Law / United States / 
Arizona
Health information organizations: transfer of de-identified health information for research
Health information organizations, section 36-3805(C)
In force.
A de-identification rule binding public and private bodies.
- Obligation class
- Consent, Prohibition
- Audit expectation
- none
What it requires
- If you are a health information organization, do not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research, or for use as part of a set of data for an application for grant or other research funding, unless the health care provider obtains the individual's consent for the transfer (section 36-3805(C)).
- Have a health care provider participating in the organization document that it has provided a notice of transfer, in the form of the individual's signature showing the individual has received and read and understands the notice and consents to the transfer; the notice must be in at least twelve-point type and describe the purposes of the transfer (section 36-3805(C)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
The section requires the health care provider to document the notice of transfer by the individual's signature, and states no log duty on the organization.
- Kind
- None
- As of
What this law does
A health information organization is an organization that oversees and governs the exchange of individually identifiable health information among organizations according to nationally recognized standards, other than a health care provider, an entity subject to title 20 or a health plan, or a direct exchange between providers. De-identified health information has the same meaning as described in 45 CFR section 164.514.
A health information organization may not transfer individually identifiable health information or de-identified health information that is accessible through the health information exchange to any person or entity for the purpose of research or for use as part of a set of data for an application for grant or other research funding, unless the health care provider obtains consent from the individual for the transfer.
The health care provider must document the notice of transfer by the individual's signature, and the notice must be in at least twelve-point type and describe the purposes of the transfer. The chapter does not limit a health information organization's right or duty to exchange de-identified health information, in accordance with applicable law, by means other than through the health information organization.
When LexLint raises it
When your app profile says your app handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .