NRS439.590. Requirements for participation in system; limitations on use, release or publication of certain information; penalty for unauthorized access to electronic health record, system or health information exchange; establishment of complaint system.

      1.  A health care provider, insurer or other payer that elects to participate in the statewide health information exchange system must agree to comply with all requirements prescribed by the Director and imposed by the governing entity established or contracted with pursuant to NRS 439.588.

      2.  A health care provider may not be required to participate in the statewide health information exchange system and may not be subject to any disciplinary action for electing not to participate in the system.

      3.  The Director may prohibit a person from participating in the statewide health information exchange system if the person does not comply with the provisions of NRS 439.581 to 439.595, inclusive, or the requirements prescribed by the Director and imposed by the governing entity established or contracted with pursuant to NRS 439.588.

      4.  Except as otherwise authorized by the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, a person shall not use, release or publish:

      (a) Individually identifiable health information from an electronic health record or the statewide health information exchange system for a purpose unrelated to the treatment, care, well-being or billing of the person who is the subject of the information; or

      (b) Any information contained in an electronic health record or the statewide health information exchange system for a marketing purpose.

      5.  Individually identifiable health information obtained from an electronic health record or the statewide health information exchange system concerning health care services received by a child without the consent of a parent or guardian of the child must not be disclosed to the parent or guardian of the child without the consent of the child which is obtained in the manner established pursuant to NRS 439.589.

      6.  A person who accesses an electronic health record, the statewide health information exchange system or a health information exchange without authority to do so is guilty of a misdemeanor and liable for any damages to any person that result from the unauthorized access.

      7.  The Director shall adopt regulations establishing the manner in which a person may file a complaint with the Director regarding a violation of the provisions of this section. The Director shall also post on the Internet website of the Department and publish in any other manner the Director deems necessary and appropriate information concerning the manner in which to file a complaint with the Director and the manner in which to file a complaint of a violation of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.

      (Added to NRS by 2011, 1757)