§ 90-414.11.  Construction and applicability.

(a) Nothing in this Article shall be construed to do any of the following:

(1) Impair any rights conferred upon an individual under HIPAA, including all of the following rights related to an individual's protected health information:

a. The right to receive a notice of privacy practices.

b. The right to request restriction of use and disclosure.

c. The right of access to inspect and obtain copies.

d. The right to request amendment.

e. The right to request confidential forms of communication.

f. The right to receive an accounting of disclosures.

(2) Authorize the disclosure of protected health information through the HIE Network to the extent that the disclosure is restricted by federal laws or regulations, including the federal drug and alcohol confidentiality regulations set forth in 42 C.F.R. Part 2.

(3) Restrict the disclosure of protected health information through the HIE Network for public health purposes or research purposes, so long as disclosure is permitted by both HIPAA and State law.

(4) Prohibit the Authority or any covered entity participating in the HIE Network from maintaining in the Authority's or qualified organization's computer system a copy of the protected health information of an individual who has exercised the right to opt out, as long as the Authority or the qualified organization does not access, use, or disclose the individual's protected health information for any purpose other than for necessary system maintenance or as required by federal or State law.

(b) This Article applies only to disclosures of protected health information made through the HIE Network, including disclosures made within qualified organizations. It does not apply to the use or disclosure of protected health information in any context outside of the HIE Network, including the redisclosure of protected health information obtained through the HIE Network. (2015-241, s. 12A.5(d).)