HealthShare Exchange (HSX) operates as an Opt-Out model in alignment with the Commonwealth of Pennsylvania, meaning patients have the right to block electronic access to their information through HSX.
For entities using Direct Secure Messaging only, no patient consent is required. Entities participating with Encounter Notification Services are required to notify patients of their participation with HSX. One option is to update their HIPAA Notice of Privacy Practices (NPP) to include their participation with a specific health information exchange. Suggested NPP language can be found here.
In addition, some protected health information must have a patient consent to share, such as mental health treatment, alcohol and drug treatment, and HIV/AIDS status information. As HSX expands its membership to include entities with primarily this type of information, it looks to do so in a legally responsible way. Please refer to our Consent Management Guidelines if you have questions about the consent approach for protected health information.