Assigned to HHS                                                                                                           AS PASSED BY HOUSE






Fifty-Fifth Legislature, First Regular Session





health information; disclosures; prohibition


            An emergency measure that permits state, county and local health departments to disclose communicable disease information to Arizona's designated health information organization (HIO). Authorizes the Department of Health Services (DHS) to release identifying immunization information to an HIO and specified organizations and entities that have a business associate agreement with the Arizona Health Care Cost Containment System (AHCCCS).


            The federal Health Insurance Portability and Accountability Act (HIPAA), enacted on August 21, 1996, requires the Secretary of the U.S. Department of Health and Human Services (U.S. HHS) to publicize standards for the electronic exchange, privacy and security of health information. In 2002, the U.S. HHS developed a proposed rule governing the privacy of individually identifiable health information. The regulation, known as the privacy rule, establishes a set of national standards governing the protection of certain health information. HIPAA privacy rules address the use and disclosure of individuals’ protected health information by entities that are subject to the privacy rule as well as standards for privacy rights for individuals to understand and control how their health information is used. The privacy rule applies to health plans, health care clearinghouses and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of the U.S. HHS has adopted standards under HIPAA (HIPAA Privacy Rule).

            Laws 2011, Chapter 268 established requirements for HIOs in Arizona, including requirements governing the maintenance and release of medical records and health information. An HIO is an organization that oversees and governs the exchange of individually identifiable health information according to nationally recognized standards. Statute requires that an HIO provide certain rights to individuals, including the ability to: 1) opt out of the HIO;
2) request a list of individuals who have accessed the individual's health information through the HIO; and 3) request an amendment of incorrect individually identifiable health information available through the HIO (A.R.S. § 36-3802).

            There is no anticipated fiscal impact to the state General Fund associated with this legislation.


1.   Specifies, with regard to the Division of Developmental Disabilities within the Department of Economic Security, that medical records, including information pertaining to mental health services and communicable diseases, and information contained within the medical records can only be disclosed as authorized by state or federal law, including HIPAA privacy standards.

2.   Permits state, county and local health departments and officers to disclose
communicable-disease-related information to Arizona's official HIO.

3.   Authorizes DHS to release identifying immunization information to:

a)   Arizona's official HIO; and

b)   an external quality review organization or other entity that has a business associate agreement with AHCCCS.

4.   Makes technical changes.

5.   Becomes effective on signature of the Governor, if the emergency clause is enacted.

Amendments Adopted by Committee

1.   Removes proposed language restricting a person who receives de-identified health information from using the information to identify an individual.

2.   Eliminates proposed language prohibiting an HIO from disclosing individually identifiable or de-identified health information unless the disclosure complies with laws or rules related to the use of such health information for research.

Amendments Adopted by the House of Representatives

1.   Permits DHS to release identifying immunization information to an external quality review organization or nother entity that has a business associate agreement with AHCCCS and an HIO.

3.   Adds an emergency clause.

4.   Makes technical changes.

Senate Action                                                          House Action

HHS                2/18/21      DPA     7-0-1                 HHS                3/15/21      DPA     9-0-0-0

3rd Read          3/1/21                      29-0-1               3rd Read          3/31/21                    58-0-2

Prepared by Senate Research

April 1, 2021