Amend the bill by striking out all of section 1.
Amend the bill in section 2 in paragraph F-3 in the 4th line (page 1, line 27 in L.D.) by striking out the following: " and maintained by"
Amend the bill by striking out all of section 5 and inserting the following:
‘Sec. 5. 22 MRSA §8702, sub-§4-B is enacted to read:
Sec. 6. 22 MRSA §8702, sub-§8-C is enacted to read:
Amend the bill by inserting after section 8 the following:
‘Sec. 9. 22 MRSA §8708, sub-§7, as enacted by PL 1995, c. 653, Pt. A, §2 and affected by §7, is amended to read:
Amend the bill in section 9 in §8714 in subsection 1 in the next to the last line (page 3, line 3 in L.D.) by inserting after the following: " health information" the following: ' except that an individual's identifying health information may be used to the extent necessary to prosecute civil or criminal violations regarding information in the organization database'
Amend the bill in section 9 in §8714 by striking out all of subsection 2 (page 3, lines 5 to 11 in L.D.) and inserting the following:
Amend the bill in section 9 in §8714 in subsection 3 in paragraph B in the last line (page 3, line 19 in L.D.) by inserting after the following: " measures" the following: ' that include appropriate accountability and notification requirements as required of business associate agreements under HIPAA'
Amend the bill in section 9 in §8714 in subsection 3 in paragraph D in the last line (page 3, line 25 in L.D.) by inserting after the following: " board" the following: ' consistent with state and federal laws'
Amend the bill in section 9 in §8714 in subsection 4 in the last 2 lines (page 3, lines 29 and 30 in L.D.) by striking out all of the last sentence.
Amend the bill in section 9 in §8714 by striking out all of subsection 10 (page 4, lines 12 and 13 in L.D.) and inserting the following:
Amend the bill in section 9 in §8714 by adding at the end the following:
Amend the bill in section 9 in §8715 by striking out all of subsection 3 (page 4, lines 26 to 30 in L.D.) and inserting the following:
Amend the bill in section 9 in §8716 by striking out all of subsection 5 (page 5, lines 18 to 22 in L.D.) and inserting the following:
Amend the bill in section 9 in §8717 in subsection 1 in the 6th line (page 5, line 29 in L.D.) by striking out the following: " or had"
Amend the bill in section 9 in §8717 by striking out all of subsection 3 (page 6, lines 18 and 21 in L.D.) and inserting the following:
Amend the bill by adding after section 9 the following:
‘Sec. 10. Rule-making authority. The Board of Directors of the Maine Health Data Organization shall adopt rules as necessary to implement this Act. Rules adopted pursuant to this section are major substantive rules as described in the Maine Revised Statutes, Title 5, chapter 375, subchapter 2-A.
Sec. 11. Contingent effective date. Those sections of this Act that amend the Maine Revised Statutes, Title 22, section 1711-C, subsection 6, paragraph F-3 and sections 8702 and 8705-A, repeal Title 22, section 8707 and enact Title 22, sections 8714 to 8717 take effect upon the final adoption of major substantive rules required to implement the provisions of this Act. The Board of Directors of the Maine Health Data Organization shall notify the Revisor of Statutes when the major substantive rules authorized under this Act are finally adopted.’
Amend the bill by relettering or renumbering any nonconsecutive Part letter or section number to read consecutively.
SUMMARY
This amendment makes the following changes to the bill.
1. It adds a definition of "HIPAA," which is the federal Health Insurance Portability and Accountability Act of 1996.
2. The bill amends the definition of "health care information" as it regards hospitals and medical care. The amendment strikes that change and instead inserts those provisions into the definition of "protected health information" for the Maine Health Data Organization.
3. It adds privacy protections to prevent the release of protected health information for individuals with HIV and individuals undergoing mental health or substance abuse treatment.
4. It requires the Board of Directors of the Maine Health Data Organization to adopt rules to ensure privacy and security protections of data that are equivalent to the requirements in the federal Health Insurance Portability and Accountability Act of 1996.
5. It requires the Board of Directors of the Maine Health Data Organization to provide a definition of "breach" and notifications regarding breaches that are equivalent to the requirements in the federal Health Insurance Portability and Accountability Act of 1996. It requires a breach to be reported to the joint standing committee of the Legislature having jurisdiction over health and human services matters within 30 days of the breach.
6. It requires the Board of Directors of the Maine Health Data Organization to develop rules to establish a complaints procedure for individuals who believe their protected health information has been released inappropriately.
7. It prohibits the Maine Health Data Organization from collecting any clinical data that are different from the data the organization collects as of March 1, 2014 without rulemaking. These rules are major substantive rules.
8. It adds an effective date so that the sections limiting the collection of clinical data and granting rule-making authority go into effect 90 days after adjournment and the rest of the Act goes into effect upon final adoption of major substantive rules.