Shay:

Previously, many of those who were granted an exemption did not have to pay any type of fee at all. Some were told they would still pay the small fee but would not be required to share information at all in any way.  Please confirm that the exemptions will also exempt from a connection and subscription fee being required as well.

OHCA Response:

Thank you for your feedback. If a provider elects to be exempted from both transmitting data to and utilizing the HIE, the provider will not be obligated to pay the one-time connection fee nor the monthly subscription fee. We are considering adding language to the rule to ensure this is clear.

Concerned Healthcare Worker:

Anyone who wants to be exempt is exempt from utilizing. Are they also exempt from fees and subscription costs as well, or will they be asked to pay, even though they request exemption in participation?

Seems like an undue fee/tax on those in the healthcare industry if forced to pay for those services they are exempting themselves from utilizing. 

OHCA Response:

Thank you for your feedback. If a provider elects to be exempted from both transmitting data to and utilizing the HIE, the provider will not be obligated to pay the one-time connection fee nor the monthly subscription fee. We are considering adding language to the rule to ensure this is clear.

CBenson:

It is not reasonable to make this requirement without being able to give the providers a cost estimate on how much these annual/monthly fees are going to be.  We have only heard the amount "is based on the size of the group or facility".  That is too broad.  Is the OHCA going to allow the company to charge providers whatever they determine?   I have submitted an on-line application and got no response.  I have emailed twice to get a response and have yet to receive one.  How are we supposed to be compliant when the company you are using won't even respond to an email or the application they require?  Something is not right about how this.  

OHCA Response:

Thank you for your feedback. We will follow up with the vendor to ensure your inquiry is responded to. Please email okshine@okhca.org so we can follow-up on your request.

Laurel:

This is a very wise decision.  The cost of implementing this HIE was going to be an enormous financial burden on small practices.  Please involve the medical community at large in any future plans for HIE expansion, not a for profit company.

OHCA Response:

Thank you for your feedback.  The legislature has provided grant funding to allow connection fees to be covered.  The grant application process is being developed but will be available soon on the https://okshine.ok.gov  website. 

Leah:

I request that you explicitly state that mental health providers are completely excluded from ALL aspects of the HIE unless someone individually chooses to opt in. The reasons are those stated in the recent legal filing for an injunction which due to the governor’s decision, did not need to be pursued yet. In the interest of time, money, energy, and ethics please be clear with the exemption wording and do not require providers to file for an exemption, rather they can individually file if they want to participate.  Thank you. 

OHCA Response:

Thank you for your feedback. Under the new proposed rules, all health care providers that register for an exemption will be granted such exemption. We will no longer broadly exclude a specific provider type. In order to be consistent with the directive of the statute, all health care providers are asked to either submit an application for participation or register for an exemption.

G Williams:

Healthcare  is a contract between a patient and doctor, patient, and therapist as well as a patient and health care giver. Just as confidentiality with one’s attorney, I would hope it is no less sacred with one who entrusts one’s health. How in God’s name can this be considered? What could be the benefit against the potential misuse and dereliction of a right to privacy? Look to your mentors who have made health care what it is today and ask yourself, do you know better?

OHCA Response:

Thank you for your feedback. Confidentiality, Privacy, and Security of health information is a top priority for the health information exchange. The state designated entity has been operating a health information exchange for over ten years and has substantial policies and procedures in place to ensure all health information received is closely guarded and monitored. All access to the system is governed by HIPAA and providers must be in a treatment relationship with a patient. In the case of mental health data, this may only be shared to the HIE with the patients consent.  Extensive auditing is done to ensure providers adhere to this and a patient may request a list of all providers who have accessed their record. Additionally, the state designated entity has a governing board and several committees which are all made up of health care providers and health care organizations to ensure the data and uses thereof are appropriate in accordance with HIPAA. Additionally, patients may opt-out of the system by completing a MyHealth Opt-Out form at any time. All access to their past records and future records will be blocked from access within the HIE from all providers, with no disclosure of where, or what provider the request was made from.

Marc:

I completed an exemption request form in order to be exempted from participation in the SDE and HIE around June15th of 2023. Will I receive an acknowledgement/approval of the exemption when it is granted?

OHCA Response:

Thank you for your feedback and patience. Notifications to providers that have submitted for an exemption were sent on June 29th and July 3rd. Once emergency rules are approved, we can officially process exemptions, and at that point you will receive an email with the approval for the requested exemption.

Stacey:

I would like to grant an exemption please. I don’t see any instructions on how to do that, so I thought this was a start. Please advise on what I need to do moving forward. Thank you.

OHCA Response:

Thank you for your feedback. You can complete the exemption request by following this link oklahoma.gov/ohca/exemption

Constance:

I still do not like being mandated to get into this system, however the exemptions that will be guaranteed is what I'm going to do currently.

OHCA Response:

Thank you for your feedback. You can complete the exemption request by following this link oklahoma.gov/ohca/exemption

Edel:

This is additional burden on Providers and on clients. It does not seem that enforcement is possible without cost to the public, provider, and client. How will you know if client has denied permission without revealing his/her identity and breaking confidentiality? I do not believe any person should join an organization/agency without knowing the fees. 

OHCA Response:

Thank you for your feedback. The Office of the State Coordinator, OKSHINE, does not need to know which patients have chosen to not share their information. Any provider that is part of the HIE can process an Opt-out form upon request for one of their patients. All access to their past records and future records will be blocked from access within the HIE from all providers, with no disclosure of where, or what provider the request was made from. Alternatively, any patient can request opt-out by completing the opt-out form, getting it notarized and mailing it to MyHealth. The expected fees for your organization can be requested via the state designated entity by emailing MyHealth@myhealthaccess.net. By completing an application to join, a detailed quote for your participation fees will be provided.  Completing the application does not commit you to anything and does not prevent you from registering for an exemption later.

Ronald:

Under Exemptions (2) "...will be granted such exemption", add "...without being charged fees of any kind."  That item is not addressed in the new proposed revisions and is advised because of the recent provider furor over fees.

OHCA Response:

Thank you for your feedback. We are considering adding language to the rule to ensure this is clear.

Lori:

The added clarification of data set to be submitted, USCDI standard, and general exemptions provides guidelines for implementation and ongoing compliance with the HIE policy. Thank you.

OHCA Response:

Thank you for your feedback.

Camille:

It is still unclear what is expected of me as sole proprietor mental health counselor. If I am mandated to participate how does that work? What are my fees? How do I opt out if I determine I choose to? 

OHCA Response:

With the new rules all health care providers are asked to either submit an application for participation or register for an exemption. If you register for an exemption, it will be granted, and no fees are charged.  As stated in the rules, subscription fees are for those that apply to participate and are determined based on the organization type and size.  A subscription fee schedule is established by the SDE based on network operating costs as approved by the SDE board and can be obtained upon request to the SDE which is MyHealth (MyHealth@myhealthaccess.net). Additionally, the legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available.

Ross:

I am extremely troubled by two items on the patient opt out form.

The first issue is the matter of the data can still be transmitted after opting out in the event of an emergency.   This may be a very good idea that could save lives, but because it overrides the patient’s consent and collects private papers without a warrant this is unconstitutional. (Oklahoma Constitution Section II-30, and Section II-37.)  I  strongly advise creating a form with the following choices:

Option A: I request that my data not be transmitted unless a medical emergency has been declared by a doctor in my care.

Option B: I request that my data never be viewed, accessed, or transmitted via the HIE under any circumstances, even in the case of a medical emergency.   I understand that in the event of a medical emergency the health care workers will not have access to potentially lifesaving information.   I accept this risk.

Though the second option might appear foolish at first glance it also removes the potential for data to be stolen by breach and it removes the potential of a non-emergency breaking of the glass.  Which privacy advocates like me would prefer.

The second problem I see is the form requests Previous Names or Nicknames as a mandatory field.   People suffering from gender dysphoria disorder would have to out themselves on medical privacy document to a private company on behalf of the state of Oklahoma. This is a major privacy violation that can and should be avoided.  This should be made an optional field.

OHCA Response:

Thank you for sharing your concerns about MyHealth’s current opt-out policy. Your concerns are noted and will be included in discussions about possible changes in policy. 

MyHealth is a private nonprofit health information exchange organization located in and exclusively serving the healthcare organizations and patients of Oklahoma, whose mission and purpose is to meet the needs of its participants with respect to private, secure, and appropriate electronic exchange of health information. The network policies are set through its governance board which includes representation from every type of HIE participant.  The current policies are the product of many years of collaboration among hundreds of healthcare providers and their lawyers.  However, the new law does change the context for health information exchange, and policies are expected to evolve in response to stakeholder input.

The current opt-out policy was developed thoughtfully with input from the participants. Both federal and state privacy laws put the responsibility for creating, maintaining, and protecting the privacy and security of patient medical records on healthcare providers. Healthcare providers can contract with other entities, such as electronic medical record vendors, to help them with these duties, without patient consent.  The same laws (45 CFR §§160, 162, 164, 171) direct healthcare providers to appropriately exchange health information privately and securely with other healthcare organizations who participate in a patient’s care for specific permitted purposes.  MyHealth’s contract with participants makes it a business associate of healthcare providers. Its policies are designed to enable providers to do their work in compliance with applicable laws and according to the rules set by, oversight of, and accountability to Oklahoma healthcare providers. MyHealth prohibits disclosures of data that are not allowed under the law.

Currently, MyHealth’s HIE agreement assigns full control to healthcare providers to choose not to use MyHealth to exchange information about any individual patient, subject to their own policy and technical capability. MyHealth’s network-level opt out policy was created on top of that principle, to make a network-level “off switch” for any patient, while still allowing healthcare providers (whose goal is to do no harm and save lives) to have crucial information in the moment it is most needed to save lives. 

The State’s proposed rule (APA WF 23-17) has a new definition of “Report data to”, that says providers will not be out of compliance with the new law if they implement policies and technical controls that allow a patient to request the patient information to be withheld from transmission to MyHealth.

Regarding previous names and nicknames: This concern is valid and will be considered. The information on an opt out form is used to identify all medical records to which the opt out applies. Practically speaking, MyHealth cannot make anyone list any names they do not wish to share, but records listed under other names might not be recognized as records that are meant to be included under the umbrella of the opt out choice. The form is only handled by those who are involved in the processing, all of whom are trained and accountable for protecting privacy. After processing, the form itself is kept in a secure file only to be used for ensuring the preference remains in effect for every individual who has made their choice clear.  MyHealth will consider adjustments to the form in recognition of the stated concerns.

Becky:

This is in violation of the Bill of Rights of the Oklahoma Constitution, just as the last set of rules were.  Why are you going through the motions only to not correct your mistakes?

OHCA Response:

Please clarify you concerns. These rules allow providers the option to either make an application to join or register for an exemption, this is consistent with the statute.  If an exemption is asked for it will be given relieving the provider from any requirement to pay any fee or supply data. Additionally, The legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available.

Elizabeth:

Y’all failed to do your research and now every small healthcare business in OK is having to pay for it while you get to say, “no impact”, “no impact”… that’s utter nonsense AEB directly starring after that except providers will have a cost, course y’all make us jump through hoops to know what this cost that “won’t hurt us” is. y’all obviously thought $5k was chump change to OK LMHPs. It may be nothing to Mercy or RedRock but that’s a cost that closes businesses. We’re already having to pay for CPT codes now, rising costs for everything and y’all want to mandate, fee and fine us into oblivion. People will not want to be counselors in OK now cause of this crap, counselors are going to leave the profession/state like our teachers have now that you’ve brought politics into mental healthcare. Plus forcing us to go against the very foundation of recovery stands on confidentiality. I would love to know why OHCA & ODMHSAS left private businesses out of their research on the HIE impact? I’d also love to know why small businesses were left out of the round tables and not placed on any of their boards or in the discussion rooms from the beginning? 

OHCA Response:

The new rules provide for exemptions to anyone who asks for one. The previous rules allowed for exemptions for small and medium sized practices.  The legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available.  Confidentiality of mental health data is maintained as no mental health data can be shared unless the patient provides a signed consents and all patients have the option to opt-out of the HIE.  Anyone can be a part of the governance process and can request attendance to the MyHealth committee meeting by emailing (MyHealth@myhealthaccess.net.  You may also request engagement with the state coordinator for HIE at okshine@okhca.org.)

Concerned Mental Health Worker:

I request that these rules be changed to EXPLICITLY, AUTOMATICALLY exempt all mental health providers.   

OHCA Response:

Thank you for your feedback. Under the new proposed rules, all health care providers that register for an exemption will be granted such exemption, we will no longer broadly exclude a specific provider type. In order to be consistent with the directive of the statute all health care providers are asked to either submit an application for participation or register for an exemption. Also please note that if a mental health provider chooses to join the HIE and transmit their patient data, all data transmitted must be provided with a signed consent from the patient.  

Eduardo:

There are only 1 provider and 1 Candidate in our agency. How is this going to benefit the agency? If the cost is too high for connection and monthly fees, I don't think many agencies like the one, I work for would be able to afford. I personally see a confidentiality problem with this HIE system.

OHCA Response:

Thank you for your feedback.  Without knowing your provider type it’s difficult to provide specifics, however generally the ability to review the patients’ medical history and plan your care is a primary benefit and conversely providing information on the treatment you provided that might assist in the coordination of care by another provider who may be seeing the patient including circumstances such as an unexpected ER visit or hospitalization. 

The legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available. Monthly fees are minimal for an organization with 1 provider.  As stated in the rule’s subscription fees for those do not register for an exemption are determined based on the organization type and size.  A subscription fee schedule is established by the SDE based on network operating costs as approved by the SDE board and can be obtained upon request to the SDE, which is MyHealth (MyHealth@myhealthaccess.net)

Confidentiality, Privacy, and Security of health information is a top priority for the health information exchange. The state designated entity has been operating a health information exchange for over ten years and has substantial policies and procedures in place to ensure all health information received is closely guarded and monitored. All access to the system is governed by HIPAA and providers must be in a treatment relationship with a patient. In the case of mental health data this may only be shared to the HIE with the patients consent.  Extensive auditing is done to ensure providers adhere to this and a patient may request a list of all providers who have accessed their record. Additionally, the state designated entity has a governing board and several committees which are all made up of health care providers and health care organizations to ensure the data and uses thereof are appropriate in accordance with HIPAA. Additionally, patients may opt-out of the system by completing a MyHealth Opt-Out form at any time. All access to their past records and future records will be blocked from access within the HIE from all providers, with no disclosure of where, or what provider the request was made from.

Cathy:

I have been an Office Manager for 37 years. HIE, like "meaningful use and every other EHR system" out there is a joke. Where is HIPAA in this exchange of information? The information on EHR systems is only as good as the person entering it. We see mistakes ALL the time because these are "pre-made" reports with all kinds of info that never gets entered correctly, but it appears that the physician did a lot more than he/she actually did on that visit. This results in being filed with a higher E/M code than it actually was, resulting in higher payments, actually a form of fraud. I just received a report from another physician on myself. Whoever entered that information failed to enter the changes in my medication, which could be detrimental to my health. Happens ALL the time. 

Who sits around and dreams up these things? The physician I work for will be 73 years old in October. He has the largest SoonerCare roster in a 5-county area. He is older and types with 2 fingers. The office is still "paper charts". We have a hardship exemption to file "Paper Claims" with Medicare. We are penalized with lower payments since we are NOT meeting their EHR requirements, but he continues to see the patients. We do NOT use a clearing house to file our claims. They are done" in-house" to save that money.  He has 1 nurse practitioner and 5 employees. He would tell you he went to medical school to treat patients, not deal with all the bureaucracy this profession has been attacked with. If anyone needs medical records, they can easily be obtained by fax, since "medical to medical" does not require a HIPAA signature, unless someone has changed that law too. Due to HIPAA law we now have massive firewalls to protect everything on our computers. These computers are NEVER going to be able to link with one another. He will choose to retire rather than deal with HIE or EHR requirements. Then, what doctors are going to take all our SoonerCare patients? No physicians in this area wants them, that's why he has so many. What type of insurance they have does NOT affect his choice to treat. Their ability to pay does not affect his choice to treat. His father was a physician in Comanche, OK, sometimes being paid with chickens, eggs, fish, a pie, or other acts of kindness. This is what TRUE medical care looked like then and SHOULD now.

OHCA Response:

Thank you for your comments. With the new rules all health care providers are asked to either submit an application for participation or register for an exemption. If you register for an exemption, it will be granted, also please note that the new rules specifically states “A health care provider that does not currently own or subscribe to an electronic health records technology system or service is not required to acquire an electronic health records technology system or service and is removed from any requirement to report data to the SDE”.  It sounds like this provider fits into that category. All access to the system is governed by HIPAA and providers must be in a treatment relationship with a patient. In the case of mental health data this may only be shared to the HIE with the patients consent.  Extensive auditing is done to ensure providers adhere to this and a patient may request a list of all providers who have accessed their record. Additionally, the state designated entity has a governing board and several committees which are all made up of health care providers and health care organizations to ensure the data and uses thereof are appropriate in accordance with HIPAA. Additionally, patients may opt-out of the system by completing a MyHealth Opt-Out form at any time. All access to their past records and future records will be blocked from access within the HIE from all providers, with no disclosure of where, or what provider the request was made from.

Russell:

I am a small private practice barely recovering from the financial impact related to the Covid pandemic.  My practice consists of myself.  As a psychologist my patients have already brought up concerns about record sharing and getting mental health treatment that can be used against them.  Mental Health records contain sensitive information that should never be shared!  If forced to conform to this mandate, I fear it will be detrimental and deter those seeking help. 

OHCA Response:

Thank you for your comments. With the new rules all health care providers are asked to either submit an application for participation or register for an exemption. If you register for an exemption, it will be granted, and no fees are charged. The legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available. Confidentiality, Privacy, and Security of health information is a top priority for the health information exchange. The state designated entity has been operating a health information exchange for over ten years and has substantial policies and procedures in place to ensure all health information received is closely guarded and monitored. All access to the system is governed by HIPAA and providers must be in a treatment relationship with a patient. In the case of mental health data this may only be shared to the HIE with the patient’s consent.  Extensive auditing is done to ensure providers adhere to this and a patient may request a list of all providers who have accessed their record. Additionally, the state designated entity has a governing board and several committees which are all made up of health care providers and health care organizations to ensure the data and uses thereof are appropriate in accordance with HIPAA. Additionally, patients may opt-out of the system by completing a MyHealth Opt-Out form at any time. All access to their past records and future records will be blocked from access within the HIE from all providers, with no disclosure of where, or what provider the request was made from.

Erica:

Agree with Gov Stitt’s disapproval of rules.  HIE should be a voluntary opt-in program, by both providers/practices and patients.  That way there is no undue burden for processing all the exemptions that will be filed.  Communication to all providers needs to be clearer. Physicians and professionals have annual licensures, and we receive communication on that. Lack of inclusion from the major stakeholders is incredibly suspicious, especially if there are mandatory fees and “subscriptions”.  Did not expect to see such tyranny in Oklahoma. 

OHCA Response:

Thank you for your comments. With the new rules all health care providers are asked to either submit an application for participation or register for an exemption. If you register for an exemption, it will be granted, and no fees are charged. This is consistent with the directive of the statute that all health care providers are asked to either submit an application for participation or register for an exemption. Anyone can be a part of the governance process and can request attendance to the MyHealth committee meetings by emailing MyHealth@myhealthaccess.net.  You may also request engagement with the state coordinator for HIE at okshine@okhca.org. This office has made over 75 public presentations at association meetings and conferences over the last 10 months as well as spoke with dozens of providers individually. Additionally, The legislature has provided funding for the $5000 variable connection fee, and it is waived if a provider meets the grant criteria. That criterion is in development, but it is intended to be widely available.

Julia: 

This is unnecessary legislation. It is burdensome to implement, causes a financial hardship for smaller practices and mental health care is between a doctor/patient. As a psychiatrist, I always coordinate care with other medical professionals for continuity purposes anyway.  

Anonymous: 

Why would personal info about mental health need to be shared in a government database? That sounds like a HIPAA violation. It sounds like a back doorway to "Red Flag Laws". It sounds like it would just be a matter of time before that system gets hacked and personal data are leaked. There is absolutely no need to share that kind of information with federal, state, or local governments. That information should remain between the patient and the doctor. And whomever the patient wishes to share the information with. I'm just guessing but most would not want their medical or mental health information shared with the government. This is a terrible idea, a terrible use of taxpayer dollars and is only going to create more problems for WE THE PEOPLE than anything. What is the point of the government collecting all of this information anyways? 

Jordan: 

I agree with and appreciate the changes that all requests for exemption (from reporting data to the SDE and/or utilizing the HIE on the OKSHINE website) will be approved. I want to clarify that this means that exempt providers will be exempt from having to look up their clients/patients on the HIE (as doing so represents a HIPAA violation since the log of who viewed each client's chart can be viewed by others, essentially confirming that the patient is receiving treatment from whoever viewed their chart on the HIE). Previously, OHCA/MyHealth personnel stated that even those who were exempt from transmitting data would still have to look up their patients.

Jennifer: 

I am still not sure of how small agencies who provide a vital service for rural areas will meet the criteria once OHCA policy and rules are implemented. Will there be updates and emails on all changes?  

Kathy: 

If I were to seek mental health services, I would never want my information shared with any other provider. How can a person be open if they think they are talking to multiple people? I believe people who need services will be dropping out like flies. 

Leslye: 

I think the HIE should be an "opt in" rather than an "opt out" system.  It should be our right, as patients, that our medical records should be more protected, even in an emergency "break the glass" situation.  Especially in light of our rights as Oklahomans as is stated in the Oklahoma Constitution. 

Section II-37, B(1) states that "A law or rule shall not compel, directly or indirectly, any person, employer or health care provider to participate in any health care system."

Jason: 

On November 2 of 2010, the citizens of Oklahoma went to the polls to vote on State Question 756 to amend our state constitution.  This question added new rights regarding healthcare.  “A law or rule shall not compel, directly or indirectly, any person, employer or health care provider to participate in any health care system.”  This question passed with nearly 65% of the vote and and was added to Oklahoma’s constitution in section II-37.   (Everyone reading this, please Google what I am saying to confirm.  Don’t just take my word for it.)  Then in 2022 Senate Bill 1369 was passed by the legislature to mandate the use of the HIE which is clearly a healthcare system as defined by Oklahoma law - making it a law that cannot be enacted.

Regardless of what rules are enacted by OHCA, 1369 is irredeemably unconstitutional and must nullified.  No set of rules, no matter how lenient can rectify this fundamental problem with 1369.  The proposed rules outline that exemptions will be granted which is a major step in the right direction, but why should a provider have to ask the state for permission in the form of an exemption request rather than simply not participating out of free choice? 756 is very clear and very specific.  Furthermore, when an individual opts out of the HIE, it is made clear on the form that this personal data that the person does NOT want shared may still be shared in the event of an emergency.  This is also a violation section II-37 as it overrides the person's choice to not participate in a healthcare system.

I want to call upon OHCA, the Oklahoma legislature, and Governor Stitt to nullify and repeal 1369 and all rules to implement it and replace this unlawful bill with a bill that simplifies voluntary participation in the HIE for Oklahomans and health care providers alike as our state’s highest law requires.  

Durant Family Medicine Clinic: 

No health provider should be required to provide information per the State of Oklahoma Constitution.

Lisa: 

First, it is not logical that the "broad-based exemptions" for providers have been removed. Many licensed professionals do not provide direct client care & should not be required to submit an exemption form. They may, for example, provide organizational consultation, teach, or provide prevention services. This needs to be clarified. Relatedly, there are no official rules or procedures in place for exemptions despite the implied assumption that providers will proceed in applying for one. How can a provider make a decision about exemption with such limited information about the rules & guidelines, especially when we know "emergency rules" can be easily changed? Similarly, it is clear there are fees involved but they are not designated. Would you sign a contract to buy a car without knowing how much it will cost?

The rule impact statement is also not accurate--there IS an economic impact for those who must pay to connect to the HIE & pay a subscription fee. For mental health providers there IS an adverse effect on small business. Many mental health providers, for example, are planning to close their small business practices if required to participate in the HIE due to significant ethical & financial concerns. The ethical concerns are well-founded for many reasons, not the least of which is reflected in cybersecurity expert warnings about increasing healthcare data breaches. A recent (2023) Healthcare Dive article provided data showing that 385 million patient healthcare records have been exposed between 2010 and 2022 due to hacking, "unauthorized access/disclosure, theft, loss, [and] improper disclosure...". Given the state of Oklahoma's documented history in struggling to develop secure & reliable database systems, it is reasonable for providers to have serious concerns about ethics & security. Further, the loss of more healthcare providers in this state should cause concern for all citizens given the already inadequate resources & lengthy waitlists for services. These are just a few of my concerns...the entire emergency rule document is ambiguous & vague. 

Concerned Citizen: 

I am concerned that my medical records will be shared without my consent. I should be able to decide what medical information I want shared. It should be required that I consent to each of my providers sharing information. This should not happen without my explicit permission. 

Mary: 

What has prompted this next level Health Information Exchange policy.  Understanding the WHY may help with pushback from providers.  What risk is there not being a part of the HIE?

Fay

How can requiring health care providers to even file an exemption be constitutional? This needs to be purely an OPT-IN system. Having to file an exemption is compelling providers to participate if they do not.

Alan

I’ve worked in information technology for over 20 years and I have major concerns.

Earlier this year Washington DC Health Link was hacked.  Sensitive health data from members of the House and Senate were stolen.  A broker on an online crime forum claimed to have records on 170,000 DC Health Link customers and was offering them for sale for an unspecified amount. In an emailed statement members of congress were informed by Capitol Police that DC Health Link “suffered an extraordinarily large data breach of enrollee information” that posed a “great risk” to members, employees and their family members.  Heath Link thought their electronic security was the greatest thing since sliced bread, but somebody found a way in.  Something similar happened with Equifax when the names birthdates, driver’s license numbers, and social security numbers of 150 million Americans was stolen by hackers.  I know OHCA is satisfied with the current level of security, but as good as the mousetrap is, eventually a better mouse comes along to outsmart it.  I have found this to be true from my years of experience in the IT field.

I would like to hear OHCA tell the people of Oklahoma what the people can expect in the event  (regardless of how likely or unlikely) of such a breach of the HIE, what is the plan?  How would such a catastrophe be handled?  What remedies could the people of Oklahoma expect? 

Paulette

Question G. - The fees for connection to the HIE and ongoing yearly fees for participation in HIE do adversely impact small businesses as many mental health providers are either in a small group practice or in solo practice with limited income potential. While it is stated that participants may apply for a grant to "help" cover the cost of the initial connection fee, the amount of "help" is not defined and the word "help" implies the potential that the fees may not be covered entirely.

Question I. - While it is stated that the HIE will not have an adverse impact upon Oklahomans, this is misleading. Mental health providers have been considering leaving the profession should they be required to participate in HIE, which will have a very unfortunate impact upon Oklahomans seeking mental health care in a state where providers are already scarce.

The language of "shall" and "may" regarding provider participation is encouraging. OHCA is encouraged to remove any language mandating participation by mental health practitioners including removing the term "Mental Health" from those defined as Health Care Providers for the purpose of these rules. 

Becky

Why should I ask your permission to not participate, when that right is granted in the Oklahoma Constitution?(Section II-37).

Barry

I applied for an exemption long ago and did not receive an email by either date you mentioned with approval of an exemption. Also, I received an email today from a legislator stating regardless of the exemption, there are possibly additional requirements that will be in place for those who provide Medicaid and Medicare services. This whole thing has wasted the time of so many providers. 

Anonymous

Will agencies be able to opt out as a whole or will it need to be each individual provider within the agency?

Apollo

With the shortage of professionals in the state, it is curious why we are running new graduates, out of state possible graduate students, and professionals to a different state. Oklahoma is already a dangerous place for minorities; now it is going to foster an even greater divide on those who have the privilege to pay versus small minority business owners who are already have to pay extra in a variety of ways. Oklahoma seems to keep passing oppressive laws. This is part of that. 

Bob

1. Requiring medical service providers to submit medical records of patients to the HIE violates the Right of Privacy guaranteed by the U.S. Constitution.

2. The Emergency Rule is in direct conflict with Art. 2, Sec. 37 of the Oklahoma Constitution.

3. The Emergency Rule results in an unconstitutional tax.

4. Under the doctrine of delegata potestas non potest delegarai, the State of Oklahoma’s relinquishment of total control of the Health Information Exchange to a nongovernmental entity is contrary to the Oklahoma Constitution.

5. The Emergency Rule results in the unconstitutional taking of personal property without due compensation.

6. The Emergency Rule is a violation of the constitutional right of free speech.

7. The Emergency Rule is unconstitutionally vague.

8. The Emergency Rule is contrary to the statutes authorizing the HIE and therefore is void, unenforceable, and unconstitutional.

9. The Emergency Rule creates disparate treatment of members of the same class and therefore is a special law, in violation of the Oklahoma Constitution

Frederick

I am very pleased to see rules spell out any provider who wants an exemption may have one in black and white.     This was something I had been quite concerned about in recent months.  I just want to get that feedback out of the way first and foremost.

However, these rules are unconstitutional like the previous version.  Here’s why.  Let’s say Dr. Smith is an optometrist in Owasso.  Dr. Smith refuses to apply for the exemption or register for the HIE because he is such a rebel.  Not OHCA nor any other state agency may fine or penalize Doctor Smith under section II-37.  The law is clear: “A law or rule shall not compel, directly or indirectly, any person, employer or health care provider to participate in any health care system.”

This section of the Bill of Rights includes definitions so there is no question as to what this means.

Health care system: means any public or private entity whose function or purpose is the management of, processing of, enrollment of individuals for or payment for, in full or in part, health care services or health care data or health care information for its participants.  (The HIE would meet this definition)

Compel: shall include penalties or fines.

Penalties or fines: means any civil or criminal penalty or fine, tax, salary or wage withholding or surcharge or any named fee with a similar effect established by law or rule by a government- established, -created or -controlled agency that is used to punish or discourage the exercise of rights protected under this section.

Let’s pretend after months or years of not complying with these rules OHCA or the state takes action to fine or otherwise penalize Dr. Smith.     Next Dr. Smith would file a lawsuit in response to the action brought against him. It is easily foreseeable that the court see the plain text meaning of section II-37 applies here and rule in Dr. Smith’s favor. OHCA would have no legal ground to stand on to impose any penalty for Dr. Smith’s defiant non-compliance with the HIE. 

Rather than impose rules that the State of Oklahoma has no lawful ability to enforce and would only cost the taxpayers money in court costs I would suggest the rules reflect that willing providers are encouraged to opt in to improve the patient experience, while making it clear participation is 100% voluntary and no action shall be taken against any non-compliant provider.

Cassie 

This is ridiculous.  Behavioral/Mental health should be exempt in order to comply with Federal Behavioral Health licensing standards.  This is a complete breach of client confidentiality.  There should be a complete carve out for Mental Health, not just substance abuse treatment.  I work in  a University Counseling Center.  The legislature has cut budgets for higher ed so much that we are running on a very small budget and would not be able to pay to participate in this.  Please do a complete carve out for all mental health providers.

Martha

Fresenius Kidney Care (FKC) supports the flexibility that the revised rules provide for HCPs to participate in the HIE. 

Becky

The Oklahoma Constitution states “A law or rule shall not compel, directly or indirectly, any person, employer or health care provider to participate in any health care system.” 

Therefore, this is unconstitutional. Further, REQUIRING ANYONE to request an opt out is fruit of the poisonous tree.  Instead, you should make a rule that those who choose to participate may sign up to opt in.

Melanie

Ideally, it should be an "opt in" and not an "opt out". There appears to be few consumers and/or MH practitioners that are in support of this Bill. 

Dora 

Are individuals that do not practice whatsoever but still maintain their licensed legally required to register to the statewide HIE and pay fees? Or do they fall under the following:

 317:30-3-35: (d) required participation (2)Paragraph (d) of this Section shall not apply to:

(A) A health care provider that does not currently own or subscribe to an electronic health records technology system or service.

Herman

Form to apply for exemption link or information.

Rhys 

As a former Oklahoma State resident with medical records that still exist in the state. Why must I opt out when my state's laws and the federal laws prevent your state from illegally sharing my healthcare information?

Under federal and state laws where I live this means if your system has any kind of data compromise, it will be a VERY large class action lawsuit. This should be an OPT in ONLY with a waiver of HIPPA rights.

Jeremy

I support the proposed change to align with the Oklahoma Constitution allowing automatic exemptions that automatically renew.

Oklahoma Osteopathic Association

On behalf of our physician members, the Oklahoma Osteopathic Association appreciates the efforts of the OHCA administration and staff in crafting these proposed rules. We echo the concerns voiced by Governor Kevin Stitt regarding the security of patients’ data stored in a centralized database and controlled by a private corporation. The proposed rules do not alter that situation. These proposed rules also fail to address the Governor’s stated concern that the opt-out provision in the mandate, which is based in statute, places too much of a burden on patients. The Governor said he believes the previous proposed rules were likely unconstitutional: until the underlying question of the HIE statute’s constitutionality, which mandates the participation of all providers, has been addressed, we believe that rulemaking is premature and implementation of the HIE should be halted in the interest of Oklahoma’s patients and the physicians and healthcare workers who provide their care.

April

I am an Oklahoma psychologist not comfortable with effectively disclosing my patients’ mental health treatment information to every other provider in the state, particularly without obtaining patients’ explicit permission first.

I have researched requesting an exemption from HIE, but exemptions appear to be organization NPI-specific. My organization is the largest healthcare provider in the county; only a teeny-tiny percentage of its services are mental-health-related. How would you propose I protect my mental health and substance abuse patients' rights to be in charge of who does and doesn't know about their treatment? 

Rebecca

The demands made on practitioners is already too high and stressful.  Why create more stress for practitioners? There are so many concerns about the HIE.  Price of implementation and who should pay for this ($5000.00 to the state and $7030.00 to the EMR plus monthly fees) , confidentiality, creating a wide open window for a law suit because a practitioner did not look at records each time a patient is seen, so each visit is going to be impossible in regards to time, just too much stress. 

L

SB 1369 refers to all licensed providers in Oklahoma.  As a licensed SLP, I only provide services in a public school setting.  I am an employee of the district.  Does this bill apply to those of us providing services in a public school setting if we do not bill Medicaid?  

Concerned mental health patient

Granting exemptions is not sufficient, especially for mental health providers. Confidentiality is crucial for all medical relationships, especially in mental health, and that sacred trust must be protected. Exempt mental health care providers completely (not on a case-by-case basis) while providing an opt in if desired by the provider. The quality of my care (and thus my life) depends on 1) keeping mental health providers financially solvent (no mandated fees!) 2) keeping mental health care in OK confidential. OK residents are already struggling to find mental health care, and our providers must be valued and protected from both onerous financial mandates (how can that be legal?) and a threat to the confidentiality for their patients…that ethical commitment is a bedrock of the profession. 

Ross 

On the issue that after a patient opts out their data can still be transmitted on the HIE in the event of an “emergency” (as clarified by the opt out form);  where does the state of Oklahoma obtain the legal authority to do so?  In an emergency the police are forbidden from coming in my house and taking papers from my firesafe box by the 4th Amendment.  That would require a warrant from a judge, not a doctor declaring an emergency.  What is the difference?  The 4th Amendment because it grants right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.   (I would say medical records qualify as papers under the 4th Amendment.)

Can you point me to the exact statute that OHCA is looking at when claiming it is legal for the state of Oklahoma to override the will of the patient (who had submitted the opt out form) to collect private records (which are a digital form of papers) and transmit them from (utilizing a third party) one provider to another all without a warrant?

Is there anything at all the patients can do to secure his/her data to the extent that it could not be transmitted during an emergency and if so what are the steps to do so?

Kat

I have been unable to file for an exemption and the link provided here is not working.  Can I please get an exemption form?

Integrity Behavioral Medicine, PLLC

As a small business and currently not using electronic medical records we have filed for exemption. We understand it will be automatically renewed annually unless we choose to participate. We are in agreement with the general desirability of HIE in principle, but for mental health records we would endorse HIE be limited to medical information to be shared only with specific consent by each patient. The information of mental health (psychiatric) patients be limited to allergies, medical history, and medications. No other information including psychiatric diagnoses be entered in HIE unless requested by patient. Any and all information submitted to HIE needs to be transparent to patient/patient's guardian. We urge, as and when we decide to join HIE, the cost for connecting, maintaining, etc. be paid by the State Government and additionally grants be available to bear other costs. Thank you.

Mental health provider AND patient

I am glad that the rules have been changed so that anyone may request an exemption. However, I have a problem with the whole idea of the HIE altogether. The fact that our government is sharing our personal, sensitive data with a private (for profit) organization is troubling. I don't trust that it will be protected. Data hacks and breaches happen all the time.  Data is the new oil. It is sensitive, valuable and dangerous in the wrong hands. 

Matt

Topic: Public Comment – Support Health Information Exchange (HIE) Rules Re-Draft

On behalf of the Oklahoma State Medical Association (OSMA) representing organized medicine and nearly 4,000 physicians, residents and students statewide, many thanks to the Oklahoma Health Care Authority (OHCA) for facing the challenges associated with implementing a statewide Health Information Exchange (HIE). Your efforts have not gone unnoticed, and we continue to offer a helping hand to enhance health outcomes in Oklahoma.

Organized medicine is very pleased the OHCA heeded our concerns after the initial HIE Rules were rejected. The new proposed rules offer as much flexibility as possible and greatly expand the ability to receive a waiver. We also support the process by which grant funding for the initial connection cost will be paid directly to the SDE, rather than requiring providers to pay out of pocket and then be reimbursed. While we certainly agree that the goals of the HIE are laudable, there are still many unanswered questions and unfunded mandates for physicians statewide. As such, we support the proposed rules as they provide the maximum flexibility to physicians until such time as the Legislature can address these concerns.

Rules and regulations should never be created in a vacuum. During the most recent OHCA Board Meeting, Mr. Corbett mentioned that the Authority has been “working with groups” to develop the new emergency rules associated with HIE implementation. Please remember that organized medicine brings expertise and experience to the table which cannot be found elsewhere. As interested groups as well as enthusiastic partners, our organizations continue to offer professional guidance and will always be available to provide valuable input throughout any rule-making process.

Thank you for your effort. Please know and remember organized medicine is always available.

Sincerely,

Diane Heaton, MD, President

Oklahoma State Medical Association

Felissa

I’m a poli sci student at OU and after reading the rules and the area of the constitution being raised I have a few questions:

I understand that OHCA believes creating a loophole guaranteeing all exception requests is sufficient to satisfy the Oklahoma constitution.  Can OHCA explain why this would be so with the language of section II-37 which errs on the side of providers?   This question is specific to ”a law or rule shall not compel, directly or indirectly.”   Wouldn’t the court examine the plain text meaning of this phrase and look to your rules and find that these rules indirectly compel providers to obey them?  Are OHCA’s lawyers claiming requiring providers to apply for exemptions that will be guaranteed is not a rule that indirectly compels to participation?  Is the court expected to see it that way?   Can OHCA’s exact position on this issue be clarified?

What does OHCA plan to do to enforce these rules for providers who disobey them?  What are the penalties for non-compliance?  Would OHCA impose fines and attempt to use the court system compel providers to pay these fines and if so is it believed the courts would find fines or penalties (or any other punishment) to be lawful?  Is that something OHCA’s lawyers are claiming is a good idea?

I shall end with this.   With rights, two parties can’t split the baby and meet in the middle as if negotiating a contract.   You can’t take guaranteed rights under the Oklahoma constitution and take Senate Bill 1369 and compromise both into a hybrid solution the legislature and governor are happy with.  Rights don’t work that way, rights are black and white.  You either have a right or you do not.  State Question No. 756 (which added this to the bill of rights) represents the will of the people.   Any attempt to reduce it disrespects and dishonors all the voters who come out each election day and tells them their does not matter.   I advise honoring the constitution rather than undermining it.

Concerned physician

There should be no need for an exemption. If any HIE is kept it place it should be 100% voluntary and with OPT-IN (not opt out) participation for patients, physicians, and non-physician clinicians.