<?xml version='1.0' encoding='utf-8'?>
<regulation prefix="Regulation" num=".11" citation="COMAR 10.25.18.11" title_num="10" subtitle_num="25" chapter_num="18" heading="Requirements for Accessing, Using, or Disclosing of Data Through an HIE in an Emergency.">
  <paragraph num="A.">
    <text>An HIE shall develop and implement emergency access policies and procedures that satisfy the following requirements:</text>
    <paragraph num="(1)">
      <text>The policies and procedures shall be included in the HIEs health care consumer education materials required by Regulation .03B(1) of this chapter; and</text>
    </paragraph>
    <paragraph num="(2)">
      <text>Clearly communicate the following:</text>
      <paragraph num="(a)">
        <text>The extent to which the HIE has the capability to disclose the patient's information in an emergency and how this compares to disclosure for routine access; and</text>
      </paragraph>
      <paragraph num="(b)">
        <text>The circumstances under which the HIE would disclose the patient's information in an emergency, including how opting in or out of participation would impact access to the patient's information during an emergency.</text>
      </paragraph>
    </paragraph>
  </paragraph>
  <paragraph num="B.">
    <text>If an HIEs emergency access policy allows the disclosure of information during an emergency, the HIE shall:</text>
    <paragraph num="(1)">
      <text>Only disclose information to the requesting health care provider if the following conditions are met:</text>
      <paragraph num="(a)">
        <text>The requesting health care provider:</text>
        <paragraph num="(i)">
          <text>Advises the HIE that it is the health care provider's professional opinion that an emergency exists; and</text>
        </paragraph>
        <paragraph num="(ii)">
          <text>Attests that all conditions of the participating organization's policy have been met;</text>
        </paragraph>
      </paragraph>
      <paragraph num="(b)">
        <text>The patient's condition preclude the participating organization from obtaining the consent of the health care consumer;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Information available through the HIE may be relevant to the treatment needed by the patient in the specific emergency;</text>
      </paragraph>
      <paragraph num="(d)">
        <text>The participating organization has an established policy that describes the requirements and attestation process for emergency access; and</text>
      </paragraph>
      <paragraph num="(e)">
        <text>Disclosure of information available through the HIE is not in violation of applicable federal and State laws and regulations related to sensitive health information.</text>
      </paragraph>
    </paragraph>
    <paragraph num="(2)">
      <text>Establish technical procedures for documenting an attestation by the requesting health care provider that the conditions in §B(1) of this regulation, were met prior to accessing information through the HIE;</text>
    </paragraph>
    <paragraph num="(3)">
      <text>Review the emergency access logs at least monthly, in coordination with the participating organization, to identify any unusual finding;</text>
    </paragraph>
    <paragraph num="(4)">
      <text>Take action in accordance with Regulation .06 of this chapter, in the event the emergency access log reveals an unusual finding;</text>
    </paragraph>
    <paragraph num="(5)">
      <text>Maintain an audit trail of user emergency access logs in accordance with Regulation .06A(8) of this chapter; and</text>
    </paragraph>
    <paragraph num="(6)">
      <text>Require a participating organization to:</text>
      <paragraph num="(a)">
        <text>Access only the minimum necessary information needed to care for the patient during the emergency encounter;</text>
      </paragraph>
      <paragraph num="(b)">
        <text>Discontinue querying of the patient's record upon the completion of the emergency encounter;</text>
      </paragraph>
      <paragraph num="(c)">
        <text>Allow emergency access only to authorized users with the appropriate access designation consistent with the policy of the participating organization; and</text>
      </paragraph>
      <paragraph num="(d)">
        <text>Notify the health care consumer, as soon as reasonably possible, and no later than ten business days from the initial access, when the HIE has granted access to the health care consumer's information during an emergency.</text>
      </paragraph>
    </paragraph>
  </paragraph>
</regulation>