Health Exchange in the United States

Exchange or Health Insurance Exchange in Health Care Law

A definition of Exchange or Health Insurance Exchange is available here: The Affordable Care Act requires each state to create a Health Benefit Exchange (competitive insurance marketplace), where individuals and small employers can shop for health plans. Exchanges will assist individuals and small businesses in comparing and purchasing qualified health plans. If a state decides not to establish and Exchange, the federal government will establish an Exchange in that state.

Health Information Exchange

While health information organizations offer benefits to participants and patients, they also introduce unique challenges with respect to managing privacy and security practices and policies. The health information organization and its participants are responsible to comply with the laws protecting the privacy of mental health and substance use disorder patient-identifying information as it moves within the health information organization and participants’ health information systems.

Some health information organizations in California simply provide the services and infrastructure to pass information between health information organization participants. Other health information organizations maintain databases to store data and use security safeguards that appropriately controls participant access to the data. The health information organization-based scenarios that follow assume the latter approach.

42 C.F.R. Part 2 regulations permit patient information disclosure to health information organizations and other health information exchange systems. The regulation contains specific requirements for the disclosure of information by substance use disorder treatment programs. With some exceptions, patient authorization is required. [42 U.S.C. § 290dd-2; 42 C.F.R. Part 2.]

Patient authorization is required to allow an HIO to disclose the 42 C.F.R. Part 2 information to
other health information organization affiliated members, with certain exceptions. A written statement indicating the information disclosed is protected by federal law and cannot be further disclosed unless permitted by
regulations must accompany each disclosure made with patient authorization. Information
disclosed electronically must have an accompanying electronic notice prohibiting re-disclosure.
Under 42 C.F.R. § 2.32, the statement must read:

“This information has been disclosed to you from records protected by federal confidentiality
rules (42 C.F.R. Part 2). The federal rules prohibit you from making any further disclosure of
information in this record that identifies a patient as having or having had a substance use
disorder either directly, by reference to publicly available information, or through verification of
such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted
by 42 C.F.R. Part 2. A general authorization for the release of medical or other information is
NOT sufficient for this purpose (see §2.31). The federal rules restrict any use of the information
to investigate or prosecute with regard to a crime any patient with a substance use disorder,
except as provided at §§2.12(c)(5) and 2.65.“

Related regulations include:
• 42 C.F.R. § 2.11.
• 42 C.F.R. § 2.12(a)(1).
• 42 C.F.R. § 2.12(c)(4).
• 42 C.F.R. § 2.31(a).
• 42 C.F.R. § 2.32.
• 45 C.F.R. § 164.308(b).
• 45 C.F.R. § 164.314(a).
• 45 C.F.R. § 164.501.
• 42 U.S.C. § 290dd-2