Chapter 191: PROTECTED HEALTH CARE INFORMATION EXCHANGES

191.01 Definitions.

As used in this chapter:

(A) "Administrative safeguards," "availability," "confidentiality," "integrity," "physical safeguards," and "technical safeguards" have the same meanings as in 45 C.F.R. 164.304.

(B) "Business associate," "covered entity," "health plan," "individually identifiable health information," and "protected health information" have the same meanings as in 45 C.F.R. 160.103.

(C) "Executive director of the office of health transformation" or "executive director" means the executive director of the office of health transformation or the chief administrative officer of a successor governmental entity responsible for health system oversight in this state.

(D) "Government program providing public benefits" means any program administered by a state agency that has been identified, pursuant to section 191.02 of the Revised Code, by the executive director of the office of health transformation in consultation with the individuals specified in that section.

(E) "Office of health transformation" means the office of health transformation created by executive order 2011-02K.

(F) "Operating protocol" means a protocol adopted by the executive director of the office of health transformation or the executive director's designee under division (D) of section 191.06 of the Revised Code.

(G) "Participating agency" means a state agency that participates in a health transformation initiative as specified in the one or more operating protocols adopted for the initiative under division (D) of section 191.06 of the Revised Code.

(H) "Personally identifiable information" means information that meets both of the following criteria:

(1) It identifies an individual or there is a reasonable basis to believe that it may be used to identify an individual;

(2) It relates to an individual's eligibility for, application for, or receipt of public benefits from a government program providing public benefits.

(I) "State agency" means each of the following:

(1) The department of administrative services;

(2) The department of aging;

(3) The development services agency;

(4) The department of developmental disabilities;

(5) The department of education;

(6) The department of health;

(7) The department of insurance;

(8) The department of job and family services;

(9) The department of medicaid;

(10) The department of mental health and addiction services;

(11) The department of rehabilitation and correction;

(12) The department of taxation;

(13) The department of veterans services;

(14) The department of youth services;

(15) The opportunities for Ohioans with disabilities agency.

(J) "Unsecured" has the same meaning as in 16 C.F.R. 318.2.

Amended by 130th General Assembly File No. TBD, HB 483, §101.01, eff. 9/15/2014.

Amended by 130th General Assembly File No. 25, HB 59, §101.01, eff. 9/29/2013.

Added by 129th General AssemblyFile No.127, HB 487, §101.01, eff. 9/10/2012.

191.02 Identification of pertinent programs.

The executive director of the office of health transformation, in consultation with all of the following individuals, shall identify each government program administered by a state agency that is to be considered a government program providing public benefits for purposes of sections 191.04 and 191.08 of the Revised Code:

(A) The director of administrative services;

(B) The director of aging;

(C) The director of development services;

(D) The director of developmental disabilities;

(E) The director of health;

(F) The director of job and family services;

(G) The medicaid director;

(H) The director of mental health and addiction services;

(I) The director of rehabilitation and correction;

(J) The director of veterans services;

(K) The director of youth services;

(L) The executive director of the opportunities for Ohioans with disabilities agency;

(M) The administrator of workers' compensation;

(N) The superintendent of insurance;

(O) The superintendent of public instruction;

(P) The tax commissioner.

Amended by 130th General Assembly File No. 50, SB 206, §1, eff. 3/20/2014.

Amended by 130th General Assembly File No. 25, HB 59, §101.01, eff. 9/29/2013.

Added by 129th General AssemblyFile No.127, HB 487, §101.01, eff. 9/10/2012.

191.04 Exchange of protected health care information.

(A) In accordance with federal laws governing the confidentiality of individually identifiable health information, including the "Health Insurance Portability and Accountability Act of 1996," 104 Pub. L. No. 191, 110 Stat. 2021, 42 U.S.C. 1320d et seq., as amended, and regulations promulgated by the United States department of health and human services to implement the act, a state agency may exchange protected health information with another state agency relating to eligibility for or enrollment in a health plan or relating to participation in a government program providing public benefits if the exchange of information is necessary for either or both of the following:

(1) Operating a health plan;

(2) Coordinating, or improving the administration or management of, the health care-related functions of at least one government program providing public benefits.

(B) For fiscal years 2013, 2014, and 2015 only, a state agency also may exchange personally identifiable information with another state agency for purposes related to and in support of a health transformation initiative identified by the executive director of the office of health transformation pursuant to division (C) of section 191.06 of the Revised Code.

(C) With respect to a state agency that uses or discloses personally identifiable information, all of the following conditions apply:

(1) The state agency shall use or disclose the information only as permitted or required by state and federal law. In addition, if the information is obtained during fiscal year 2013, 2014, or 2015 from an exchange of personally identifiable information permitted under division (B) of this section, the agency shall also use or disclose the information in accordance with all operating protocols that apply to the use or disclosure.

(2) If the state agency is a state agency other than the department of medicaid and it uses or discloses protected health information that is related to a medicaid recipient and obtained from the department of medicaid or another agency operating a component of the medicaid program, the state agency shall comply with all state and federal laws that apply to the department of medicaid when that department, as the state's single state agency to supervise the medicaid program , uses or discloses protected health information.

(3) A state agency shall implement administrative, physical, and technical safeguards for the purpose of protecting the confidentiality, integrity, and availability of personally identifiable information the creation, receipt, maintenance, or transmittal of which is affected or governed by this section.

(4) If a state agency discovers an unauthorized use or disclosure of unsecured protected health information or unsecured individually identifiable health information, the state agency shall, not later than seventy-two hours after the discovery, do all of the following:

(a) Identify the individuals who are the subject of the protected health information or individually identifiable health information;

(b) Report the discovery and the names of all individuals identified pursuant to division (C)(4)(a) of this section to all other state agencies and the executive director of the office of health transformation or the executive director's designee;

(c) Mitigate, to the extent reasonably possible, any potential adverse effects of the unauthorized use or disclosure.

(5) A state agency shall make available to the executive director of the office of health transformation or the executive director's designee, and to any other state or federal governmental entity required by law to have access on that entity's request, all internal practices, records, and documentation relating to personally identifiable information it receives, uses, or discloses that is affected or governed by this section.

(6) On termination or expiration of an operating protocol and if feasible, a state agency shall return or destroy all personally identifiable information received directly from or received on behalf of another state agency. If the personally identifiable information is not returned or destroyed, the state agency maintaining the information shall extend the protections set forth in this section for as long as it is maintained.

(7) If a state agency enters into a subcontract or, when required by 45 C.F.R. 164.502(e)(2), a business associate agreement, the subcontract or business associate agreement shall require the subcontractor or business associate to comply with the terms of this section as if the subcontractor or business associate were a state agency.

Amended by 130th General Assembly File No. 25, HB 59, §101.01, eff. 9/29/2013.

Added by 129th General AssemblyFile No.127, HB 487, §101.01, eff. 9/10/2012.

191.06 Authority of executive director to facilitate coordination of operations and exchange of information between state agencies.

(A) The provisions of this section shall apply only for fiscal years 2013, 2014, and 2015.

(B) The executive director of the office of health transformation or the executive director's designee may facilitate the coordination of operations and exchange of information between state agencies. The purpose of the executive director's authority under this section is to support agency collaboration for health transformation purposes, including modernization of the medicaid program, streamlining of health and human services programs in this state, and improving the quality, continuity, and efficiency of health care and health care support systems in this state.

(C) In furtherance of the authority of the executive director of the office of health transformation under division (B) of this section, the executive director or the executive director's designee shall identify each health transformation initiative in this state that involves the participation of two or more state agencies and that permits or requires an interagency agreement to be entered into for purposes of specifying each participating agency's role in coordinating, operating, or funding the initiative, or facilitating the exchange of data or other information for the initiative. The executive director shall publish a list of the identified health transformation initiatives on the internet web site maintained by the office of health transformation.

(D) For each health transformation initiative that is identified under division (C) of this section, the executive director or the executive director's designee shall, in consultation with each participating agency, adopt one or more operating protocols. Notwithstanding any law enacted by the general assembly or rule adopted by a state agency, the provisions in a protocol shall supersede any provisions in an interagency agreement, including an interagency agreement entered into under section 5101.10 or 5162.35 of the Revised Code, that differ from the provisions of the protocol.

(E)

(1) An operating protocol adopted under division (D) of this section shall include both of the following:

(a) All terms necessary to meet the requirements of "other arrangements" between a covered entity and a business associate that are referenced in 45 C.F.R. 164.314(a)(2)(ii);

(b) If known, the date on which the protocol will terminate or expire.

(2) In addition, a protocol may specify the extent to which each participating agency is responsible and accountable for completing the tasks necessary for successful completion of the initiative, including tasks relating to the following components of the initiative:

(a) Workflow;

(b) Funding;

(c) Exchange of data or other information that is confidential pursuant to state or federal law.

(F) An operating protocol adopted under division (D) of this section shall have the same force and effect as an interagency agreement or data sharing agreement, and each participating agency shall comply with it.

Amended by 130th General Assembly File No. 25, HB 59, §101.01, eff. 9/29/2013.

Added by 129th General AssemblyFile No.127, HB 487, §101.01, eff. 9/10/2012.

191.08 Adoption of employment strategies.

The executive director of the office of health transformation shall adopt strategies that prioritize employment as a goal for individuals participating in government programs providing public benefits.

Added by 130th General Assembly File No. 50, SB 206, §1, eff. 3/20/2014.