2016 Arizona Revised Statutes
Title 36 - Public Health and Safety
§ 36-3804 Notice of health information practices

36-3804. Notice of health information practices

A. A health information organization must maintain a written notice of health information practices describing the following:

1. Individually identifiable health information that the health information organization collects about individuals.

2. The categories of persons who have access to information, including individually identifiable health information, through the health information organization.

3. The purposes for which access to the information, including individually identifiable health information, is provided through the health information organization.

4. The individual's right to opt out of participating in the health information organization.

5. An explanation as to how an individual opts out of participating in the health information organization.

B. The notice shall include a statement informing the patient of the right not to share the patient's individually identifiable health information through the health information organization and that this right is protected by article XXVII, section 2, Constitution of Arizona.

C. A health information organization must post its current notice of health information practices on its website in a conspicuous manner.

D. Notwithstanding any other requirement in this section, a health information organization must provide an individual with a copy of the notice of health information practices within thirty days after receiving a written request for that information.

E. A health care provider participating in a health information organization must provide the health information organization's notice of health information practices in at least twelve-point type to the provider's patients before or at the provider's first encounter with a patient, beginning on the first day of the provider's participation in the health information organization. A health care provider must document that it has provided the health information organization's notice of health information practices to a patient and that the patient has received and read and understands the notice. Documentation must be in the form of a signature by the patient indicating the patient has received and read and understands the notice of health information practices and whether the patient chooses to opt out. As technology develops and electronic methods of receiving documentation from the patient exist, the health information organization is permitted to utilize such electronic documentation.

F. If the patient chooses to opt out of the health information organization, the patient's individually identifiable health information shall not be accessible through the health information organization no later than thirty days after the patient opts out. A person who receives de-identified information from the health information organization may not use such de-identified information, either alone or in combination with other information, to identify an individual.

G. If there is a material change to a health information organization's notice of health information practices, a health care provider must redistribute the notice of health information practices at the next point of contact with the patient or in the same manner and within the same time period as is required by 45 Code of Federal Regulations section 164.528 in relation to the health care provider's notice of privacy practices, whichever comes first.