Section 216-RICR-10-10-6.2 - DefinitionsA. Wherever used in this Part, the following terms shall be construed as follows:1. "Act" means R.I. Gen. Laws Chapter 5-37.7 entitled, "The Rhode Island Health Information Exchange Act of 2008."2. "Administrative review" means the administrative processes contained in Practices and Procedures Before the Rhode Island Department of Health (Subchapter 05 Part 4 of this Chapter), and as otherwise permitted by the Administrative Procedures Act.3. "Authorized representative" means: a. A person empowered by the patient participant to assert or to waive confidentiality, or to disclose or authorize the disclosure of confidential information, as established by this Part. That person is not, except by explicit authorization, empowered to waive confidentiality or to disclose or consent to the disclosure of confidential information; orb. A person appointed by the patient participant to make health care decisions on his or her behalf through a valid durable power of attorney for health care as set forth in R.I. Gen. Laws § 23-4.10-2; orc. A guardian or conservator, with authority to make health care decisions, if the patient participant is decisionally impaired; ord. Another legally appropriate medical decision maker, temporarily, if the patient participant is decisionally impaired and no health care agent, guardian or conservator is available; ore. If the patient participant is deceased, his or her personal representative or, in the absence of that representative, his or her heirs-at-law; orf. A parent with the authority to make health care decisions for the parent's child; org. A person authorized by the patient participant or their authorized representative to access their confidential health information from the HIE, including family members or other proxies as designated by the patient, to assist patient participant with the coordination of their care.4. "Business associate" means a business associate as defined by HIPAA, and its implementing Regulations (45 C.F.R. Parts 160 through 164).5. "Confidential health information" means all identifiable information relating to a patient participant's health care history, diagnosis, condition, treatment, or evaluation.6. "Data submitting partner" means an individual, organization or entity that has entered into a business associate agreement with the RHIO and submits patient participants' confidential health information through the HIE.7. "Department" means the Rhode Island Department of Health.8. "Director" means the Director of the Rhode Island Department of Health or his or her designee(s).9. "Disclosure report" means a report generated by the HIE relating to the record of access to, review of and/or disclosure of a patient's confidential health information received, accessed or held by the HIE.10. "Electronic mobilization" means the capability to move clinical information electronically between disparate health information systems while maintaining the accuracy of the information being exchanged.11. "Emergency" means the sudden onset of a medical, mental, or substance use, or other condition manifesting itself by acute symptoms of severity (e.g., severe pain) where the absence of medical attention could reasonably be expected, by a prudent layperson, to result in placing the patient's health in serious jeopardy, serious impairment to bodily or mental functions, or serious dysfunction of any bodily organ or part.12. "Gender markers" means the sex or gender designation recorded in a patient's medical records.13. "Health care provider" means any person or entity licensed by this State to provide or lawfully providing health care services, including, but not limited to, a physician, hospital, intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist, physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer, employee, or agent of that provider acting in the course and scope of his or her employment or agency related to or supportive of health care services.14. "Health care services" means acts of diagnosis, treatment, medical evaluation, referral or counseling or any other acts that may be permissible under the health care licensing statutes of this State.15. "Health Information Exchange" or "HIE" means the technical system operated by the RHIO under State authority allowing for the statewide electronic mobilization of confidential health information, pursuant to the Act and this Part.16. "Health plan" means an individual plan or a group plan that provides, or pays the cost of, health care services for patient participants.17. "HIE Advisory Commission" means the advisory body established by the Department in order to provide community input and policy recommendations regarding the use of the confidential health information of the HIE.18. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (45 C.F.R. Parts 160 through 164).19. "HIPAA Final Omnibus Rule" means the HIPAA Regulations promulgated and effective March 25, 2013.20. "HITECH" means the Health Information Technology for Economic and Clinical Health Act of 2009, Pub. Law 111-5and its implementing Regulations.21. "Opt-out form" means the form described in §6.5.4 of this Part and by which a patient participant revokes permission for the RHIO to allow provider participants access to, review of, and/or disclosure of the patient participant's confidential health information by electronic, written or other means.22. "Participant" means a patient participant, a patient participant's authorized representative, a provider participant, a data submitting partner, the regional health information organization, and the Department that has stored, submitted, accessed, and/or disclosed confidential health information via the HIE in accordance with the Act and this Part.23. "Participation" means a participant's authorization, submission, access and/or disclosure of confidential health information in accordance with the Act and this Part.24. "Patient matching" means the process of identification and linking of one (1) patient's data within and across the health systems at the RHIO in order to obtain a comprehensive view of that patient's health care record.25. "Patient participant" means a person who receives health care services from a provider participant and whose protected health information is included in the HIE through the mechanisms established in the Act and this Part.26. "Protected health information" means individually identifiable health information including demographic information that is collected from an individual and is created or received by a health care provider, health plan, employer or health care clearinghouse that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.27. "Provider participant" means a pharmacy, laboratory, health care provider, or health plan that is providing health care services or pays for the cost of health care services for a patient participant and/or is submitting or accessing health information through the HIE and has executed an electronic and/or written agreement regarding disclosure, access, receipt, retention or release of confidential health information to the HIE.28. "Public Health Authorities" means an agency or authority of the United States Government, a State, a Territory, a Political Subdivision of a State or Territory, or an Indian Tribe, that is responsible for public health matters as a part of its official mandate. With regards to this Regulation, this includes: the Rhode Island Department of Health (RIDOH), Executive Office of Health and Human Services (EOHHS), the Department of Children, Youth and Families (DCYF), and the Department of Behavioral Healthcare, Developmental Disabilities and Hospitals (BHDDH).29. "Regional health information organization" or "RHIO" means the organization designated as the RHIO by the State of Rhode Island to provide administrative and operational support to the HIE.30. "Security incident" means a security event that results in a compromise to the confidentiality, integrity, or availability of RHIO network resources, including information system damage, network disruptions, or significant loss of vital business assets. A security event that results in the unauthorized disclosure of confidential data is also known as a security breach.31. "Unanticipated events" means instances in which the provider participant is unavailable and another health care provider is providing coverage to treat the patient participant.32. "Unsecured protected health information" means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the United States Secretary of Health and Human Services in guidance issued under §13402(h)(2) of Pub. Law 111-5.216 R.I. Code R. 216-RICR-10-10-6.2
Amended effective 12/8/2022