Home Table of Contents

§ 126060. Requests to Develop Alternative Requirements.

22 CA ADC § 126060Barclays Official California Code of Regulations

Barclays California Code of Regulations
Title 22. Social Security
Division 14. California Office of Health Information Integrity
Chapter 1. Demonstration Projects for the Electronic Exchange of Health Information
22 CCR § 126060
§ 126060. Requests to Develop Alternative Requirements.
Currentness
(a) An Applicant may request to demonstrate an alternative requirement from those stated in sections 126050, 126055, 126070, 126072, 126074, and 126076, if the Applicant is currently unable to comply with the requirement or has an alternative policy that it wants to test. All requests to develop alternative requirements must be submitted to CalOHII in writing, and include:
(1) The reason for the request.
(2) All supporting documentation, such as:
(A) If the reason is related to implementation delays, state the timeframe in which the requirement will be implemented.
(B) A description of, and copies of:
(i) Alternate privacy and security provisions that would provide similarly adequate compliance with the California Health Information Exchange Practices Principles,
(ii) Clear delineation of the purpose and the roles of those who may have access to the individual health information and any permitted subsequent use of the information, and
(iii) Information on the governance structure and evaluation of security compliance.
(b) In granting requests to develop alternative requirements, CalOHII will consider, but is not limited to the following factors:
(1) General factors:
(A) The proposal will advance the knowledge and development of privacy and security standards in a new area;
(B) Alternative requirements can provide similar compliance with the principles, without jeopardizing privacy and security of IHI;
(C) Patient safety concerns are significant;
(D) The technology is not readily available; and/or
(E) Insufficient benefit to individual privacy interests as compared to the costs or other legitimate burdens that would be incurred.
(2) Purpose limitations requirements in § 126050
(A) The purpose is consistent with State law and not preempted by HIPAA;
(B) The Applicant can demonstrate adequate oversight to ensure no further disclosure or use of IHI unless the secondary use is consistent with the Civil Code sections 56.10, 56.13, 56.30 and more stringent laws; and
(C) If de-identified data is being used or generated, the recipients of the data are known.
(3) Informing and Consent requirements in § 126055
(A) For HIO and independent directed exchanges of IHI:
(i) The circumstances ensure that patients or their representatives are made aware that IHI is being disclosed, to whom and for what purpose, and whether they have the right to refuse and if they so choose the option to not permit their health information to be disclosed, what are the possible consequences to them;
(ii) The data being disclosed, whether it is considered sensitive health information, and whether the disclosure is narrowly tailored to the need for the information.
(B) For independent directed exchanges, in addition to paragraph (A):
(i) The disclosure is made to another CMIA provider;
(ii) The disclosure is by means of a secure transaction;
(iii) The other CMIA provider has a current treating relationship with the patient;
(iv) The disclosure does not contain sensitive health information nor is the information about another individual; and
(vi) There is no re-purposing or re-directing of the information.
(4) Security Controls requirements in § 126070-126076
(A) Adequacy of the alternative security controls in addressing the particular circumstance; and
(B) Whether the proposed security provision is consistent with a mandatory HIPAA provision.
(c) CalOHII shall document in writing each grant of a request to demonstrate an alternative requirement within forty-five (45) days of the receipt of the DAR at CalOHII, and will make the request and a summary of the basis for the decision publicly available.
(1) In cases where a DAR is submitted with insufficient information for CalOHII to determine approval, a 15 day extension period may be provided to CalOHII to collect information and documentation in order to make a determination.

Credits

Note: Authority cited: Sections 130277 and 130278, Health and Safety Code. Reference: Sections 130200, 130277 and 130279, Health and Safety Code.
History
1. New section filed 1-31-2012; operative 1-31-2012. Exempt from the rulemaking requirements of the Administrative Procedure Act and submitted to OAL for printing only pursuant to Health and Safety Code section 130278 (Register 2012, No. 5).
This database is current through 4/26/24 Register 2024, No. 17.
Cal. Admin. Code tit. 22, § 126060, 22 CA ADC § 126060
End of Document