Revision: Feb. 2, 2022, 3:11 p.m.
Health and Human Services
February 2, 2022
2022-0465s
05/04
Amendment to SB 423-FN
Amend the bill by replacing all after the enacting clause with the following:
1 New Paragraph; Department of Health and Human Services; Closed Loop Referral System. Amend RSA 126-A:4 by inserting after paragraph V the following new paragraph:
VI. If the department itself or through a contracted entity provides a closed loop referral system, the following privacy and security provisions shall be included:
(a) The department shall not access any individual’s personally identifiable information or protected health information from or through any closed loop referral system unless the individual is currently receiving services funded through a department of health and human services program or has received services funded through a department of health and human services program within the past 12 months, has previously given consent for the department to access their personally identifiable information or protected health information and has not revoked consent.
(b) Notwithstanding the foregoing, the department may obtain specific consent from an individual to access the individual’s personally identifiable information or protected health information on each consent for a referral for services, provided that in obtaining consent:
(1) A separate page, in hard copy or electronically, shall be used; and
(2) The request shall be phrased as follows: "Do you consent to allow the New Hampshire department of health and human services to have access to your personally identifiable information and your private health information along with information about your referrals for services? Please note that you will receive the same services whether you sign this form or not."
(c) Within 48 hours of becoming aware of a data breach, the contracted entity providing a closed loop referral system shall begin the process of notification by first class mail or other individually agreed to communication mechanisms to all individuals impacted by the data breach.
(d)(1) An individual's personally identifiable information or protected health information may be added to the closed loop referral system only if:
(A) The individual consents to its inclusion on each instance of a referral for services, and
(B) The individual whose information is intended to be included in the closed loop referral system shall retain the right to opt into the system on each referral and retain the right to revoke consent to be in the system at any time.
(2) If an individual revokes consent to be in the system, then, to the extent allowed under federal or state law, information relative to the individual's referrals for services shall be deleted from the system within 7 days of the revocation.
(e) No provider or organization utilizing the closed loop referral system network shall have access to an individual's personally identifiable information or protected health information unless the individual has been referred to that provider or organization for services and the provider or organization requested consent from and was given consent by the individual to access such information.
2 Effective Date. This act shall take effect upon its passage.
2022-0465s
AMENDED ANALYSIS
This bill establishes privacy and security requirements for a closed loop referral system established by the department of health and human services or an entity under contract with the department.