(a) During the demonstration project, authorized CalOHII representatives may audit Demonstration Project Participants for compliance with these regulations, applicable state and federal law for the protection of individual privacy and the confidentiality of electronic health records with appropriate notice to the Demonstration Project Participant. An audit may include, but is not limited to inspection of:
(1) Privacy and security policies and procedures
(2) Adequacy of the consent informing process
(3) Training documentation
(4) Business associate agreements
(5) Participant Agreements
(6) Operations of the demonstration project, including impact of demonstration of alternative requirements.
(b) The Demonstration Project Participant must provide CalOHII with any and all requested documentation pertaining to 126090(a) within 10 business days of the receipt of the request or other time frame negotiated by the parties.
(c) CalOHII may conduct a site visit to observe operations of the demonstration project and compliance with these regulations.
(d) If CalOHII determines a Demonstration Project Participant is not in compliance with these regulations, a notice of non-compliance will be issued.
(1) A Demonstration Project Participant receiving a notice of non-compliance shall submit a plan of correction to CalOHII within 10 business days of the receipt of the notice of non-compliance.
(A) If CalOHII determines the plan of correction does not adequately address the identified instances of non-compliance, it may reject the plan of correction and request a Demonstration Project Participant to modify the plan of correction and resubmit within 5 business days.
(2) CalOHII may terminate a Demonstration Project Participant from remaining in a demonstration project or may terminate a demonstration project in its entirety if:
(A) CalOHII determines a Demonstration Project Participant has not adequately addressed identified areas of non-compliance; or
(B) If the Demonstration Project Participant has not complied with an accepted plan of correction; or
(C) If the non-compliance with the regulations is so egregious as to imminently threaten the security or privacy of the health information held by the Demonstration Project Participant.
(3) In the event of a termination, termination of a Demonstration Project Participant or the demonstration project shall occur in an orderly fashion balancing patient health and safety with any time constraints in the Participant's Agreements with their HIO or other data sharing arrangements.
Credits
Note: Authority cited: Sections 130277 and 130278, Health and Safety Code. Reference: Section 11180 et seq., Government Code; and Sections 130200, 130277 and 130279, Health and Safety Code.
1. New section filed 1-31-2012; operative 1-31-2012. Exempt from the rulemaking requirements of the Administrative Procedure Act and submitted to OAL for printing only pursuant to Health and Safety Code section 130278 (Register 2012, No. 5).
This database is current through 4/26/24 Register 2024, No. 17.
Cal. Admin. Code tit. 22, § 126090, 22 CA ADC § 126090
