Bill > S222

This bill aims to clarify and enhance privacy protections for electronic health records (EHRs). It includes the following key provisions: 1. It gives patients the option to allow only designated healthcare providers to share their individually identifiable health information with statewide interoperable EHR networks or health information exchanges. 2. It requires any plan for a statewide interoperable EHR network or health information exchange to conduct annual privacy and security audits, and report any violations to the Attorney General. 3. It empowers the Health Information Technology Council to promulgate rules and regulations, including defining key terms like "identifiable health information" and "unauthorized access/disclosure." 4. It allows individuals to bring civil actions against EHR networks, exchanges, and participating entities for failing to maintain privacy and security protections or permitting unauthorized access/disclosure of their health information. It also allows the Attorney General to enforce these obligations. 5. It establishes monetary damages, including liquidated and punitive damages, for violations, as well as provisions to protect whistleblowers who report such violations. Overall, this bill aims to strengthen the legal framework for protecting the privacy and security of electronic health records in Massachusetts.

Business and Industry

https://malegislature.gov/Bills/191/S222