THE GENERAL ASSEMBLY OF PENNSYLVANIA

SENATE BILL

INTRODUCED BY FOLMER, SCARNATI, PILEGGI, FARNESE, M. WHITE, GORDNER, BOSCOLA, D. WHITE, VANCE, ERICKSON, TARTAGLIONE, BLAKE, STACK, BRUBAKER AND PIPPY, FEBRUARY 13, 2012

AS AMENDED ON THIRD CONSIDERATION, JUNE 11, 2012   

AN ACT

Establishing the Pennsylvania eHealth Partnership Authority and

the Pennsylvania eHealth Partnership Fund; providing for

consent and confidentiality of health information; and

establishing civil immunity under certain circumstances.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

CHAPTER 1

PRELIMINARY PROVISIONS

Section 101.  Short title.

This act shall be known and may be cited as the Pennsylvania

eHealth Information Technology Act.

Section 102.  Definitions.

The following words and phrases when used in this act shall

have the meanings given to them in this section unless the

context clearly indicates otherwise:

"Authority."  The Pennsylvania eHealth Partnership Authority.

"Board."  The board of directors of the Pennsylvania eHealth

Partnership Authority.

"Electronic health record."  An electronic record of health-

related information relating to an individual that is created,

gathered, managed and consulted by health care providers or

<--

payers.

"Fund."  The Pennsylvania eHealth Partnership Fund.

"Health care provider."  A person licensed by the

Commonwealth to provide health care or professional clinical

services. The term includes:

(1)  A "health care practitioner," as defined in section

103 of the act of July 19, 1979 (P.L.130, No.48), known as

the Health Care Facilities Act.

(2)  A "health care provider," as defined in section 103

of the Health Care Facilities Act.

(3)  A life or health insurer or other payer.

<--

(4) (3)  A public health authority.

<--

(5) (4)  A pharmacy.

<--

(6) (5)  A laboratory.

<--

(7) (6)  A person that provides items or services

<--

described  in section 1861(s) of the Social Security Act (49

Stat. 620, 42 U.S.C. § 1395x(s)).

(8) (7)  A "provider of services," as defined in section

<--

1861(u) of the Social Security Act (42 U.S.C. § 1395x(u)).

"Health information."  Information, whether oral or recorded,

in any form or medium, that is created or received by a health

care provider relating to the following:

(1)  The past, present or future physical or mental

health or medical condition of an individual.

(2)  The past, present or future payment for the

provision of health care to an individual.

"Health information exchange."  A Statewide interoperable

system established under this act that electronically moves and

exchanges health information between approved participating

health care providers or health information organizations in a

manner that ensures the secure exchange of health information to

provide care to patients.

"Health information organization."  An information technology

infrastructure with an interoperable system that is established

by a health care provider or payer or that connects

<--

participating health care providers or payers to ensure the

<--

secure digital exchange of health information among participants

engaged in the care of the patient.

"Health information technology."  Hardware, software,

integrated technologies or related licenses, intellectual

property, upgrades or packaged solutions sold as services that

are designed for or support the use by health care entities or

patients for the electronic creation, maintenance, access or

exchange of health information.

"Interoperability."  The ability of different operating and

software systems to employ federally recognized standards to

exchange data securely, accurately, effectively and in a manner

that maintains and preserves the clinical purpose of the data.

"Participant."  A person or entity which has been approved by

the Pennsylvania eHealth Partnership Authority to send and

receive health information using the health information

exchange.

"Payer."  An entity that contracts or offers to contract to

provide, deliver, pay or reimburse any of the costs of health

care services, including an employer, a health care plan, the

Federal Government, the Commonwealth, a municipality, a labor

union or an entity licensed under any of the following:

(1)  The act of May 17, 1921 (P.L.682, No.284), known as

The Insurance Company Law of 1921.

(2)  The act of December 29, 1972 (P.L.1701, No.364),

known as the Health Maintenance Organization Act.

(3)  40 Pa.C.S. Ch. 61 (relating to hospital plan

corporations).

(4)  40 Pa.C.S. Ch. 63 (relating to professional health

services plan corporations).

CHAPTER 3

PENNSYLVANIA EHEALTH

PARTNERSHIP AUTHORITY

Section 301.  Scope of chapter.

This chapter relates to the Pennsylvania eHealth Partnership

Authority.

Section 302.  Pennsylvania eHealth Partnership Authority.

(a)  Establishment.--There is hereby established a body

corporate and politic to be known as the Pennsylvania eHealth

Partnership Authority, which shall be an independent agency of

the Commonwealth. The powers and duties of the authority shall

be vested in and exercised by a board of directors.

(b)  Composition.--The board shall consist of 15 members, who

must be residents of this Commonwealth, with two additional, ex

officio nonvoting members selected by members of the advisory

council, composed and appointed as follows:

(1)  The Secretary of Health or a designee, who shall be

an employee of the Department of Health designated in writing

prior to service.

(2)  The Secretary of Public Welfare or a designee, who

shall be an employee of the Department of Public Welfare

designated in writing prior to service.

(3)  One representative of the health care community

focused on an unserved or underserved rural or urban patient

population, who shall be appointed by the Governor from a

list of individuals submitted for consideration by both the

Pennsylvania Area Health Education Center and the Association

of Community Health Centers.

(4)  One physician or nurse appointed by the Governor

from lists of individuals submitted by the Pennsylvania

Medical Society, the Pennsylvania Osteopathic Medical

Association, the Pennsylvania Academy of Family Physicians

and the Pennsylvania State Nurses Association. At least one

name on each list shall include an individual residing in an

unserved or underserved rural patient population area and an

individual in an unserved or underserved urban patient

population area.

(5)  One hospital representative appointed by the

Governor from a list of individuals submitted by the Hospital

and Healthsystem Association of Pennsylvania. At least one

name on this list shall include an individual residing in an

unserved or underserved rural or urban patient population

area.

(6)  One insurance representative appointed by the

Governor from lists of individuals submitted by the Blue

Cross and Blue Shield plans and the Insurance Federation of

Pennsylvania.

(7)  One representative of an assisted living residence,

personal care home, long-term care nursing facility, 

continuing care facility or behavioral or mental health

facility who shall be appointed by the Governor.

(8)  Two consumer representatives appointed by the

Governor who are not primarily involved in providing health

care or health care insurance. At least one of these

individuals shall have expertise in health care or health

care information technology or the laboratory industry.

(9)  Three representatives from established health

information organizations appointed by the President pro

tempore of the Senate, in consultation with the Majority

Leader and the Minority Leader of the Senate, each of whom

shall recommend one person. At least one of these

representatives shall be from the private information

technology sector with knowledge about security issues.

(10)  Three representatives from established health

information organizations appointed by the Speaker of the

House of Representatives, in consultation with the Majority

Leader and the Minority Leader of the House of

Representatives, each of whom shall recommend one person. At

least one of these representatives shall be from the private

information technology sector with knowledge about security

issues.

(c)  Terms.--Except a member as specified in subsection (b)

(1) or (2), a member of the board shall serve for a term of

three years after completion of the initial terms designated in

subsection (g) and may not be eligible to serve more than two

full consecutive three-year terms. A member shall remain on the

board until the member's replacement is appointed and,

notwithstanding any other provision of this act, all terms end

at the expiration of the authority.

(d)  Quorum.--A majority of the appointed members of the

board shall constitute a quorum. Action may be taken by the

board at a meeting upon a vote of a quorum of its members

present in person or through electronic means if authorized by

the bylaws of the board.

(e)  Meetings.--The board shall meet at the call of the

chairperson or as may be provided in the bylaws of the board.

The board shall hold meetings at least quarterly, which shall be

subject to the requirements of 65 Pa.C.S. Ch. 7 (relating to

open meetings). Meetings of the board may be held anywhere

within this Commonwealth.

(f)  Chairperson.--The Governor shall appoint a chairperson

from among the authority members.

(g)  Initial appointment and vacancy.--

(1)  A member appointed under subsection (b)(3), (4) or

(5) shall be appointed to an initial term of two years with

the option for reappointment to two additional three-year

terms.

(2)  A member appointed under subsection (b)(6) or (7)

shall be appointed to an initial term of one year with the

option for reappointment to two additional three-year terms.

(3)  A member appointed under subsection (b)(8) shall be

appointed to an initial term of three years with the option

for reappointment to one additional three-year term.

(4)  A member appointed under subsection (b)(9) or (10)

shall be appointed to an initial term that coincides with the

appointing members' terms with the option for reappointment

to two additional three-year terms.

(h)  Formation.--The board shall be formed within 90 days of

the effective date of this act.

Section 303.  Powers and duties.

(a)  General rule.--The board shall:

(1)  Adopt bylaws necessary to establish the authority

and carry out the provisions of this act.

(2)  Develop, establish and maintain a health information

exchange that complies with Federal and State law and that:

(i)  Promotes efficient and effective communication

among multiple health care providers, payers and

<--

participants.

(ii)  Creates efficiencies and promotes accuracy in

the delivery of health care.

(iii)  Supports the ability to improve community

health status.

(3)  Employ individuals as necessary to carry out the

purposes of this act. Individuals employed by the authority

shall be considered employees of the Commonwealth for the

purposes of 71 Pa.C.S. Pt. XXV (relating to retirement for

State employees and officers).

(4)  Adopt all of the following:

(i)  Policies and procedures to govern the electronic

exchange of health information in accordance with this

act.

(ii)  Rules, responsibilities and obligations for

organizations and individuals to become and remain

participants in the health information exchange.

(iii)  Policies and procedures for organizations and

individuals to be suspended and disengaged as

participants in the health information exchange.

(5)  Make, execute and deliver contracts, grants and

other instruments.

(6)  Apply for, solicit, receive, establish priorities

for, allocate, disburse, contract for, administer and expend

funds consistent with the purposes of this act.

(7)  Apply for, accept and administer grants and loans to

carry out the purpose of the authority.

(8)  Accept funds from both public and private sources,

consistent with Federal and State law.

(9)  Develop and maintain a directory of health care

provider's contact information to enable participants to

share health information electronically.

(10)  Develop criteria for the approval of participants

in the health information exchange.

(11)  Develop and maintain standards to ensure

interoperability.

(12)  Establish and collect fees adopted by the

authority. Fees may include transaction fees, subscription

fees or other fees or donations, to cover costs of

implementation and operation of the exchange or for other

services provided by the authority. Receipt of services

provided by or through the authority may be conditioned on

payment of fees. Participation in the exchange by any health

care provider, payer, consumer or any other person is

voluntary.

(13)  Establish advisory groups with a diverse membership

representing interested and affected groups and individuals,

two of which shall be selected by other members of the group

to serve as nonvoting members of the board or the authority.

(14)  Develop and conduct public information programs to

educate and inform consumers and patients about health

information.

(15)  Submit an annual report to the Governor, the

President pro tempore of the Senate and the Speaker of the

House of Representatives for distribution to appropriate

legislative committees on the activities of the authority for

the year, including a summary of the receipts and

expenditures, a list of contracts and a summary of any

reportable security breaches that occurred and corrective

actions that were taken.

(16)  Develop and maintain:

(i)  a registry of patients choosing to opt out of

the health information exchange; and

(ii)  procedures to reenroll re-enroll into the

<--

health information exchange.

(17)  Perform all other activities in furtherance of the

purposes of this act.

(b)  Audit.--

(1)  The accounts and books of the authority shall be

examined and audited annually by an independent certified

public accounting firm. The audit shall be public

information.

(2)  The authority shall, by December 31 of each year,

file a copy of the audit of the preceding Commonwealth fiscal

year required under paragraph (1) with the Secretary of the

Senate and the Chief Clerk of the House of Representatives.

(c)  Publication.--The authority shall annually submit a

financial statement to the Legislative Reference Bureau for

publication in the Pennsylvania Bulletin.

(d)  Expiration.--The authority shall expire five years after

the effective date of this chapter. One year prior to the

expiration, the Legislative Budget and Finance Committee shall

evaluate the management, viability and performance of the health

information exchange and shall provide a report to the

Communications and Technology Committee of the Senate and the

Health Committee of the House of Representatives and the Human

Services Committee of the House of Representatives. The report

shall include recommendations as to reauthorization of the

authority, dissolution of the authority or assumption of the

authority's responsibilities and assets by another entity.

CHAPTER 5

PENNSYLVANIA EHEALTH PARTNERSHIP FUND

Section 501.  Establishment.

There is established a separate fund in the State Treasury to

be known as the Pennsylvania eHealth Partnership Fund. The fund

shall be administered by the authority.

Section 502.  Funds.

All moneys deposited into the fund shall be held for the

purposes of the authority and may not be considered a part of

the General Fund, but shall be used only to effectuate the

purposes of this act as determined by the authority. All

interest earned from the investment or deposit of moneys

accumulated in the fund shall be deposited in the fund for the

same use.

CHAPTER 7

CONSENT AND CONFIDENTIALITY

OF HEALTH INFORMATION

Section 701.  Consent and confidentiality of health information.

(a)  Construction.--

(1)  Nothing in this act shall be construed to prohibit a

health care provider or payer from obtaining and storing a

<--

patient's health records in electronic form or exchanging

health information with another health care provider or payer 

<--

in accordance with Federal law or State law other than this

act.

(2)  Nothing in this act shall supersede or limit any

other law which requires additional consent to the release of

health information or otherwise establishes greater

restrictions or limitations on the release of health

information.

(b)  Consent.--The authority shall promulgate a consent form

including notice of a patient's ability to decline to allow

exchange of the patient's electronic health information in the

health information exchange. The notice shall include, at a

minimum and in plain language, the following information:

(1)  Definition of a health information exchange.

(2)  Explanation of the benefits of participation in the

health information exchange.

(3)  Explanation of the limits of the patient's ability 

to decline the release or exchange of the patient's health

information with the health information exchange.

(4)  Explanation of the manner in which the health

information exchange will address privacy issues.

(5)  Explanation of the manner in which an individual may

decline to participate in the health information exchange.

(c)  Opt-out registry.--

(1)  In order to decline participation in the health

information exchange, a patient must sign and date a form

declining participation. If appropriate, the signature must

be witnessed by the patient's representative. Copies of the

completed form shall be sent by the provider within five

business days to the authority to be included in an opt-out

registry.

(2)  After receipt of the form, the authority shall

within five business days notify health information

organizations that the patient has not authorized the release

of the health information.

(3)  Once the patient is included in the opt-out

registry, the authority shall notify the patient. The

notification shall include a copy of the completed form

signed by the patient or electronic notification to the

patient.

(4)  The patient alone shall decide to opt out of a

health information exchange.

(d)  Disclosure.--

(1)  The authority shall retain only the health 

information necessary for the operation of the health  

information exchange. The authority may not disclose, without

prior written consent of the patient, any health information

that the authority or its employees, agents or contractors

retain, or to which the authority or its agents or

contractors have access or any other health records

maintained or accessible by the authority under this act, to

any person who is not an authorized employee, agent or

contractor of the authority, except as required by law.

(2)  Sharing health information among participants in the

health information exchange shall not be considered a

disclosure under paragraph (1).

(3)  Violations of this subsection:

(i)  shall subject employees, agents and contractors

to administrative discipline, including discharge and

suspension; and

(ii)  shall subject contractors to monetary penalties

or contract revocation or suspension.

(e)  Construction.--Nothing in this act may be construed to

alter a proprietary interest held by any participant in any

record, data or information released, accepted or included in

the health information exchange, except insofar as the paperwork

approved by the authority may require participants to license

those interests by contract in order to allow for the free flow

of information.

CHAPTER 40

MISCELLANEOUS PROVISIONS

Section 4001.  Nonapplicability.

(1)  This act is subject to 1 Pa.C.S. § 2310 (relating to

sovereign immunity reaffirmed; specific waiver).

(2)  The authority shall be subject to the act of

February 14, 2008 (P.L.6, No.3), known as the Right-to-Know

Law. Health information or personally identifying information

shall not be considered a public record for purposes of the

Right-to-Know Law.

(3)  Nothing in this act is intended to affect common law

<--

or statutory rights or obligations with respect to patient

accessibility to their electronic or nonelectronic medical

records.

Section 4002.  Effective date.

This act shall take effect immediately.