25 CAR § 20-111. Requests for restrictions

(a) Scope and applicability. This policy applies to all participating entities. (b) Recipient responsibility. A participating entity, when accessing the State Health Alliance for Records Exchange shall not be expected to know of or comply with a restriction on use or disclosure agreed to by a participating entity that provides data. (c) Data provider responsibility. (1)(A) If a participating entity agrees to an individual's request for restrictions, as permitted under the HIPAA privacy rule, such participating entity shall ensure that it complies with the restrictions when releasing information through the State Health Alliance for Records Exchange. (B) This shall include not exchanging the individual's protected health information through the State Health Alliance for Records Exchange and opting the individual out of the State Health Alliance for Records Exchange, if required by the restriction. (C) Participating entities should advise individuals that opting out only affects access, use, and disclosure of their protected health information through the State Health Alliance for Records Exchange. (2) If an agreed-upon restriction will or could affect the requesting institution's uses and/or disclosures of health information, at the time of disclosure, the participant disclosing such health information shall notify the requesting institution of the fact that certain information has been restricted, without disclosing the content of any such restriction. (3) When evaluating a request for a restriction, the participating entity shall consider the implications that agreeing to the restriction would have on the accuracy, integrity, and availability of information through the State Health Alliance for Records Exchange.