LAC 48:I.607. Treatment of Protected Health Information

A. For both emergency preparedness training activities and actual public health emergency events, the health care provider shall upload patient protected health information (PHI) to the Louisiana AtRisk Registry. 1. The Louisiana AtRisk Registry shall maintain PHI on a secure File Transfer Protocol (FTP) server. 2. After an event or training, all data uploaded to the Louisiana AtRisk Registry FTP server shall be deleted and be non-recoverable. B. Access to PHI on the Louisiana AtRisk Registry shall be limited to the following entities. 1. Louisiana Department of Health (LDH) shall have access to all patient PHI in the Louisiana AtRisk Registry throughout the state. 2. The Regional Disaster Recovery Center (DRC) shall have access to PHI for patients within its region. 3. Enrolled hospitals shall have access only to its patient’s PHI. If a patient is transferred to another hospital, both the sending and receiving hospitals shall have access to the patient’s PHI. 4. Enrolled hospice and home health agencies shall have access only to its patient’s PHI. 5. The Louisiana-Mississippi Hospice and Palliative Care Organization (LMHPCO) shall have access to PHI of patients of all enrolled hospice and home health agencies.