Within the last week, both chambers of the Connecticut Legislature passed Senate Bill 1, which includes provisions revising the law governing the Statewide Health Information Exchange known as Connie (sections 21-24). Once the Governor signs the bill, it will take effect on July 1, 2024.
In summary, the bill makes clear that healthcare providers are not required to share specially protected health information, are protected from liability if Connie has a security incident and are not required to sign any contract or share any information with Connie until 18 months after the Office of Health Strategy implements its policies and procedures, which must include input from provider associations.
Here are the details:
- Healthcare providers who do not maintain medical records need not connect to Connie;
- Healthcare providers who are employees of HIPAA covered entities that will connect do not need to connect individually;
- Healthcare providers are not required to share information with Connie when state or federal law prohibits disclosure or if a patient’s consent is required by law and has not been obtained (e.g., behavioral health, substance use disorder, HIV/AIDS information, etc.);
- Healthcare providers are protected from liability for any private or public claim related to a data breach, ransomware or hacking suffered by Connie so long as the provider complied with all applicable laws in sharing information with and connecting to Connie.
- Any healthcare provider that would violate a law by sharing information with or connecting to Connie shall not be required to share such information with or connect to Connie.
- Healthcare providers must complete onboarding (e.g., contract signing and set-up) and be sharing information with Connie, if permitted by law, no later than 18 months AFTER the Office of Health Strategy (OHS) implements policies and procedures (policies and procedures are the precursor to regulations);
- OHS, the state agency that oversees Connie, must convene a work group by September 1, 2024, to make recommendations regarding regulations and policies and procedures. The work group is limited to 15 members and must include: (1) the Executive Director of OHS or her designee; (2) the Health Information Technology Officer of OHS or his designee; (3) the chairpersons and ranking members of the Legislature’s Public Health Committee; and (4) representatives from the state’s various healthcare provider associations. The work group will send recommendations to the Public Health Committee by January 1, 2025.
- OHS’ HITAC committee, which advises on Connie, must include a representative from the Attorney General’s Office (prior to this change, the HITAC committee did not include any lawyers).
This is all good news. But there is still work to do.
For the more details on Connie, see the previous articles: Connie: CT’s Health Information Exchange and Providers’ Obligations to Participate (Dec. 2022); and Connie: Update and What to Expect in 2024 (Dec. 2023).
DMC Law will hold a webinar on Wednesday, June 12, 2024, at 1pm to discuss these changes and what they mean for healthcare providers. This webinar is open to any interested healthcare provider. Attendance is limited to the first 100 registrants.
Link to Register: https://us06web.zoom.us/meeting/register/tZcqde6oqDsvH9JPgkn1gWCDBzgsARSTxZjz