SB250 - Revises provisions relating to health care records. (BDR 40-70)

EXEMPT (Reprinted with amendments adopted on April 21, 2025) FIRST REPRINT S.B. 250 - *SB250_R1* SENATE BILL NO. 250–SENATORS LANGE; CRUZ-CRAWFORD AND OHRENSCHALL FEBRUARY 27, 2025 ____________ Referred to Committee on Health and Human Services SUMMARY—Revises provisions relating to health care records. (BDR 40-70) FISCAL NOTE: Effect on Local Government: May have Fiscal Impact. Effect on the State: Yes. CONTAINS UNFUNDED MANDATE (§§ 3, 8, 12, 15) (NOT REQUESTED BY AFFECTED LOCAL GOVERNMENT) ~ EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted. AN ACT relating to health care; requiring certain entities to allow a patient to take certain actions relating to access to his or her electronic health records; requiring the adoption of regulations to minimize the need for a patient to repeatedly provide certain information; providing that the health records of a patient are the property of a patient; requiring the Director of the Department of Health and Human Services to compile certain reports; providing a penalty; and providing other matters properly relating thereto. Legislative Counsel’s Digest: Existing law prescribes various requirements governing health information 1 technology and the electronic maintenance, transmittal and exchange of electronic 2 health records and certain other electronic health information. (NRS 439.581- 3 439.597) Upon the request of a person who is authorized to request a copy of health 4 records that are maintained electronically, existing law requires a custodian of 5 health care records to electronically transmit a copy of the health records to any 6 person or entity for a fee. (NRS 629.062) Section 15 of this bill provides that the 7 health care records of a patient are the property of the patient, and section 3 of this 8 bill requires a health care provider to allow a patient to: (1) access and forward his 9 or her electronic health records without a fee or charge; and (2) request that his or 10 her electronic health records be forwarded to any other person or entity in 11 accordance with existing law. Section 8 of this bill makes a conforming change to 12 remove a requirement that the Director of the Department of Health and Human 13 – 2 – - *SB250_R1* Services adopt regulations governing the ownership of electronic health records 14 because section 15 establishes that such records are the property of the patient. 15 With certain exceptions, existing law requires a health care provider, health 16 insurer, health insurance administrator and certain other entities to authorize a 17 person to opt out of having his or her individually identifiable health information 18 disclosed electronically to health care providers, insurers and certain other entities. 19 (NRS 439.597) Section 10 of this bill requires those persons and entities to allow a 20 patient to prohibit any person or entity from accessing his or her individually 21 identifiable health information, with similar exceptions. Section 5 of this bill makes 22 a violation of section 3 or 10, or any regulations adopted to carry out those 23 sections, a misdemeanor. A health care provider, health insurer or health insurance 24 administrator that commits such a violation would also be subject to administrative 25 sanctions. (NRS 439.589, 439.5895, 449.167, 450B.215, 629.051, 680A.225, 26 683A.0891, 695C.329) 27 Existing law requires the Director to adopt regulations that prescribe a 28 framework for the electronic maintenance, transmittal and exchange of electronic 29 health records, prescriptions, health-related information and electronic signatures. 30 Existing law requires state and local governmental entities, health care providers 31 and insurers and certain related entities to maintain, transmit and exchange health 32 information in accordance with that framework, with certain exceptions. (NRS 33 439.589) Existing law establishes that physician group practices and other business 34 entities organized for the purpose of practicing a health care profession with 20 or 35 fewer employees are not required to comply with those provisions until January 1, 36 2030. (Section 2.8 of chapter 278, Statutes of Nevada 2023, at page 1859) Section 37 8 requires the regulations adopted by the Director to include requirements to 38 minimize the need for a patient to repeatedly provide demographic information, 39 information relating to his or her medical history and the list of medications that the 40 patient is currently taking or has taken in the past. A health care provider who fails 41 to comply with those regulations would be subject to administrative sanctions but 42 would not be guilty of a misdemeanor. (NRS 439.589, 439.5895, 449.167, 43 450B.215, 629.051) Sections 5-7, 9, 10, 12-14 and 16 of this bill make conforming 44 changes to: (1) clarify the applicability of section 3 and certain provisions of 45 existing law; and (2) indicate the proper placement of section 3 in the Nevada 46 Revised Statutes. During the 2026 calendar year, section 16.5 of this bill requires 47 the Director of the Department to publish and submit to the Governor and the 48 Legislature a quarterly report concerning the progress of the Department toward 49 implementing the provisions of this bill. Section 16.5 also requires the Director or 50 his or her designee to appear before the Joint Interim Standing Committee on 51 Health and Human Services or the Legislative Commission upon request to provide 52 information concerning the reports. 53 THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Section 1. Chapter 439 of NRS is hereby amended by adding 1 thereto the provisions set forth as sections 2, 3 and 4 of this act. 2 Sec. 2. (Deleted by amendment.) 3 Sec. 3. A health care provider shall: 4 1. Allow a patient unimpeded, secure access to his or her 5 electronic health records without a fee or charge. 6 – 3 – - *SB250_R1* 2. Allow a patient to forward his or her electronic health 1 records to any other person or entity without a fee or charge. 2 3. Ensure that, upon the request of a patient to furnish his or 3 her electronic health records to himself or herself or another 4 person or entity, the electronic health records of the patient are 5 transmitted to the requested person or entity in accordance with 6 NRS 629.062. 7 Sec. 4. (Deleted by amendment.) 8 Sec. 5. NRS 439.580 is hereby amended to read as follows: 9 439.580 1. Any local health officer or a deputy of a local 10 health officer who neglects or fails to enforce the provisions of this 11 chapter in his or her jurisdiction, or neglects or refuses to perform 12 any of the duties imposed upon him or her by this chapter or by the 13 instructions and directions of the Division shall be punished by a 14 fine of not more than $250. 15 2. Except as otherwise provided in NRS 439.589, each person 16 who violates any of the provisions of this chapter or refuses or 17 neglects to obey any lawful order, rule or regulation of the: 18 (a) State Board of Health or violates any rule or regulation 19 approved by the State Board of Health pursuant to NRS 439.350, 20 439.366, 439.410 and 439.460; or 21 (b) Director adopted pursuant to NRS 439.581 to 439.597, 22 inclusive, and section 3 of this act, 23  is guilty of a misdemeanor. 24 Sec. 6. NRS 439.581 is hereby amended to read as follows: 25 439.581 As used in NRS 439.581 to 439.597, inclusive, and 26 section 3 of this act, unless the context otherwise requires, the 27 words and terms defined in NRS 439.582 to 439.585, inclusive, 28 have the meanings ascribed to them in those sections. 29 Sec. 7. NRS 439.588 is hereby amended to read as follows: 30 439.588 1. A health information exchange shall not operate 31 in this State without first obtaining certification as provided in 32 subsection 2. 33 2. The Director shall by regulation establish the manner in 34 which a health information exchange may apply for certification and 35 the requirements for granting such certification, which must include, 36 without limitation, that the health information exchange demonstrate 37 its financial and operational sustainability, adherence to the privacy, 38 security and patient consent standards adopted pursuant to NRS 39 439.589 and capacity for interoperability with any other health 40 information exchange certified pursuant to this section. 41 3. The Director may deny an application for certification or 42 may suspend or revoke any certification issued pursuant to 43 subsection 2 for failure to comply with the provisions of NRS 44 439.581 to 439.597, inclusive, and section 3 of this act or the 45 – 4 – - *SB250_R1* regulations adopted pursuant thereto or any applicable federal or 1 state law. 2 4. When the Director intends to deny, suspend or revoke a 3 certification, he or she shall give reasonable notice to all parties by 4 certified mail. The notice must contain the legal authority, 5 jurisdiction and reasons for the action to be taken. A health 6 information exchange that wishes to contest the action of the 7 Director must file an appeal with the Director. 8 5. The Director shall adopt regulations establishing the manner 9 in which a person may file a complaint with the Director regarding a 10 violation of the provisions of this section. 11 6. The Director may impose an administrative fine against a 12 health information exchange which operates in this State without 13 holding a certification in an amount established by the Director by 14 regulation. The Director shall afford a health information exchange 15 so fined an opportunity for a hearing pursuant to the provisions of 16 NRS 233B.121. 17 7. The Director may adopt such regulations as he or she 18 determines are necessary to carry out the provisions of this section. 19 Sec. 8. NRS 439.589 is hereby amended to read as follows: 20 439.589 1. The Director, in consultation with health care 21 providers, third parties and other interested persons and entities, 22 shall by regulation prescribe a framework for the electronic 23 maintenance, transmittal and exchange of electronic health records, 24 prescriptions, health-related information and electronic signatures 25 and requirements for electronic equivalents of written entries or 26 written approvals in accordance with federal law. The regulations 27 must: 28 (a) Establish standards for networks and technologies to be used 29 to maintain, transmit and exchange health information, including, 30 without limitation, standards: 31 (1) That require: 32 (I) The use of networks and technologies that allow 33 patients to access electronic health records directly from the health 34 care provider of the patient and forward such electronic health 35 records electronically to other persons and entities; and 36 (II) The interoperability of such networks and 37 technologies in accordance with the applicable standards for the 38 interoperability of Qualified Health Information Networks 39 prescribed by the Office of the National Coordinator for Health 40 Information Technology of the United States Department of Health 41 and Human Services; 42 (2) To ensure that electronic health records retained or shared 43 are secure; 44 – 5 – - *SB250_R1* (3) To maintain the confidentiality of electronic health 1 records and health-related information, including, without 2 limitation, standards to maintain the confidentiality of electronic 3 health records relating to a child who has received health care 4 services without the consent of a parent or guardian and which 5 ensure that a child’s right to access such health care services is not 6 impaired; 7 (4) To ensure the privacy of individually identifiable health 8 information, including, without limitation, standards to ensure the 9 privacy of information relating to a child who has received health 10 care services without the consent of a parent or guardian; 11 (5) For obtaining consent from a patient before retrieving the 12 patient’s health records from a health information exchange, 13 including, without limitation, standards for obtaining such consent 14 from a child who has received health care services without the 15 consent of a parent or guardian; 16 (6) For making any necessary corrections to information or 17 records; 18 (7) For notifying a patient if the confidentiality of 19 information contained in an electronic health record of the patient is 20 breached; 21 (8) Governing the ownership, management and use of 22 [electronic health records,] health-related information and related 23 data [;] and the management and use of electronic health records; 24 and 25 (9) For the electronic transmission of prior authorizations for 26 prescription medication; 27 (b) Ensure compliance with the requirements, specifications and 28 protocols for exchanging, securing and disclosing electronic health 29 records, health-related information and related data prescribed 30 pursuant to the provisions of the Health Information Technology for 31 Economic and Clinical Health Act, 42 U.S.C. §§ 300jj et seq. and 32 17901 et seq., the Health Insurance Portability and Accountability 33 Act of 1996, Public Law 104-191, and other applicable federal and 34 state law; and 35 (c) Be based on nationally recognized best practices for 36 maintaining, transmitting and exchanging health information 37 electronically. 38 2. The standards prescribed pursuant to this section must 39 include, without limitation: 40 (a) Requirements for the creation, maintenance and transmittal 41 of electronic health records; 42 (b) Requirements for protecting confidentiality, including 43 control over, access to and the collection, organization and 44 – 6 – - *SB250_R1* maintenance of electronic health records, health-related information 1 and individually identifiable health information; 2 (c) Requirements for the manner in which a patient may, 3 through a health care provider who participates in the sharing of 4 health records using a health information exchange, revoke his or 5 her consent for a health care provider to retrieve the patient’s health 6 records from the health information exchange; 7 (d) A secure and traceable electronic audit system for 8 identifying access points and trails to electronic health records and 9 he [Text truncated for display. Full text available on LegiScan.]