2005-2011)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"No data is collected for the exchange until the patient is at least minimally educated about the exchange. The board also allowed individual provider organizations to adopt an opt-in protocol where providers can choose to require affirmative consent.","patient_notification_methods":"","additional_information":"Dissolved in 2011 - Tennessee is working to develop a statewide network for health information exchange (HIE)","websites_and_publicly_available_resources":"https://www.cgi.com/sites/default/files/pdf/cgi_federal_CareSpark_Mean_Health_Info_Exchange.pdf;https://www.healthit.gov/sites/default/files/tennessee_state_hie_profile.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Tennessee","state_abbreviation":"TN","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"MidSouth eHealth Alliance (MSeHA) (2004)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients can opt out at the institutional level. According to a 2012 Healthcare IT News article citing an AMIA evaluation study, 'patients were allowed to opt out of participation in the HIE when they presented at participating hospitals and clinics. The opt-out percentage ranged from 1 percent to 3 percent across all sites over the study period.' Patients have the right to not share their health information in the Alliance, also known as "Opting Out." However, if they choose to opt out, health care providers may not have access to health information that may be important and useful in making choices about their medical care.","patient_notification_methods":"A Notice of Privacy Practices is provided to patients by their health care provider. A Fact Sheet is also provided to patients for educational purposes only. Operations of the Alliance and the content of the Fact Sheet may be changed by the Alliance from time to time without notice.","additional_information":"Non-profit initiative focused on the Mid-South region Receives funding from AHRQ and the State of Tennessee with grants totaling $12.5 million. Community-wide information system","websites_and_publicly_available_resources":"http://midsoutheha.org;http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2656027/;http://www.mfrisse.com/research/midsouth-ehealth-alliance;http://www.midsoutheha.org/faq.php;http://www.healthcareitnews.com/news/vanderbilt-u-2-million-just-beginning-hie-savings","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Texas","state_abbreviation":"TX","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"HIETexas (2013)","type_of_consent_policy":"Opt-In/Opt-Out","details_of_consent_policy":"HIEs in Texas offer different consent models - ranging from opt-in models to opt-out models and hybrid models. Regardless patients have the ability to opt-out of sharing information via HIE.","patient_notification_methods":"","additional_information":"HIETexas enables HIE infrastructure for the state. Statewide Network, coordinated by the Texas Health Services Authority, to enable HIE-to-HIE connectivity between authorized HIEs in Texas and across the country.","websites_and_publicly_available_resources":"http://www.hietexas.org/frequently-asked-questions/faqs;http://www.hietexas.org/patients","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Utah","state_abbreviation":"UT","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Utah Health Information Network (UHIN) Clinical Health Information Exchange (cHIE)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients can choose to opt-out of participation in the cHIE. If patients do not participate, the cHIE will not have their current or past medical information. If they have opted out and later decide to have their information included again, they will need to complete a new participation form, and the medical information in the cHIE will only contain health information created after the date of participation.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":";https://uhin.org/;http://www.deseretnews.com/article/705374661/Utah-rolls-out-first-statewide-health-information-exchange-seeking-patient-consent.html?pg=all","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Vermont","state_abbreviation":"VT","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Vermont Information Technology Leaders (VITL) Vermont Health Information Exchange","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Patients need to sign a consent form to opt-in. If a patient changes their mind they can sign a revocation form. Vermont is recently considering altering policy for patient consent from opt-in to opt-out.  More information at: http://www.healthcare-informatics.com/blogs/rajiv-leventhal/hie/Vermont-opt-versus-opt-out-hie-debate","patient_notification_methods":"When the patient visits his/her health care provider, s/he may be asked to give consent to allow the providers involved in their care access to the Vermont Health Information Exchange. A consent form must be signed.  Patient Consent Policy and Links are listed on the website for patients to review. https://www.vitl.net/learn/what-is-patient-consent  Vermont lists all privacy and security information on their website as listed:  https://www.vitl.net/learn/privacy-and-security","additional_information":"Patients may also request an audit of access of their health information. Information is also listed for providers and how to ask for consent. Scripts are included as well as information on workflow.","websites_and_publicly_available_resources":"https://www.vitl.net/asking-patients-consent;https://www.vitl.net;http://www.healthcare-informatics.com/blogs/rajiv-leventhal/hie/vermont-opt-versus-opt-out-hie-debate","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Virginia","state_abbreviation":"VA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Connect Virginia (2012)","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Information is limited and the website does not connect. Limited information indicates that ConnectVirginia holds an opt-in policy.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Washington","state_abbreviation":"WA","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Washington State Health Information Exchange (OneHealthPo rt) (2012)","type_of_consent_policy":"No Information Available","details_of_consent_policy":"Secondary research required","patient_notification_methods":"","additional_information":"OneHealthPort HIE is designated by the State of Washington as the statewide health information exchange. Consortium of founders include: The Everett Clinic, First Choice Health Network, Group Health Cooperative, Premera Blue Cross, Regence BlueShield, The Sisters of Providence and Swedish Hospital OneHealthPort is also responsible for attracting public and private sector stakeholders to invest and participate in the HIE. Oversight and governance is handled by a public- private sector organization. OneHealthPort is a secure portal that opens the door to valuable business and clinical solutions with a single way to sign on to local healthcare sites and online services for healthcare professionals. Created by a coalition of health plans, physicians, and hospitals that joined together to build a community where information could be shared securely and simply.","websites_and_publicly_available_resources":"http://www.onehealthport.com/hie;http://www.onehealthport.com/participants;","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"West Virginia","state_abbreviation":"WV","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"West Virginia Health Information Network (WVHIN) (2012)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Participation is automatic and patients become member when they are provided a Patient Notice informing them of their participation. Participation is voluntary and all patients have the right to NOT participate. Patients can opt out by simply stating they do not want their information exchanged through the WVHIN's HIE. Providers will still be able to exchange paper medical records by fax, mail or secure email.","patient_notification_methods":"If a patient opts-out but then want to re-enroll, participating health care providers can enroll patients back into the system.  Patients must ask their health care provider to give them the WVHIN "Request to Reverse Opt-Out Form". Once they have completed the form and returned it to their health care provider, they will be able to share their health information electronically through the WVHIN's HIE.","additional_information":"WVHIN connects doctors, hospitals, clinics, labs, pharmacies and other health care providers across the State.","websites_and_publicly_available_resources":"http://www.wvhin.org/;http://www.wvhin.org/patients/faq/default.aspx#_Toc313604276","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Wisconsin","state_abbreviation":"WI","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Wisconsin Statewide Health Information Network (WISHIN) (2010)","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Patients can choose not to participate, but participation is automatic. To opt out, patients must complete and submit a Patient Choice Form. There are also Opt Out Stipulations to read before filling out the form to understand what will happen if a patient chooses to opt out. It will take up to 3 business days after the opt-out request is received to process.","patient_notification_methods":"","additional_information":"Wisconsin's state-designated entity for HIE. WISHIN is a not-for-profit (Chapter 181) organization appointed as the state-designated entity for governance and implementation of a statewide health information exchange in Wisconsin (2009 Wisconsin Act 274). Founded by four organizations - Wisconsin Hospital Association; Wisconsin Medical Society; Wisconsin Collaborative for Healthcare Quality; Wisconsin Health Information Organization.","websites_and_publicly_available_resources":"http://www.wishin.org/ForPatients/PatientChoice.aspx;http://www.wishin.org/NewSite/ProductsOLD/WISHINPulse.aspx;http://www.wishin.org/Portals/0/Policy/Patient%20Choice%20Form.pdf","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Wyoming","state_abbreviation":"WY","consent_authorization_policy":"state sponsored HIE organization consent policies","organization_launch_date":"Wyoming e- Health Partnership (2011)","type_of_consent_policy":"No Information Available","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"Non-profit entity designated by the Governor of Wyoming to carry out the strategic and operational plans of the Wyoming HIE. Could not get to the website via Google search or via the link provided by the Wyoming Department of Enterprise Technology Services site listed below:","websites_and_publicly_available_resources":"http://ets.wyo.gov/office-of-enterprise-architecture/health-it-enterprise-architecture","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alabama","state_abbreviation":"AL","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Alabama Health Information Exchange, Policy and Procedures 15 (2012) - Alabama HIE Policy states that disclosures of PHI through One Health Record for purposes of treatment, payment and operations are permitted without patient authorization, but that patients have the right to opt-out from participating in the electronic sharing of his/her PHI through One Health Record. The decision to opt- out applies globally to all of the individual's PHI, but an individual cannot opt-out of disclosures of information that are required by law. Individuals can also revoke their opt-out decisions.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all "participants" in state government-established HIE and participant providers have the burden of ensuring that patients are given the right to opt-out and maintain relevant documentation.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://onehealthrecord.alabama.gov/","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"Policy was created by Alabama Health Information Advisory Commission, which is a voluntary effort chaired by the Alabama Medicaid Agency (as the state-designated entity). Compliance with and adherence to these policies and procedures will be monitored and enforced by the AHIE staff under the guidance of the Governing Authority.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alaska","state_abbreviation":"AK","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Alaska Stat. § 18.23.310 - The statute requires that the Department of Health establish procedures to allow those individuals with health records in the HIE system to opt out of it.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to the HIE established by the Alaska Department of Health and Social Services.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.legis.state.ak.us/basis/statutes.asp#18.23.310","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arizona","state_abbreviation":"AZ","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Ariz. Rev. Stat. § 38-3802 requires that HIOs provide participating individuals a number of rights including the right to opt out.  Ariz. Rev. Stat. § 38-3803 provides further detail on what an individual's right to opt out includes:  The individual has the right to opt out by providing notice to the HIO in the form the HIO requires; an individual also has the right to opt out of a particular provider sharing his/her PHI through the HIO; and an individual has the right to opt back in by providing notice to the HIO.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all HIOs, which are defined under Arizona law as "organization[s] that oversee[] and govern[] the exchange of individually identifiable health information among organizations according to nationally recognized standards." The definition of HIO under AZ law excludes health plans, providers, and exchange between providers without the use of a separate organization governing the exchange. Ariz. Rev. Stat. § 38-3801.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.azleg.state.az.us/FormatDocument.asp?inDoc=/ars/36/03802.htm&Title=36&DocType=ARS","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arkansas","state_abbreviation":"AR","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Arkansas Office of Health Information Technology, OHIT Privacy Policies 10 (2013) - Arkansas OHIT policy gives all individuals the right to opt out of the SHARE system (the Arkansas state-run HIE). The policy states that the decision to opt out only affects the availability of PHI through SHARE, and that participating providers' policies on sharing govern all other kinds of uses/disclosures. An individual also has the right to revoke his/her decision to opt out of SHARE. The policy allows participating entities to choose how to allow the patient to exercise his/her choice. If an individual's information is available through the SHARE system, the policy allows participating providers to assume that the individual has not opted out.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all individuals participating in SHARE. Participating entities (healthcare providers) are required to find a way to give individuals the right to opt out.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://www.ohit.arkansas.gov/Websites/ohit/images/OHIT-Privacy-Policies-November-2013.pdf#page=10","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"Policy was created by the Arkansas Office of Health Information Technology (OHIT), which developed and maintains the state-run HIE, SHARE.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"California","state_abbreviation":"CA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In but HIOs can get demonstration project waivers to test out opt-out models","details_of_consent_policy":"California Office of Health Information Integrity, California's Statewide Health Information Policy Manual 193 (2016) - California's statewide health information policy manual requires that an agreement between an HIO and the entities it provides HIE services for must require that participating organizations obtain the appropriate authorization from the patient to allow the exchange of health information.  The policy manual defines "authorization" as "a detailed document signed and dated by the patient that grants permission for the covered entity to use or disclose health information, for specified purposes."","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"All HIOs operating in CA must include consent requirements in their agreements with participating providers.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://www.chhs.ca.gov/OHII/Documents/SHIPM_06-2016.pdf#page=66","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"California State Health Information Policy Manual (SHIPM) developed by the state government entity, California Office of Health Information Integrity.","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Colorado","state_abbreviation":"CO","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Connecticut","state_abbreviation":"CT","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out for regular PHI; Opt-In for sensitive PHI","details_of_consent_policy":"Health Information Technology Exchange of Connecticut, Consumer Authorization and Consent Policy 3 (2011) - HITE-CT's consumer authorization and consent policy gives patients the option to opt out of having their PHI disclosed through HITE-CT.  If a patient has not opted out, HITE-CT will disclose all non-sensitive PHI for the purposes of treatment, payment and health care operations as permitted by HIPAA, unless the patient and provider have agreed upon a specific restriction on disclosure. Sensitive PHI is PHI that is "subject to heightened confidentiality requirements in compliance with all federal and state laws as amended from time-to-time (HIV, substance abuse and mental health records)." Patients must specifically authorize disclosures of sensitive PHI. A patient's opt-out of HITE-CT is global, which means that no PHI will be disclosed to any party by HITE-CT, except as required by law (such as public health reporting requirements, etc.). However, even if a patient has opted out, HITE-CT may allow for disclosures of PHI in emergency treatment situations, but such disclosures will be audited strictly to make sure that there was a legitimate emergency requiring disclosure.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to HITE-CT and to all persons and organizations who have access to HITE-CT managed health records.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://www.ct.gov/hitect/lib/hitect/hite-ct_consumer_authorization_&_consent_policy_v1.pdf#page=3","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"Health Information Technology Exchange of Connecticut (HITE-CT) is a nonprofit quasi-state agency.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Delaware","state_abbreviation":"DE","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"1-100-102 Del. Code Regs. § 7.2 (2009) - DHIN regulations on participation gives patients the right to be informed of and the option of choosing to prohibit a search for their PHI in the DHIN Interchange upon consultation with their health care provider.","patient_notification_methods":"","additional_information":"Participation in DHIN by healthcare entities is voluntary.","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all individuals with health information in DHIN.","source_of_consent_policy":"Regulation","source_of_consent_policy_url":"http://regulations.delaware.gov/AdminCode/title1/100/102.shtml#TopOfPage","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"District of Columbia","state_abbreviation":"DC","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"District of Columbia Health Information Exchange Policy Board, Monthly Meeting Minutes 3 (2013) - The DC HIE Policy board adopted a motion to implement an opt out consent model for the DC HIE. Further details about the policy can be found  here.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all patients and participants enrolled in DC HIE.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://dhcf.dc.gov/sites/default/files/dc/sites/dhcf/publication/attachments/DC-HIE-PBMeetingMinutes-May152013-DRAFT.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"The District of Columbia Department of Health Care Finance (DHCF) was awarded a grant from the Office of the National Coordinator for Health Information Technology (ONC) to create DC HIE. DC HIE is staffed and managed by DHCF.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Florida","state_abbreviation":"FL","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In for each time a new provider wants to access PHI","details_of_consent_policy":"Florida Health Information Network, Patient Authorization - FHIN's documents discussing patient authorization of exchange of health information in FL states that patients have to authorize both the search for and access to medical records. However, Florida allows exceptions to the rule requiring patient authorization in cases of medical emergency and when disclosure is required for public health reporting purposes.","patient_notification_methods":"","additional_information":"Additional details on how patient authorization works in Florida HIE are available  here.","websites_and_publicly_available_resources":"http://fhin.net/floridaHie/docs/ConsumerInformation.pdf","scope_of_consent_policy":"Applies to all providers participating in Florida HIE.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://www.fhin.net/privacyRegulations/docs/PatientAuthorizationRule.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"Florida HIE is run by the Agency of Health Care Administration, which provides guidance through the Florida Health Information Network.","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Georgia","state_abbreviation":"GA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Hawaii","state_abbreviation":"HI","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Idaho","state_abbreviation":"ID","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Illinois","state_abbreviation":"IL","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"(1) Opt-Out for mental health information","details_of_consent_policy":"740 Ill. Comp. Stat. 110/9.6 - Illinois law requires that all HIEs require that participating healthcare providers give patients whose mental health information is on the HIE the opportunity to prohibit further disclosure of the record by the HIE to third parties, except in cases where such disclosure is permitted by law such as for purposes of public health reporting.","patient_notification_methods":"","additional_information":"The statute defines HIE as a "health information exchange or health information organization that oversees and governs the electronic exchange of health information that (i) is established pursuant to the Illinois Health Information Exchange and Technology Act; or (ii) has established a data sharing arrangement with the Illinois Health Information Exchange; or (iii) was designated by the Illinois Health Information Exchange Authority Board as a member of, or was represented on, the Authority Board's Regional Health Information Exchange Workgroup; provided that such designation shall not require the establishment of a data sharing arrangement or other participation with the Illinois Health Information Exchange or the payment of any fee."","websites_and_publicly_available_resources":"","scope_of_consent_policy":"This rule is binding upon all HIEs as defined in the statute.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.ilga.gov/LEGISLATION/ILCS/ilcs3.asp?ActID=2043","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Illinois","state_abbreviation":"IL","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"(2) Opt-Out for all PHI; Opt-In for special PHI","details_of_consent_policy":"Illinois Health Information Exchange Authority, Patient Choice and Meaningful Disclosure 1 (2015). ILHIE's patient choice policy allows automatic access to PHI maintained by participating healthcare providers unless a patient opts out and prohibits access to his/her PHI through the exchange.  Patients have the option of revoking their decision to opt- out. However, access to "specially protected health information" is not automatic and disclosure of such PHI requires specific consent from the individual. Specially protected health information is defined as: "certain alcohol and substance abuse treatment information; child abuse and neglect reports and records; sexual assault evidence and information; veteran's homes resident records; and any other health information that requires [individual] consent in order to be disclosed under Federal or State law."","patient_notification_methods":"","additional_information":"ILHIE's opt-in policy for specially protected health information can be found here.  The definition of specially protected health information can be found here.","websites_and_publicly_available_resources":"https://www.illinois.gov/sites/ilhie/Documents/%20Info%20Subject%20to%20Special%20Protection%20rev%2011.2014%20-%20final%20effective%201.1.2015.pdf;https://www.illinois.gov/sites/ilhie/Documents/ILHIE%20Connect%20Opt-In%20Form.pdf","scope_of_consent_policy":"Applies to all patients whose providers participate in ILHIE.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"https://www.illinois.gov/sites/ilhie/Documents/6%20Patient%20Choice%20%20Meaningful%20Disclosure%20rev%2011.2014%20-%20final%20effective%201.1.2015.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"Policy adopted by the ILHIE Authority - Instrumentality and an administrative agency of the State of Illinois.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Indiana","state_abbreviation":"IN","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Iowa","state_abbreviation":"IA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Iowa Code § 135.156E (2016) - Iowa law gives patients the ability to opt out of the exchange of PHI through IHIN's record locator service.  This opt-out decision is global and none of the patient's PHI will be accessible through the record locator service unless otherwise authorized by the law.  A patient who has opted out has the ability to opt back into IHIN.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"The Iowa Department of Health is responsible for making sure that all patients participating in IHIN have the opportunity to opt out, and these requirements are not intended for other regional, population-specific or local health information networks.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.legis.iowa.gov/docs/code/135.156E.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Kansas","state_abbreviation":"KS","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Kan. Stat. Ann. § 65-6832 - Kansas law requires the Kansas Department of Health to establish certain requirements for approved HIOs to use in their participation agreements with health care providers. These requirements include details about the written notice that a health care provider has to give to a patient explaining how and what PHI will be shared with the approved HIO. The law requires that the written notice specifically state that the patient has the right to request in writing that his/her PHI not be disclosed by the HIO and the HIO must comply with the request in all cases except in cases when disclosure is permitted for emergencies or as required by law.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"The Department of Health establishes opt-out requirements that all approved HIOs in participation agreements with covered entities have to follow.  HIOs must approved to operate in the state of Kansas.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.ksrevisor.org/statutes/chapters/ch65/065_068_0032.html","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Kentucky","state_abbreviation":"KY","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No further consent","details_of_consent_policy":"Governor's Office of Electronic Health Information, First Update: Kentucky Strategic and Operational Plan for Health Information Exchange 24 (2014) - GOEHI states that because health care providers are allowed to share PHI without patient consent for the purpose of treatment under HIPAA, no further consent is required for exchange of PHI through KHIE. GOEHI further states that it requires no prior consent is required for disclosures for the purposes of payment and health care operations.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all participants in KHIE.","source_of_consent_policy":"State HIE Plan","source_of_consent_policy_url":"http://khie.ky.gov/inc/Documents/SOP%20Plan%20Update%20Draft%20June%2014%20FINAL%20Edition.pdf#page=26","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"KY Strategic and Operational Plan for KHIE by the Governor's Office of Electronic Health Information (GOEHI). KHIE is administered by the Division of Kentucky Electronic Health Information in the Cabinet for Health and Family Services.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Louisiana","state_abbreviation":"LA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Maine","state_abbreviation":"ME","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Me. Rev. Stat. Ann. tit. 22, § 1711- C(18)(C) - Maine law requires that the state-designated statewide HIE provide patients the ability to opt out from participation in the HIE and to prohibit the state-designated statewide HIE from disclosing the patient's PHI to a health care provider.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to the state-designated statewide HIE.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.mainelegislature.org/legis/statutes/22/title22sec1711-C.html","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Maryland","state_abbreviation":"MD","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Md. Code Regs. 10.25.18.03 - Maryland regulations give patients participating in an HIE a number of rights including the right to opt out of the HIE at any time and to refuse access to the patient's PHI through an HIE, except in certain specific circumstances.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all HIEs, not just the state designated exchange. MD statute defines HIE as "an infrastructure that provides organizational and technical capabilities for the exchange of protected health information electronically among entities not under common ownership."","source_of_consent_policy":"Regulation","source_of_consent_policy_url":"http://www.dsd.state.md.us/comar/comarhtml/10/10.25.18.03.htm","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Massachusetts","state_abbreviation":"MA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Mass. Gen. Laws ch. 118I §§ 11, 13 - Massachusetts law requires that any plan that has received funds from the eHealth Institute Fund or the Massachusetts Health Information Exchange Fund is required to establish a mechanism allowing patients to opt-in to the HIE and to subsequently opt- out at any time.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to any plan that receives funding from the Massachusetts eHealth Institute or the MA HIE Fund.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXVII/Chapter118I/Section11","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Michigan","state_abbreviation":"MI","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Minnesota","state_abbreviation":"MN","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Minn. Stat. § 144.293(8)(d) (2015) - Minnesota law requires that health care providers or entities operating a record locator service or a patient information service must give patients the opportunity to exclude their identifying information and information about the location of their records from such a record locator or patient information service. Providers participating in a HIE with a record locator or patient information service who receive a patient's opt-out request to exclude all of his/her information from the service or to have a specific provider excluded from the service are responsible for removing that information from the service.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"All providers and entities in MN operating a record locator of patient information service have to give patients the ability to opt out.  Burden is on providers to get patients' info removed from HIE service.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"https://revisor.mn.gov/statutes/?id-144.293","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Mississippi","state_abbreviation":"MS","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Missouri","state_abbreviation":"MO","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Montana","state_abbreviation":"MT","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nebraska","state_abbreviation":"NE","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nevada","state_abbreviation":"NV","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In","details_of_consent_policy":"Nev. Rev. Stat. § 439.589 - Nevada law requires that the director of the Department of Health and Human Services put forward regulations establishing standards for obtaining consent from a patient before retrieving the patient's health records from an HIE.  The law further requires that these standards include requirements for how a patient may revoke his/her consent for a health care provider to retrieve his/her health records from the HIE.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"In Nevada, HIEs can't operate without state certification.  To receive certification, HIEs have to demonstrate their adherence to patient consent standards described in the language of consent policy.  Therefore, this statute requiring consent applies to all HIEs operating in Nevada.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"https://www.leg.state.nv.us/urs/NRS-439.html#NRS439Sec589","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Hampshire","state_abbreviation":"NH","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"N.H. Rev. Stat. Ann. § 332-I:3 - New Hampshire law gives patients the right to opt out of sharing his/her name and address and his/her PHI through NH-HIO. The law requires that the patient be given this opportunity to opt out in a clear and conspicuous manner.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to state-created NH- HIO only.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.gencourt.state.nh.us/rsa/html/xxx/332-i/332-i-mrg.htm","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Jersey","state_abbreviation":"NJ","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Mexico","state_abbreviation":"NM","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out for demographic information and information about location of EHR, but consent is required to access the EHRs themselves","details_of_consent_policy":"N.M. Stat. § 24-14B-6 (2009) - New Mexico law requires that record locator services provide patients the option of excluding their demographic information and information about the location of their electronic medical records from the record locator service. The person at a record locator service or HIE who receives a patient's request to exclude all of his/her information from the record locator service is responsible for removing that information from the service. The law allows for access to a patient's medical record in case of a medical emergency even if the patient has opted out.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all record locator services or HIEs.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://public.nmcompcomm.us/nmnxtadmin/NMPublic.aspx","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New York","state_abbreviation":"NY","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In","details_of_consent_policy":"N.Y. Comp. Codes R. & Regs. tit.10, § 300.5(a) (2016) - New York requires that qualified entities only allow access to patient information by participating healthcare providers with a written authorization from the patient or someone qualified to consent on behalf of the patient if the patient lacks capacity.  The written authorization must specify who is authorized to access the information. The regulation states that qualified entities may allow access to patient information without written authorization when: (1)Prior consent has already been obtained for the disclosure and no provision of law requires any additional written authorization; (2)Disclosure is required or authorized by law; or (3) The patient is in need of emergency medical care as long as the health care provider documents the situation and states that attempting to secure consent would result in delay of treatment resulting in increased medical risk to the patient.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies only to qualified entities certified by the state of New York to participate in the Statewide Health Information Network for New York (SHIN- NY).","source_of_consent_policy":"Regulation","source_of_consent_policy_url":"http://w3.health.state.ny.us/dbspace/NYCRR10.nsf/11fb5c7998a73bcc852565a1004e9f87/0e7e8eade1f0fbdb85257f7000615371?OpenDocument","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"North Carolina","state_abbreviation":"NC","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"N.C. Gen. Stat. § 90-414.10 - North Carolina law gives each patient the right to opt out of having their PHI shared through the NC HIE and to revoke his/her decision to opt out.  However, PHI must be disclosed in order to provide emergency medical services even when a patient has opted out , as long as certain criteria are met.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Gives all individuals with PHI in the NC HIE the right to opt out.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.ncga.state.nc.us/enactedlegislation/statutes/pdf/bysection/chapter_90/gs_90-414.10.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"North Dakota","state_abbreviation":"ND","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"N.D. Cent. Code § 23-12-19 - North Dakota law gives patients the right to opt out of participating in the state-run HIO by providing notice to the HIO. Further, the law gives patients the option of either fully opting out or conditionally opting out (which means that the patient's PHI will only be accessible to a health care provider in cases of medical emergency).  Patient's decision to opt out can be revoked at any time and opting out does not prohibit disclosures required by law.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Gives all individuals the right to opt out of participating in the state HIO.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://www.legis.nd.gov/cencode/t23c12.pdf#nameddest=23-12-19","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Ohio","state_abbreviation":"OH","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"Ohio Rev. Code § 3798.06 - Ohio law allows disclosure of PHI to approved HIEs by a participating health care provider as long as the provider gives the individual/personal representative of the individual written notice informing the patient, among other things, that s/he has the ability to submit a written request to place restrictions on disclosures of PHI to the approved HIO. Ohio Rev. Code § 3798-07 - Ohio law requires that providers restrict disclosures as per the patient's request. Ohio Rev. Code § 3798.16(B) - Ohio law further requires that a provider's notice of privacy practices inform patients that their PHI will be disclosed to authorized HIE and that they have the right to request that the covered entity not disclose any PHI (this must always be honored by the covered entity) or specific categories of PHI to the HIE (this must be honored by covered entity if consistent with future regulations adopted by state).","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all disclosures of PHI to approved HIEs by participating healthcare providers.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://codes.ohio.gov/orc/3798","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"Y","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oklahoma","state_abbreviation":"OK","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oregon","state_abbreviation":"OR","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"Oregon state government seems to be working on developing a consent policy, according to the materials  here.","websites_and_publicly_available_resources":"http://www.oregon.gov/oha/OHPR/HITOC/Pages/Meeting_Materials.aspx","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Pennsylvania","state_abbreviation":"PA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"62 Pa. Cons. Stat. § 1403–C - Pennsylvania law requires that the PA Department of Human Services develop and maintain an opt-out registry and procedures to re-enroll into the HIE. The law states that only the patient has the right to decide to opt out of the HIE.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to patients with PHI in the state HIE.","source_of_consent_policy":"Passed bill about to be incorporated into the statutory code","source_of_consent_policy_url":"http://www.legis.state.pa.us/CFDOCS/Legis/PN/Public/btCHeck.cfm?txtType=PDF&sessInd=0&billBody=H&billTyp=B&billNbr=1062&pn=3638#page=16","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Rhode Island","state_abbreviation":"RI","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In","details_of_consent_policy":"5 R.I. Gen. Laws § 37.7-4 - Rhode Island law gives patients and healthcare providers the choice of participating in the HIE, but providers are required to continue maintaining their own medical record. The law allows disclosure of PHI in cases where the patient has opted out when such disclosure is otherwise allowed by law.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to patients with PHI in the state-established HIE.","source_of_consent_policy":"Statute","source_of_consent_policy_url":"http://webserver.rilin.state.ri.us/Statutes/TITLE5/5-37.7/5-37.7-4.HTM","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Carolina","state_abbreviation":"SC","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Dakota","state_abbreviation":"SD","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"South Dakota Health Link, Policy and System Operation Manual 7 (2015) - South Dakota Health Link's policy states that all patients of a participating health care provider will be automatically enrolled in South Dakota Health Link, with no need for further consent from the patient. The policy states that a patient's consent will be assumed unless the patient affirmatively opts out of participating in South Dakota Health Link.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all patients whose providers participate in SD Health Link.","source_of_consent_policy":"State Policy","source_of_consent_policy_url":"http://www.sdhealthlink.org/files/HealthLinkPolicy.pdf#page=7","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"South Dakota Health Link is the HIE provided by the South Dakota Department of Health and guided by an active advisory council.","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Tennessee","state_abbreviation":"TN","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Texas","state_abbreviation":"TX","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Utah","state_abbreviation":"UT","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out for Medicaid, CHIP and State public office health benefits enrollees","details_of_consent_policy":"H.B. 46, 2012 Gen. Sess. (Utah 2012) - Utah passed a law that automatically enrolls Medicaid, CHIP, and public employees in the HIE unless they opt out. The bill amends a number of sections of Utah's code to include this automatic enrollment provision.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Gives all recipients of Medicaid, CHIP, and state public employee benefits automatically enrolled in the state HIE the right to opt out.","source_of_consent_policy":"Bill amending a number of statutes in Utah Code","source_of_consent_policy_url":"http://le.utah.gov/~2012/bills/hbillenr/hb0046.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Vermont","state_abbreviation":"VT","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-In","details_of_consent_policy":"State of Vermont Green Mountain Care Board, Decision Approving Proposed Revised Policy on Patient Consent for Provider Access to Protected Health Information on the Vermont Health Information Exchange (VHIE) or through the Vermont Blueprint for Health (2014). Vermont's Green Mountain Care Board adopted a proposed policy giving participating healthcare providers access to PHI on VHIE and Vermont State Blueprint for Health for those individuals who have a current written consent on record. The policy requires participating health care providers who collect such written consents to maintain a record of such a consent and to inform the exchanges that the patient has consented to participating in the exchanges.  The policy allows participating healthcare providers access to the PHI of an individual through the exchanges without the consent in cases of medical emergency when the provider cannot obtain the individual's consent due to the emergency medical condition. The policy allows individuals who have provided consent the option of revoking the consent.","patient_notification_methods":"","additional_information":"The draft proposal can be found here.; The state agency adoption of the draft proposal can be found here.","websites_and_publicly_available_resources":"http://hcr.vermont.gov/sites/hcr/files/pdfs/Draft-Consent-Policy-020614.pdf; http://hcr.vermont.gov/sites/hcr/files/pdfs/Draft-Consent-Policy-020614.pdf","scope_of_consent_policy":"Applies to providers participating in VHIE and Vermont State Blueprint for Health HIEs.","source_of_consent_policy":"State agency decision adopting the policy","source_of_consent_policy_url":"http://hcr.vermont.gov/sites/hcr/files/pdfs/Draft-Consent-Policy-020614.pdf","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"State agency decision adopting the policy","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Virginia","state_abbreviation":"VA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Washington","state_abbreviation":"WA","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"West Virginia","state_abbreviation":"WV","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"Opt-Out","details_of_consent_policy":"W. Va. Code R. § 65-28-5 (2014) - West Virginia regulations require WV HIN to give patients the opportunity to make an informed choice about whether his/her PHI may be disclosed and used in WV HIN, allowing any patient to opt out of participation.  The regulation considers any patient who has not opted out an automatic participant in WV HIN when his/her health care provider enrolls in WV HIN or when a data supplier discloses his/her PHI through WV HIN.  The regulation further states that when a patient has opted out WV HIN will not disclose PHI in any case except for public health reporting purposes as required by law.","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"Applies to all patients whose providers participate in WV HIN.","source_of_consent_policy":"Regulation","source_of_consent_policy_url":"https://apps.sos.wv.gov/adlaw/csr/readfile.aspx?DocId=25709&Format=PDF#page=9","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"N","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Wisconsin","state_abbreviation":"WI","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Wyoming","state_abbreviation":"WY","consent_authorization_policy":"state HIE consent policies","organization_launch_date":"","type_of_consent_policy":"No policy","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alabama","state_abbreviation":"AL","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alaska","state_abbreviation":"AK","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arizona","state_abbreviation":"AZ","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arkansas","state_abbreviation":"AR","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"California","state_abbreviation":"CA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Colorado","state_abbreviation":"CO","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Connecticut","state_abbreviation":"CT","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Delaware","state_abbreviation":"DE","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"16 Del.C. § 5161/16 Del.C. § 1210","citation_of_statute_or_regulation_url":"http://www.delcode.delaware.gov/title16/c051/sc05/index.shtml","narrative_description_of_state_law":"When releasing protected health information without authorization, the Delaware Department of Health and Social Services must limit the disclosure to minimum amount necessary to accomplish the purpose of disclosure. This limitation applies to disclosures of protected health information for treatment purposes.","definition_or_scope_of_information_material_covered_by_policy":"Protected health information maintained by the Department of Health and Social Services. Delaware defines protected health information as any information that relates to an individual's mental or physical health status, condition, or treatment history and identifies or could identify the individual (16 Del.C. § 1210)."},{"state":"District of Columbia","state_abbreviation":"DC","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"D.C. Code §§ 7- 1201.01 et seq.","citation_of_statute_or_regulation_url":"http://doh.dc.gov/sites/default/files/dc/sites/doh/publication/attachments/MENTAL%20HEALTH%20INFORMATION.pdf","narrative_description_of_state_law":"Health care providers may disclose mental health information to other providers for treatment purposes to the extent necessary to provide health services to an individual. Providers must give individuals an opportunity to opt out of such disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Mental health information. Washington D.C. defines mental health information as identifiable diagnosis or treatment information obtained by a mental health professional while serving in a professional capacity (D.C. Code § 7-1201.01)."},{"state":"Florida","state_abbreviation":"FL","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Georgia","state_abbreviation":"GA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"Ga. Code. Ann., § 37-3-1661/Ga Comp. R. & Regs. 290-4-6-.05","citation_of_statute_or_regulation_url":"https://www.lexisnexis.com/hottopics/gacode","narrative_description_of_state_law":"Georgia permits facilities to disclose a patient's record when and as necessary for treatment as determined by the chief medical officer of a facility (Ga Comp. R. & Regs. 290-4-6-.05).","definition_or_scope_of_information_material_covered_by_policy":"Clinical records. Georgia defines clinical records as written records maintained by facilities and other entities that provide treatment in accordance with Georgia's mental health law that include information about an individual's hospitalization and treatment (e.g., medical records, charts, admission data, etc.) (Ga. Code Ann., § 37-3-1)."},{"state":"Hawaii","state_abbreviation":"HI","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"HRS § 334-5/Haw. Admin. Rules (HAR) § 11-175-31","citation_of_statute_or_regulation_url":"http://health.hawaii.gov/opppd/files/2015/06/11-1751.pdf","narrative_description_of_state_law":"Hawaii prohibits the mental health division, a contract program, or providers from disclosing information from the clinical record of a person receiving mental health treatment unless the disclosure falls into one of the exempted disclosure categories. These categories include disclosures that the director or administer deems necessary to carry out the provisions of Hawaii's mental health law, including the provisions that address mental health treatment. All permissible disclosures must be limited to the information relevant to the purpose for disclosure. Therefore, the minimum necessary standard applies to disclosures for treatment purposes.","definition_or_scope_of_information_material_covered_by_policy":"Certificates, applications, records, and reports that directly or indirectly identify an individual and are generated, maintained, or disclosed by providers, health plans, or health care clearinghouses in accordance with Hawaii's mental health statute (HRS § 334-4)."},{"state":"Idaho","state_abbreviation":"ID","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Illinois","state_abbreviation":"IL","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"740 ILCS 110/9","citation_of_statute_or_regulation_url":"http://www.ilga.gov/legislation/ilcs/fulltext.asp?DocName=074001100K9","narrative_description_of_state_law":"Illinois permits therapists, integrated health systems, or members of an interdisciplinary team ("providers") to disclose mental health information without an individual's consent in limited circumstances (e.g., to consulting therapists or staff members while providing services to an individual). Providers must notify individuals before making the disclosure and limit disclosure to only the information that is essential to the purpose of disclosure.","definition_or_scope_of_information_material_covered_by_policy":"Records and communications made while providing mental health or developmental disability services (740 ILCS 110/2)."},{"state":"Indiana","state_abbreviation":"IN","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Iowa","state_abbreviation":"IA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"I.C.A. § 228.5","citation_of_statute_or_regulation_url":"https://www.legis.iowa.gov/docs/code/2016/228.5.pdf","narrative_description_of_state_law":"Iowa allows the disclosure of an individual's mental health information to other providers so long as the disclosure is limited to the "extent necessary" to provide the individual with professional or administrative services.","definition_or_scope_of_information_material_covered_by_policy":"Mental health information. Iowa defines mental health information as identifiable information in written, oral, or recorded form that pertains to an individual's receipt of mental health services (I.C.A. § 228.1)."},{"state":"Kansas","state_abbreviation":"KS","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Kentucky","state_abbreviation":"KY","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Louisiana","state_abbreviation":"LA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"La. Admin Code. tit. 48, pt. I, § 507","citation_of_statute_or_regulation_url":"http://www.doa.la.gov/osr/LAC/48v1/48v01.doc","narrative_description_of_state_law":"Louisiana allows agency employees to disclose medical information without a patient's consent to other employees of the agency if the employee has a legitimate need for the information in order to perform their duties. Louisiana grants the superintendent authority to determine the meaning of legitimate need. Agency employees may disclose medical information to another agency without a patient's consent if the superintendent of the disclosing agency determines that: (1) a Louisiana law or regulation compels disclosure; (2) the information is necessary for a cooperative program in which both agencies participate; (3) the agency has referred the patient to another agency for evaluation or treatment; or (4) the receiving agency needs the information to perform their duties and the disclosing agency cannot reasonably obtain the patient's consent. Employees must limit disclosure to the information necessary to achieve the purpose of the disclosure.","definition_or_scope_of_information_material_covered_by_policy":"Medical information maintained by an agency. Louisiana defines medical information as records, documents, reports, and charts created by physicians, public hospital employees, psychiatrists, surgeons, public mental health facilities, and other public health facilities that pertain to an individual's physical or mental condition. Agency refers to mental health facilities, hospitals, intuitions, and other entities that are housed with the Department of Health and Human Resource and that use or maintain medical information. (La. Admin Code. tit. 48, pt. I, § 503)."},{"state":"Maine","state_abbreviation":"ME","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Maryland","state_abbreviation":"MD","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"Md. Gen. Health. § 4-307","citation_of_statute_or_regulation_url":"http://mgaleg.maryland.gov/webmga/frmStatutesText.aspx?article=ghg&section=4-307&ext=html&html&session=2015RS&tab=subject5","narrative_description_of_state_law":"Persons that disclose medical records related to mental health services without authorization may only disclose information relevant to the purpose for which they are disclosing the information. This limitation applies to disclosures for treatment purposes.","definition_or_scope_of_information_material_covered_by_policy":"Medical records. Maryland defines medical records as information about a patient or recipient's health care that is entered into a record and identifies or can lead to the identification of a patient. Recipient refers to a person that has applied for or is receiving mental health services (MD Code, Health - General, § 4-307)."},{"state":"Massachusetts","state_abbreviation":"MA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Michigan","state_abbreviation":"MI","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"M.C.L.A. § 330.1748","citation_of_statute_or_regulation_url":"http://www.legislature.mi.gov/(S(kb1t1tggl3kyt30iolbnnecg))/mileg.aspx?page=GetObject&objectname=mcl-330-1748","narrative_description_of_state_law":"Michigan permits the disclosure of information from a state program recipient's mental health record without authorization when disclosure is necessary to comply with another provision of law. [This could be read to include disclosure for treatment purposes]. When disclosing a recipient's mental health record without authorization, the disclosing party may only disclose the recipient's identity if it is germane to the purpose of the disclosure and, if practicable, limit disclosure to only the information germane to the purpose of disclosure.","definition_or_scope_of_information_material_covered_by_policy":"Records maintained by the Department of Health and Human Services, community mental health services, facilities, and contract providers regarding the provision of mental services to individual recipients (M.C.L.A. 330.1700)."},{"state":"Minnesota","state_abbreviation":"MN","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Mississippi","state_abbreviation":"MS","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Missouri","state_abbreviation":"MO","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Montana","state_abbreviation":"MT","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"Mont. Code. Ann. § 53-21-166","citation_of_statute_or_regulation_url":"http://leg.mt.gov/bills/mca/53/21/53-21-166.htm","narrative_description_of_state_law":"Montana authorizes health care providers to disclose a patient's health care information, without authorization, to any health care provider has previously provided services to the patient. Such disclosures must be limited to the extent the necessary to provide treatment and are prohibited if a patient requests that their provider not make such disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records and information obtained and maintained while providing services to persons with serious mental illness in accordance with Montana's mental health law (Mont. Code. Ann. § 53-21-166). Health care information. Defined as information related to a patient's health care that either identifies the patient or can identify the patient (Mont. Code Ann.§ 50-16-50 et seq.)."},{"state":"Nebraska","state_abbreviation":"NE","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nevada","state_abbreviation":"NV","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Hampshire","state_abbreviation":"NH","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"New Jersey","state_abbreviation":"NJ","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"N.J.S.A. § 30:4- 24.3/N.J.A.C. § 10:37–6.79/ N.J.A.C. 10:37G- 3.5/ N.J.A.C. 10:31–12.4","citation_of_statute_or_regulation_url":"http://www.state.nj.us/humanservices/providers/rulefees/regs/NJAC%2010_37%20Community%20Mental%20Health%20Svcs%20Act.doc","narrative_description_of_state_law":"New Jersey limits disclosures without authorization of information and records related to the community mental health program to those that are "relevant and necessary" to the purpose for disclosure. This limitation applies to disclosures for treatment purposes. The releasing agency may rely upon the requesting party's assertion of need when releasing information for treatment purposes so long as the individual hasn't executed an authorization that limits the scope of disclosure (N.J.A.C. § 10:37–6.79).; New Jersey allows short term care facility staff to disclose patient information to community mental health agencies, screening services, psychiatric facilities, or special psychiatric hospitals for treatment purposes. Such discloses are limited to the minimum necessary (NJAC 10:37G-3.5).","definition_or_scope_of_information_material_covered_by_policy":"Certificates, applications, records, and reports that identify or could identify a current or former recipient of mental health services at a noncorrectional institution (N.J.S.A. § 30:4-24.3) or through a community mental health program (NJAC § 10:37-6.79). Patient records maintained by short term care facilities (N.J.A.C. § 10:37G-3.3). Consumer records maintained by screening services; Screening is the process for assessing whether a person meets the requirements for an involuntary commitment (NJAC 10:31-12.1)."},{"state":"New Mexico","state_abbreviation":"NM","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"NM ST § 43-1-19/§ 32A-6A-24","citation_of_statute_or_regulation_url":"http://public.nmcompcomm.us/nmpublic/gateway.dll/?f=templates&fn=default.htm","narrative_description_of_state_law":"New Mexico permits the disclosure of a state mental health or developmental disability services client's confidential information without authorization to mental health or developmental disability professionals to the extent that these professionals need the information for practice, employment, or training purposes. Disclosure of a child's confidential information without authorization is permissible when the information is necessary for a clinician to treat the child (32A- 6A-24).","definition_or_scope_of_information_material_covered_by_policy":"Confidential information about a patient who is receiving mental health or developmental disability services which would allow a person familiar with the patient to identify the patient; Codes, numbers, or other items that would enable a person to match a patient to the patient's confidential information (NM ST 43-1-19). This information is also protected when it pertains to a patient under the age of 18 (NM ST 32A-6A-24)."},{"state":"New York","state_abbreviation":"NY","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"North Carolina","state_abbreviation":"NC","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"N.C. Gen. Stat. § 122C-51 et seq.","citation_of_statute_or_regulation_url":"http://www.ncleg.net/EnactedLegislation/Statutes/HTML/ByChapter/Chapter_122C.html","narrative_description_of_state_law":"Authorizes physicians, facilities, or other person responsible for treating, evaluating, managing, or supervising person committed to a state facility for outpatient services to disclose confidential information to the extent necessary to perform their duties.","definition_or_scope_of_information_material_covered_by_policy":"Confidential information. North Carolina defines confidential information as information about an individual that is obtained or generated by a facility in the course of performing a function of the facility. This definition does not include non-identifiable information regarding treatment that is used for training, treatment, and monitoring purposes or statistical information from reports (N.C. Gen. Stat. § 122C-3)."},{"state":"North Dakota","state_abbreviation":"ND","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Ohio","state_abbreviation":"OH","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oklahoma","state_abbreviation":"OK","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"43A Okl. St. Ann. § 109","citation_of_statute_or_regulation_url":"https://www.ok.gov/odmhsas/documents/2010%20-%2043A.pdf","narrative_description_of_state_law":"Oklahoma privileges mental health information and the communications between a patient and their physician or mental health professional. Providers may disclose such information and communications for treatment or related administrative purposes so long as the disclosure is limited to the minimum necessary to achieve the purpose of the disclosure.","definition_or_scope_of_information_material_covered_by_policy":"Mental health treatment information and communications between an individual and a physician or a mental health professional (43A Okl. St. Ann. § 109)."},{"state":"Oregon","state_abbreviation":"OR","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Pennsylvania","state_abbreviation":"PA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"50 P.S. § 7111/ 55 Pa. Code § 5100.32","citation_of_statute_or_regulation_url":"http://www.pacode.com/secure/data/055/chapter5100/s5100.32.html","narrative_description_of_state_law":"Persons that permissibly disclose mental health records without patient authorization must limit the disclosure to the information that is "relevant and necessary" to the purpose of the disclosure. This requirement applies to disclosures for treatment purposes.","definition_or_scope_of_information_material_covered_by_policy":"Documents regarding persons receiving mental health treatment on a voluntary or involuntary basis (50 PS 7111). Records of persons receiving mental health services from a facility (55 PA Code 5100.32). Facilities include mental health establishments, hospitals, clinics, institutions, and community mental health centers."},{"state":"Rhode Island","state_abbreviation":"RI","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Carolina","state_abbreviation":"SC","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"South Dakota","state_abbreviation":"SD","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Tennessee","state_abbreviation":"TN","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Texas","state_abbreviation":"TX","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Utah","state_abbreviation":"UT","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Vermont","state_abbreviation":"VT","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Virginia","state_abbreviation":"VA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Washington","state_abbreviation":"WA","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"West Virginia","state_abbreviation":"WV","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"No","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Wisconsin","state_abbreviation":"WI","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"W.S.A. 51.30","citation_of_statute_or_regulation_url":"https://docs.legis.wisconsin.gov/statutes/statutes/51/30","narrative_description_of_state_law":"All records of treatment for mental health, developmental disabilities, alcoholism, or drug dependence shall remain confidential and are privileged to the subject individual. Wisconsin permits the disclosure of mental health information without consent for certain listed treatment purposes and limited to the extent necessary, including disclosure to the Department of Health Services, the director of the county department, or qualified staff members when the information is necessary to assess the adequacy of treatment or the need to transfer the individual to another facility; within facilities between to the extent that the information is necessary to perform their duties, and within the Department to the extent necessary to coordinate mental health treatment.","definition_or_scope_of_information_material_covered_by_policy":"Registration and treatment records regarding persons receiving mental health services from treatment facilities, department contractors, county departments, psychologists, or mental health professionals that are not affiliated with a county department or treatment facility (W.S.A. 51.30)."},{"state":"Wyoming","state_abbreviation":"WY","consent_authorization_policy":"apply minimum necessary standard to treatment disclosures of mental health info","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"Yes","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"","citation_of_statute_or_regulation":"W.S.1977 § 9-2-125","citation_of_statute_or_regulation_url":"http://legisweb.state.wy.us/statutes/compress/title09.docx","narrative_description_of_state_law":"Wyoming permits a treatment facility to disclose an individual's mental health treatment records in connection with the individual's transfer to another facility. The transferring facility must limit disclosure to only the records necessary to enable the receiving facility to provide mental health services and any records required by law.","definition_or_scope_of_information_material_covered_by_policy":"Registration and treatment records regarding patients receiving mental health treatment at a treatment facility that is under contract with the Department of Health (W.S.1977 § 9-2-125)."},{"state":"Alabama","state_abbreviation":"AL","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"The provision does not address TPO authorization.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Alaska","state_abbreviation":"AK","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"AS § 47.30.845","citation_of_statute_or_regulation_url":"http://www.legis.state.ak.us/basis/statutes.asp#47.30.845","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records and information obtained while screening, evaluating, examining, or treating a person in accordance with Alaska's procedures for voluntary or involuntary commitment (AS § 47.30.845)."},{"state":"Arizona","state_abbreviation":"AZ","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Arkansas","state_abbreviation":"AR","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"California","state_abbreviation":"CA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"West's Ann.Cal.Welf. & Inst.Code § 5328","citation_of_statute_or_regulation_url":"http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=5328&lawCode=WIC","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures and some treatment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Information and records obtained while providing mental health services, developmental services, or community mental health services in accordance with California's Welfare and Institutions Code (West's Ann.Cal.Welf. & Inst.Code § 5328)."},{"state":"Colorado","state_abbreviation":"CO","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"C.R.S.A. § 27-65- 121","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Information and records obtained and prepared while providing services governed by Colorado's mental health code (C.R.S.A. § 27-65-121)."},{"state":"Connecticut","state_abbreviation":"CT","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Conn. Gen. Stat. §§ 52-146d","citation_of_statute_or_regulation_url":"https://www.cga.ct.gov/current/pub/chap_899.htm#sec_52-146d","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Communications and records relating to a psychiatrist's diagnosis or treatment of a patient (Conn. Gen. Stat. §§ 52- 146d)."},{"state":"Delaware","state_abbreviation":"DE","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"District of Columbia","state_abbreviation":"DC","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"D.C. Code §§ 7- 1201.01 et seq.","citation_of_statute_or_regulation_url":"http://doh.dc.gov/sites/default/files/dc/sites/doh/publication/attachments/MENTAL%20HEALTH%20INFORMATION.pdf","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Mental health information. The District of Columbia defines mental health information as identifiable diagnosis or treatment information obtained by a mental health professional while serving in a professional capacity (D.C. Code § 7-1201.01)."},{"state":"Florida","state_abbreviation":"FL","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"West's F.S.A. § 394.4615","citation_of_statute_or_regulation_url":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0300-0399/0394/Sections/0394.4615.html","narrative_description_of_state_law":"Authorization required by individual or personal representative for payment disclosures and some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Clinical records. Defined by Florida as medical records, charts, data, and other information regarding a patient's hospitalization or treatment in a facility that provides mental health services (West's F.S.A. § 394.455)."},{"state":"Georgia","state_abbreviation":"GA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Ga. Code. Ann., § 37-3-1661  GaComp. R. & Regs. 290-4-6-.05","citation_of_statute_or_regulation_url":"http://wwwlexisnexis.com/hottopics/gacode/;http://rules.sos.state.ga.us/GAC/290-4-6-.05","narrative_description_of_state_law":"Authorization required by individual or personal representative for payment disclosures and some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Clinical records. Georgia defines clinical records as written records maintained by facilities and other entities that provide treatment in accordance with Georgia's mental health law that include information about an individual's hospitalization and treatment (e.g., medical records, charts, admission data, etc.) (Ga. Code Ann., § 37-3-1)."},{"state":"Hawaii","state_abbreviation":"HI","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"HRS § 334-5/Haw. Admin. Rules (HAR) § 11-175-31","citation_of_statute_or_regulation_url":"http://health.hawaii.gov/opppd/files/2015/06/11-1751.pdf","narrative_description_of_state_law":"Authorization required by individual or personal representative for payment disclosures and some health care operations disclosures. Authorization by facility representative required for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Certificates, applications, records, and reports that directly or indirectly identify an individual and are generated, maintained, or disclosed by providers, health plans, or health care clearinghouses in accordance with Hawaii's mental health statute (HRS § 334-4)."},{"state":"Idaho","state_abbreviation":"ID","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Illinois","state_abbreviation":"IL","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Indiana","state_abbreviation":"IN","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"IC 16-39-2-6","citation_of_statute_or_regulation_url":"http://iga.in.gov/legislative/laws/2013/ic/titles/016/articles/039/chapters/002/pdf","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Mental health records maintained by providers of mental health services. The Division of Mental Health and Addiction, the Division of Disability and Rehabilitative Services, or the Indiana State Department of Health will define the content of these records by regulation. Mental health records maintained by private mental health institutions, hospitals, ambulatory outpatient surgical centers, abortion clinics, birthing centers, substance abuse services programs, and certain state institutions are not protected by this law (IC 16-39-2-2)."},{"state":"Iowa","state_abbreviation":"IO","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"I.C.A. § 228.5","citation_of_statute_or_regulation_url":"https://www.legis.iowa.gov/docs/code/2016/228.5.pdf","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Mental health information. Iowa defines mental health information as identifiable information in written, oral, or recorded form that pertains to an individual's receipt of mental health services (I.C.A. § 228.1)."},{"state":"Kansas","state_abbreviation":"KS","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"K.S.A.§ 59-2979","citation_of_statute_or_regulation_url":"http://www.ksrevisor.org/statutes/chapters/ch59/059_029_0079.html","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures and payment disclosures, as well as for treatment disclosures, which may be refused at the discretion of the facility director for certain reasons.","definition_or_scope_of_information_material_covered_by_policy":"Patient treatment records, court records, and medical records maintained by a district court or treatment facility. Kansas defines treatment facility as including mental health centers, clinics, a medical facility's psychiatric clinic, a state psychiatric hospital, or medical professionals licensed to provide inpatient or outpatient treatment. Patient refers to persons that have or are receiving mental health services either voluntarily or involuntarily. Patient also refers to a person in the process of being committed for involuntary treatment (K.S.A. § 59-2979)."},{"state":"Kentucky","state_abbreviation":"KY","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Louisiana","state_abbreviation":"LA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"La. Admin Code. tit. 48, pt. I, § 507","citation_of_statute_or_regulation_url":"http://www.doa.la.gov/osr/LAC/48v1/48v01.doc","narrative_description_of_state_law":"Authorization required by individual or personal representative for health care operations disclosures and payment disclosures. Authorization required by facility representative for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Medical information maintained by an agency. Louisiana defines medical information as records, documents, reports, and charts created by physicians, public hospital employees, psychiatrists, surgeons, public mental health facilities, and other public health facilities that pertain to an individual's physical or mental condition. Agency refers to mental health facilities, hospitals, intuitions, and other entities that are housed with the Department of Health and Human Resource and that use or maintain medical information (La. Admin Code. tit. 48, pt. I, § 503)."},{"state":"Maine","state_abbreviation":"ME","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"14-193 CMR Ch. 1, § IX/  14-472 CMR Ch. 1, § IX/ 34- M.R.S.A. § 1207","citation_of_statute_or_regulation_url":"https://www1.maine.gov/sos/cec/rules/14/193/193c001.docx;http://www.maine.gov/sos/cec/rules/10/chaps10.htm#193;http://legislature.maine.gov/statutes/34-B/title34-Bsec1207.html","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures. Authorization required by facility representative for payment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Medical records, administrative records, commitment orders, applications, and reports regarding persons that receive services from the Department of Behavioral and Developmental Services, a Department contractor, or state institution (34-B M.R.S.A. § 1207). Information related to a person or child's mental health care and treatment (14-193 CMR Ch. 1, § IX and 14-472 CMR Ch. 1, § IX)."},{"state":"Maryland","state_abbreviation":"MD","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Md. Gen. Health. § 4-307","citation_of_statute_or_regulation_url":"http://mgaleg.maryland.gov/webmga/frmStatutesText/aspx?article=ghg&section=4-307&ext=html&session=2015RS&tab=subject5","narrative_description_of_state_law":"Authorization required by health care provider for some treatment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Medical records. Maryland defines medical records as information about a patient or recipient's health care that is entered into a record and identifies or can lead to the identification of a patient. Recipient refers to a person that has applied for or is receiving mental health services (MD Code, Health - General, § 4-307)."},{"state":"Massachusetts","state_abbreviation":"MA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"104 CMR 27.17/ M.G.L.A. 123 § 36","citation_of_statute_or_regulation_url":"https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXVII/Chapter123/Section36","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records maintained by the Department of Mental Health regarding the admission and treatment of persons admitted to facilities supervised by the Department (M.G.L.A. 123 §§ 36, 36B Ch. 123); "Individual records" maintained by mental health facilities (104 CMR 27.17)."},{"state":"Michigan","state_abbreviation":"MI","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"M.C.L.A. § 330.1748","citation_of_statute_or_regulation_url":"http://www.legislature.mi.gov/(S(kb1t1tggl3kyt30iolbnnecg)/mileg.aspx?page=GetObject&objectname=mcl-330-1748","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures and some payment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records maintained by the Department of Health and Human Services, community mental health services, facilities, and contract providers regarding the provision of mental services to individual recipients (M.C.L.A. 330.1700)."},{"state":"Minnesota","state_abbreviation":"MN","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"M.S.A. § 144.293","citation_of_statute_or_regulation_url":"https://www.revisor.mn.gov/statutes/?id=144.293","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO  disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Health records. Defined by Minnesota as information regarding and individual's past, current, or future mental health or physical condition, receipt of health care, or payment for health care (M.S.A. § 144.291)."},{"state":"Mississippi","state_abbreviation":"MS","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Miss. Code Ann. § 41-21-972","citation_of_statute_or_regulation_url":"http://www.lexisnexis.com/hottopics/mscode/","narrative_description_of_state_law":"Authorization required by individual or personal representative for payment disclosures and some health care operations disclosures. Authorization required by facility representative for some payment and health care operations purposes.","definition_or_scope_of_information_material_covered_by_policy":"Records and information regarding the patients of treatment facilities and persons receiving mental health treatment from physicians, psychologists, social workers, or professional counselors (Miss. Code Ann. § 41-21-97)."},{"state":"Missouri","state_abbreviation":"MO","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Mo. Rev. Stat. § 630.140","citation_of_statute_or_regulation_url":"http://www.moga.mo.gov/mostatutes/stathtml/63000001401.HTML","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records and information obtained or maintained by residential facilities, department of mental health programs, or mental health facilities or programs that civilly detain persons (V.A.M.S. 630.140)."},{"state":"Montana","state_abbreviation":"MT","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Nebraska","state_abbreviation":"NE","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"Neb. Rev. Stat. § 71-961/ Neb. Rev. Stat. § 38-2136","citation_of_statute_or_regulation_url":"http://nebraskalegislature.gov/laws/statutes.php?statute=71-961;http://nebraskalegislature.gov/laws/statutes.php?statute=38-2136","narrative_description_of_state_law":"Authorization required by individual or personal representative for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records regarding persons committed pursuant to Nebraska's Mental Health Commitment Act (Neb. Rev. Stat. § 71-961). Information acquired by a mental health practitioner from their client or patient (Neb. Rev. Stat. § 38-2136)."},{"state":"Nevada","state_abbreviation":"NV","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"N.R.S. 433A.360","citation_of_statute_or_regulation_url":"https://www.leg.state.nv.us/NRS/NRS-433A.html#NRS433ASec360","narrative_description_of_state_law":"Authorization required by individual or personal representative for payment disclosures and some health care operations disclosures. Authorization required by facility representative for some treatment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Clinical records regarding persons receiving mental health services from a state facility, private institution, or a facility that provides community-based or outpatient services (N.R.S. 433A.360)."},{"state":"New Hampshire","state_abbreviation":"NH","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"N.H. Rev. Stat. § 135-C:19-a","citation_of_statute_or_regulation_url":"http://www.gencourt.state.nh.us/rsa/html/X/135-C/135-C-19-a.htm","narrative_description_of_state_law":"Authorization required by individual or personal representative for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Mental health treatment, diagnosis, and admission information maintained by state mental health facilities or community health centers (N.H. Rev. Stat. § 135-C:2)."},{"state":"New Jersey","state_abbreviation":"NJ","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"N.J.S.A. § 30:4- 24.3/N.J.A.C. § 10:37–6.79/ N.J.A.C. 10:37G- 3.5/ N.J.A.C. 10:31–12.4","citation_of_statute_or_regulation_url":"http://lis.njleg.state.nj.us/cgi-bin/om_isapi.dll?clientID=463992&Depth=4&TD=WRAP&advquery=%2230%3a4-24.3%22&headingswithhits=on&infobase=statutes.nfo&rank=&record=%7bC224%7d&softpage=Doc_Frame_Pg42&wordsaroundhits=2&x=0&y=0&zz=;http://www.state.nj.us/humanservices/providers/rulefees/regs/NJAC%2010_37%20Community%20Mental%20Health%20Svcs%20Act.doc;http://www.state.nj.us/humanservices/providers/rulefees/regs/NJAC%2010_31%20Screening%20and%20Screening%20Outreach%20Program.doc","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Certificates, applications, records, and reports that identify or could identify a current or former recipient of mental health services at a noncorrectional institution (N.J.S.A. § 30:4-24.3) or through a community mental health program (NJAC § 10:37-6.79). Patient records maintained by short term care facilities (N.J.A.C. § 10:37G-3.3). Consumer records maintained by screening services; Screening is the process for assessing whether a person meets the requirements for an involuntary commitment (NJAC 10:31-12.1)."},{"state":"New Mexico","state_abbreviation":"NM","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"NM ST § 43-1-19/§ 32A-6A-24","citation_of_statute_or_regulation_url":"http://public.nmcompcomm.us/nmpublic/gateway.dll/?f=template&fndefault.htm","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Confidential information about a patient who is receiving mental health or developmental disability services which would allow a person familiar with the patient to identify the patient; Codes, numbers, or other items that would enable a person to match a patient to the patient's confidential information (NM ST 43-1-19). This information is also protected when it pertains to a patient under the age of 18 (NM ST 32A-6A-24)."},{"state":"New York","state_abbreviation":"NY","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"McKinney's Mental Hygiene Law § 33.13","citation_of_statute_or_regulation_url":"http://public.leginfo.state.ny.us/lawssrch.cgi?NVLWO:","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures. Authorization by Government representative for payment disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Clinical records. New York defines clinical records as including information regarding a patient or client's care, treatment, admission, or legal status (McKinney's Mental Hygiene Law § 33.13)."},{"state":"North Carolina","state_abbreviation":"NC","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"N.C. Gen. Stat. § 122C-51 et seq.","citation_of_statute_or_regulation_url":"http://www.ncleg.net/EnactedLegislation/Statutes/HTML/ByChapter/Chapter_122C.html","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Confidential information. North Carolina defines confidential information as information about an individual that is obtained or generated by a facility in the course of performing a function of the facility. This definition does not include non- identifiable information regarding treatment that is used for training, treatment, and monitoring purposes or statistical information from reports (N.C. Gen. Stat. § 122C-3)."},{"state":"North Dakota","state_abbreviation":"ND","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"NDCC § 23-01.3-01 et seq.","citation_of_statute_or_regulation_url":"http://www.legis.nd.gov/cencode/t23c01-3.pdf","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Protected health information. North Dakota defines protected health information as including information about an individual's past, current, or future mental or physical condition (NDCC, 23-01.3-01)."},{"state":"Ohio","state_abbreviation":"OH","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oklahoma","state_abbreviation":"OK","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Oregon","state_abbreviation":"OR","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Pennsylvania","state_abbreviation":"PA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"50 P.S. § 7111/ 55 Pa. Code § 5100.32","citation_of_statute_or_regulation_url":"https://govt.westlaw.com/pac/Document/NAEB8FB70344411DA8A989F4EECDB8638?viewType=FullText&originationContext=documenttoc&transitionType=CategoryPageItem&contextData=(sc.Default);http://pacode.com/secure/data/055/chapter5100/s5100.32.html","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations purposes.","definition_or_scope_of_information_material_covered_by_policy":"Documents regarding persons receiving mental health treatment on a voluntary or involuntary basis (50 PS 7111). Records of persons receiving mental health services from a facility (55 PA Code 5100.32). Facilities include mental health establishments, hospitals, clinics, institutions, and community mental health centers."},{"state":"Rhode Island","state_abbreviation":"RI","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"R.I. Gen. Laws 1956, § 40.1-5-26","citation_of_statute_or_regulation_url":"http://webserver.rilin.state.ri.us/Statutes/TITLE40.1/40.1-5/40.1-5-26.HTM","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Information and records generated while providing services pursuant to Rhode Island's mental health law, including fact of admission or certification (R.I. Gen. Laws 1956, § 40.1-5-26)."},{"state":"South Carolina","state_abbreviation":"SC","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"S.C. Ann. Code § 44-22-100","citation_of_statute_or_regulation_url":"http://www.scstatehouse.gov/code/t44c022.php","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records, applications, certificates, and reports that directly or indirectly identify a patient receiving mental health or substance abuse treatment and are generated in accordance with South Carolina's mental health law (S.C. Ann. Code § 44-22-100)."},{"state":"South Dakota","state_abbreviation":"SD","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"SDCL § 27A-12-25 et seq.","citation_of_statute_or_regulation_url":"http://www.sdlegislature.gov/Statutes/Codified_Laws/DisplayStatute.aspx?Type=Statute&Statute=27A-12-25","narrative_description_of_state_law":"Authorization by facility representative required for some TPO disclosures. Authorization by Government representative required for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Medical records of persons receiving mental health services in accordance with South Dakota's mental health law (SDCL § 27A-12-25 et seq.)."},{"state":"Tennessee","state_abbreviation":"TN","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"T.C.A. §§ 33-3-103 et seq.3","citation_of_statute_or_regulation_url":"http://www.lexisnexis.com/hottopics/tncode","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records, applications, reports, and legal documents that directly or indirectly identify a person who received or is receiving services regulated by Tennessee's mental health law (T. C. A. § 33-3-103)."},{"state":"Texas","state_abbreviation":"TX","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"V.T.C.A., Health & Safety Code § 611.001 et seq.","citation_of_statute_or_regulation_url":"http://www.statutes.legis.state.tx.us/Docs/HS/htm/HS.611.htm#611.004","narrative_description_of_state_law":"Authorization required by individual or personal representative for some health care operations disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records maintained by professionals regarding the identity, treatment, or diagnosis of their patient and communications between professionals and their patients. Texas defines professional as including persons licensed to practice medicine and persons licensed to evaluate, diagnose, and treat mental or emotion conditions or disorders (V.T.C.A., Health & Safety Code §§ 611.001-611.002)."},{"state":"Utah","state_abbreviation":"UT","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"U.C.A § 62A-15- 643/U.C.A. § 62A- 15-707/U.A.C. R432-101","citation_of_statute_or_regulation_url":"https://le.utah.gov/xcode/Title62A/Chapter15/62A-15-S643.html?v=C62A-15-S643_1800010118000101;https://le.utah.gov/xcode/Title62A/Chapter15/62A-15-S707.html?v=C62A-15-S707_1800010118000101;http://utrules.elaws.us/uac/r432-101-22","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records, reports, applications, and legal documents that directly or indirectly identify a current or form patient and are made in accordance with Utah's mental health laws (U.C.A § 62A-15-643/U.C.A. § 62A-15-707/U.A.C. R432-101)."},{"state":"Vermont","state_abbreviation":"VT","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"18 V.S.A. § 7103","citation_of_statute_or_regulation_url":"http://legislature.vermont.gov/statutes/section/18/171/07103","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Records, reports, applications, and certificates that directly or indirectly identify a current or former patient and are generated in accordance with Vermont's mental health law (18 V.S.A. § 7103)."},{"state":"Virginia","state_abbreviation":"VA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"No","citation_of_statute_or_regulation":"","citation_of_statute_or_regulation_url":"","narrative_description_of_state_law":"State does not require additional authorization for TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":""},{"state":"Washington","state_abbreviation":"WA","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"West's RCWA 70.02.230","citation_of_statute_or_regulation_url":"http://app.leg.wa.gov/rcw/default.aspx?Cite=70.02.230","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Information and records created or obtained while providing mental health services, including fact of admission (West's RCWA 70.02.030)."},{"state":"West Virginia","state_abbreviation":"WV","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"W. Va. Code, § 27- 3-1","citation_of_statute_or_regulation_url":"http://www.legis.state.wv.us/wvcode/ChapterEntire.cfm?chap=27","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Communications and information regarding the treatment or evaluation of a patient or client (W. Va. Code, § 27-3-1)."},{"state":"Wisconsin","state_abbreviation":"WI","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"W.S.A. 51.30","citation_of_statute_or_regulation_url":"https://docs.legis.wisconsin.gov/statutes/statutes/51/30","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Registration and treatment records regarding persons receiving mental health services from treatment facilities, department contractors, county departments, psychologists, or mental health professionals that are not affiliated with a county department or treatment facility (W.S.A. 51.30)."},{"state":"Wyoming","state_abbreviation":"WY","consent_authorization_policy":"require auth to disclose mental health info for TPO","organization_launch_date":"","type_of_consent_policy":"","details_of_consent_policy":"","patient_notification_methods":"","additional_information":"","websites_and_publicly_available_resources":"","scope_of_consent_policy":"","source_of_consent_policy":"","source_of_consent_policy_url":"","state_involvement_in_creating_consent_policy_if_source_is_not_a_statute_regulation":"","statewide_applicability_y_n":"","applies_minimum_necessary_standard_to_treatment_disclosures":"","requires_authorization_for_one_or_more_tpo_disclosures_that_would_be_permitted_under_hipaa_without_authorization":"Yes","citation_of_statute_or_regulation":"W.S.1977 § 9-2-125","citation_of_statute_or_regulation_url":"http://legisweb.state.wy.us/statutes/compress/title09.docx","narrative_description_of_state_law":"Authorization required by individual or personal representative for some TPO disclosures.","definition_or_scope_of_information_material_covered_by_policy":"Registration and treatment records regarding patients receiving mental health treatment at a treatment facility that is under contract with the department (W.S.1977 § 9-2-125)."}]