Revision: Jan. 18, 2022, 8:54 a.m.
SB 423-FN - AS INTRODUCED
2022 SESSION
22-2862
05/10
SENATE BILL 423-FN
AN ACT relative to a closed loop referral system in the department of health and human services.
SPONSORS: Sen. Rosenwald, Dist 13; Rep. Edwards, Rock. 4; Sen. Giuda, Dist 2; Rep. Salloway, Straf. 5; Rep. Murphy, Graf. 12
COMMITTEE: Health and Human Services
─────────────────────────────────────────────────────────────────
ANALYSIS
This bill establishes privacy and security requirements for a closed loop referral system established by a private organization under contract with the department of health and human services.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
22-2862
05/10
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand Twenty Two
AN ACT relative to a closed loop referral system in the department of health and human services.
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 New Paragraph; Department of Health and Human Services; Closed Loop Referral System. Amend RSA 126-A:4 by inserting after paragraph V the following new paragraph:
VI. If the department contracts with any private organization to provide a closed loop referral system, each contract shall include the following privacy and security provisions:
(a) The department shall not access any individual’s personally identifiable information or protected health information from or through any closed loop referral system unless the individual is currently receiving services funded through a department of health and human services program.
(b) Notwithstanding the foregoing, the department may obtain specific consent from an individual to access the individual’s personally identifiable information or protected health information on each instance of a referral for services, provided that in obtaining consent:
(1) A separate page, in hard copy or electronically, shall be used; and
(2) The request shall be phrased as follows: "Do you consent to allow the New Hampshire department of health and human services to have access to your private health information along with information about your referrals for services? Please note that you will receive the same services whether you sign this form or not."
(c) Within 48 hours of becoming aware of a data breach, the private organization providing a closed loop referral system shall begin the process of notification by first class mail or other individually agreed to communication mechanisms to all individuals impacted by the data breach.
(d)(1) An individual's personally identifiable information or protected health information may be added to the closed loop referral system only if:
(A) The individual consents to its inclusion on each instance of a referral for services; and
(B) The individual whose information is intended to be included in the closed loop referral system shall retain the right to opt into the system on each referral and retain the right to revoke consent to be in the system at any time.
(2) If an individual revokes consent to be in the system, then, to the extent allowed under federal or state law, information relative to the individual's referrals for services shall be deleted from the system within 7 days of the revocation.
(e) No member of the closed loop referral system network shall have access to an individual's personally identifiable information or protected health information unless the individual has been referred to that member for services or the member requested consent from and was given consent by the individual to access such information.
2 Effective Date. This act shall take effect upon its passage.
22-2862
Revised 1/17/22
SB 423-FN- FISCAL NOTE
AS INTRODUCED
AN ACT relative to a closed loop referral system in the department of health and human services.
FISCAL IMPACT: [ X ] State [ ] County [ ] Local [ ] None
|
| |||
| Estimated Increase / (Decrease) | |||
STATE: | FY 2022 | FY 2023 | FY 2024 | FY 2025 |
Appropriation | $0 | $0 | $0 | $0 |
Revenue | $0 | $0 | $0 | $0 |
Expenditures | $0 | Indeterminable Increase | Indeterminable Increase | Indeterminable Increase |
Funding Source: | [ X ] General [ ] Education [ ] Highway [ ] Other | |||
METHODOLOGY:
This bill establishes privacy and security for a closed loop referral system established by a private entity under contract with the Department of Health and Human Services. In order to secure the personal health information (PSI) and personally identifiable information (PII) of state citizens, the bill establishes a process for obtaining consent, in the form of a separate page (either hardcopy or electronic) containing specific language requesting the individual's approval. In addition, the bill establishes a process for notifying individuals in the event of a data breach. The Department states that it expect the bill to increase expenditures by an indeterminable amount, due to the need to design an IT system that complies with the bill's requirements.
The Department anticipates any fiscal impact of this bill will begin in FY 2023.
AGENCIES CONTACTED:
Department of Health and Human Services