P2

SNO Policy 300: Individual Participation and Control of Information Posted to the RLS

Purpose and Principles: This recommended model policy provides greater privacy protection over personal health information than the HIPAA Privacy Rule by allowing individuals to elect whether or not to have information about them included in the RLS. Importantly, individuals are treated as participants in the process of health information collection and dissemination, rather than as spectators. Providing such consumer protections allows individuals to better understand the conditions under which information concerning them might be used, to restrict such use, and to develop confidence in the protections surrounding the use of their data.

This model policy promotes the privacy principles of individual participation and control, purpose specification and minimization, use limitation, and collection limitation. By enhancing reasonable individual control over the collection and use of health information the policy will promote consumer confidence that health information is being used and collected in accordance with individual preferences.

Recommended Language

Scope and Applicability: This Policy applies to all institutions that have registered with and are participating in the SNO and the RLS and that may provide or make available health information through the SNO and the RLS.

Policy:

1. Choice Not to Have Information Included in the RLS. All individuals may choose not to have information about them included in or made available through the RLS.

2. Effect of Choice. An individual’s choice not to have information about him or her included in or made available through the RLS shall be exercised through the Participant, as described in the institution’s Notice, after which time the institution shall no longer include the individual in the RLS. Participants shall develop and implement appropriate mechanisms to remove information about an individual from the RLS if the individual chooses to have such information excluded from the RLS.
3. Revocation. An individual who has chosen not to make information concerning him or her available through the RLS subsequently may be included in the RLS only if the individual revokes his or her decision or subsequently chooses to renew participation in the RLS.
4. Documentation. Each Participant shall document and maintain documentation of all patients’ decisions not to have information about them included in the RLS.
5. Participant Choice. Participants shall establish reasonable and appropriate processes to enable the exercise of a patient’s choice not to have information about him or her included in the RLS. Each Participant retains the authority to decide whether and when to obtain patient consent prior to making information available through the RLS.
6. Provision of Coverage or Care. A Participant shall not withhold coverage or care from an individual on the basis of that individual’s choice not to have information about him or her included in the RLS.