Skip to Content

Notice of health information practices, A.R.S. § 36-3804

Link to the law
This will open in a new window

“Notice of health information practices”
Health Information Organizations (HIOs) must establish a notice of health information practices that specifies the information that an HIO collects, the persons that can access individually identifiable information, and the purposes for which information maintained by the HIO may be accessed. The notice must also state that an individual has the right to opt out of HIO participation and describe the procedures for opting out. Finally, the notice must inform the patient that the Arizona Constitution protects patients’ rights to not have their individually identifiable information shared by an HIO.
HIOs must post the most recent copy of their notice of health information practices on their website and send a copy of the notice to individuals that request a copy. Providers that participate in an HIO must give patients a copy of the HIO’s notice of health information practices before or during the first patient encounter. Providers must also document that a patient has received and understood the notice. Providers must redistribute the notice during if the HIO makes material changes
HIOs must stop access to an individual’s information within 30 days of the individual opting out.