PUBLIC HEALTH Reports

Research

Public Health Reports

Vol. XX(X) 1-8

Reprints and permission: sagepub.com/journalsPermissions.nav DOI: 10.1177/00333549 17722994 journals.sagepub.com/home/phr

@SAGE

Transitioning From Paper to Digital: State Statutory and Regulatory Frameworks for Health Information Technology

Cason Schmit, jD'?, Gregory Sunshine, jpD', Dawn Pepin, JD, MPH!', Tara Ramanathan, JD, MPH?, Akshara Menon, JD, MPH', and Matthew Penn, JD, MLIS?

Abstract

Objectives: In all health system sectors, electronic health information (EHI) is created, used, released, and reused. We examined states’ efforts to address EHI uses in law to provide an understanding of the EHI legal environment.

Methods: Attorney researchers used WestlawNext to search for EHl-related statutes and regulations of the US states, US territories, and the District of Columbia in effect as of January 2014. The researchers independently catalogued provisions by the EHI use described in the law. Researchers resolved discrepancies through peer review meetings and recorded the con- sensus codes for each law.

Results: This study identified 2364 EHl-related laws representing 49 EHI uses in 54 jurisdictions. A total of 18 EH] uses were regulated by >10 jurisdictions. More than 750 laws addressed 2 or more EHI uses. Jurisdictions varied by the number of EHI laws in effect, with a mean of 44 laws. Texas had the most EHI laws (n = 145). Hawaii and South Carolina had the fewest (n = 14 each).

Conclusions: The EHI legal landscape is complex. The large quantity and diversity of laws complicate legal analysis, likely delay implementation of public health solutions, and might be detrimental to the development of emerging health information

technology. Research is needed to understand the effect of EHl-related laws.

Keywords

health information technology, health information, regulation, law

Although many health care providers had been slowly adopt- ing electronic health record systems for years, the Health Information Technology for Economic and Clinical Health Act, adopted in 2009, accelerated adoption of electronic health record systems among health care providers.'* The Act introduced incentives to encourage health care providers to adopt electronic health record systems and use the tech- nology meaningfully to promote health care efficiencies. Digitization of health information allows a single piece of health information to be used for several purposes simulta- neously.* For example, when a patient arrives at an emer- gency department with viral meningitis, a physician might use the electronic health information (EHI) to help treat the patient,’ a local health authority might learn about the meningitis diagnosis through a report generated from the electronic health record,’ the emergency department might use the electronic health record to evaluate the quality of its health care services,*” and the health care payer might use the electronic health record to determine provider quality

improvement incentives.'? The EHI might also be used to evaluate the effectiveness of meningitis treatment'''? and inform clinical decision making for meningitis treatment.'?

Many state statutes and regulations authorize and define the use of EHI. Practitioners often criticize these laws as complex and contradictory and point to them as barriers to

| Chenega Professional and Technical Services, LLC for Public Health Law Program, Office for State, Tribal, Local and Territorial Support, Centers for Disease Control and Prevention, Atlanta, GA, USA

? Department of Health Policy & Management, Texas A&M University School of Public Health, College Station, TX, USA

3 Public Health Law Program, Office for State, Tribal, Local and Territorial Support, Centers for Disease Control and Prevention, Atlanta, GA, USA

Corresponding Author:

Cason Schmit, JD, Department of Health Policy & Management, Texas A&M University School of Public Health, 212 Adriance Lab Rd, 306 SPH Administration Building, College Station, TX 77843-1266, USA.

Email: schmit@sph.tamhsc.edu

Public Health Reports XX(X)

using EHI.'*!° The objectives of our study were to (1) pro- vide a better understanding of the laws, which might answer the criticisms and reduce barriers to EHI use; (2) examine explicit references to EHI in US statutes and regulations; and (3) provide insights on the effect of health information technology regulation on important health system objectives, such as health information exchange and public health reporting.” We restricted the study to express references to focus on purposeful efforts to address legal issues associated with the transition from paper records to digital records.

Methods

We used WestlawNext*! to search for EHI-related statutory and regulatory legal provisions (laws) in the 50 US states, 3 US territories (Guam, Puerto Rico, and the US Virgin Islands), and the District of Columbia. We included laws if they related to (1) electronic information and (2) an indi- vidual’s health. We only included laws in effect on January 17, 2014. We used a search string to identify terms relating to electronic media, data, and health in sufficient proximity in a law’s text: (“[digital electronic computer internet web-based automated] /50 [health medical] /50 [record database]”). In addition, we added targeted terms and acro- nyms used for EHI (EHR [electronic health record], HIE [health information exchange], HIO [health information orga- nization], RHIO [regional health information organization], HIT [health information technology], “health information technology,” “health information exchange,” “health information organization”).

We included jurisdictions if the search terms returned at least | EHI law in the WestlawNext database. Using these criteria, we included 54 jurisdictions: the 50 US states, the District of Columbia, Guam, Puerto Rico, and the US Virgin Islands. Uses of EHI fall into 2 general categories: (1) uses that further a patient’s treatment (ie, primary EHI use) and (2) uses other than patient treatment (ie, secondary EHI uses).* We established primary and secondary use categories based on a literature review (conducted in January 2014) of scho- larly articles published on EHI since 2009 and on distin- guishable EHI uses described in the laws~” (Table 1). Two or 3 researchers independently interpreted and classified each identified legal provision by use category. The interco- der agreement rate for coding categories between any 2 coders ranged from 0.67 to 0.70 (ie, the total number of use category agreements divided by the sum of the agreement and disagreement totals). After coding sessions, we analyzed coding discrepancies and corrected them in meetings in which impartial arbiters assisted in making final determina- tions. We recorded the peer-reviewed consensus codes for each law in a database. This analysis took place between February 2014 and August 2015.

We assigned 2 types of codes to each law: main codes and cross-references. The main code of a law designated the general purpose of the EHI use reflected in the law or the general activity of the law’s focus. Laws that related to more

than 1 use of EHI were also assigned | or more cross- reference codes to indicate the additional EHI uses. For example, a law implementing a health information exchange that also authorized sharing information with immunization information systems would be assigned a health information exchange main code and an immunization information sys- tem cross-reference code. Although every law received a main code, not every law received a cross-reference code.

We used sections of a state’s codification of statutes and regulations (as subdivided by Westlaw) to count laws. Although the lengths of legal provisions as they appeared in WestlawNext varied, researchers did not subdivide longer legal provisions (which might be more complex in isolation) into smaller legal provisions. However, it was common for longer legal provisions to address multiple EHI uses, neces- sitating the use of cross-reference codes.

Results

Number of Provisions in Effect

We found 2364 EHI laws as of January 2014, of which 1306 (55%) were regulations and 1058 (45%) were statutes. The mean number of laws per jurisdiction was 43.7 (median = 37.5). The states with the most laws were Texas (n = 145), Oregon (n = 104), and California (n = 103). The states with the fewest EHI laws were South Dakota (n = 17), Delaware (n = 15), Hawaii (n = 14), and South Carolina (n = 14). Only 3 US territories had EHI laws—Guam (n = 2), Puerto Rico (n = 5), and the US Virgin Islands (n = 9)—all of which had the fewest EHI laws of all jurisdictions in the sample (Table 2).

We identified 49 discrete use categories for EHI in the collected laws. Of those, 5 use categories were assigned as main codes for 76% (1800 of 2364) of all laws: electronic health record: treatment (664 laws, 54 jurisdictions), payer (527 laws, 47 jurisdictions), health information exchange/ health information organization (298 laws, 38 jurisdic- tions), health information technology oversight (161 laws, 36 jurisdictions), and vital statistics (150 laws, 47 jurisdic- tions). Several more use categories were used as main codes in >20 jurisdictions, including anatomical gifts (51 laws, 44 jurisdictions), immunization information systems (37 laws, 20 jurisdictions), prescription drug-monitoring program (38 laws, 21 jurisdictions), and workers’ compensation (57 laws, 21 jurisdictions). Ten use categories were used as main codes only once, and 25 use categories were used as a main code <10 times.

We found 228 combinations of main codes and cross- reference codes; that is, unique combinations of a main code and the set of cross-references associated with the same law, including laws without any cross-references. An average EHI law had 0.44 cross-references in addition to the main code. Although 68% (1610 of 2364) of EHI laws did not have cross-references, 32% (754 of 2364)

Schmit et al 3

Table |. Laws related to electronic health information, by use category,” United States, January 2014?

Use Category No. of Laws No. of Jurisdictions With Laws Primary use* (main codes‘ only) Electronic health record: treatment 664 54 Education patient records 36 16 Correctional patient records 24 13 Secondary use* (main codes‘ only) Payer 527 47 Health information exchange/health information organization 298 38 Health information technology oversight 161 36 Vital statistics 150 47 Workers’ compensation 57 21 Anatomical gift 51 44 Prescription drug-monitoring program 38 21 Immunization information systems 37 20 Occupational health 32 12 Government records 30 12 Child support, child welfare, and foster care 29 18 Health care quality monitoring 27 17 Controlled substances 22 14 Cancer information system 18 13 Disease reporting 18 12 Mental and behavioral health reporting 15 I Advance directive information systems 12 9 Research and public use data 12 8 Birth defects information system 11 7 Accountable care organizations 10 6 Methamphetamine precursor tracking 10 7 Trauma information systems 9 7 Emergency medical services data reporting 7 4 Newborn blood screening 7 4 Administrative investigations 6 4 Child blood lead data 5 4 Health care services reporting 5 4 Public assistance 5 4 Health information in driver license records 3 I Laboratory reporting 3 2 Medical marijuana 3 3 Newborn hearing screening 3 3 Syndromic surveillance 3 3 Chronic disease information system 2 2 Dental identification records 2 2 Medical malpractice database 2 2 Birth-related neurological injury compensation I I Disease investigation | I Family planning reporting | I Government held breath testing records | I Health and hazardous substance registry | I Infectious disease epidemiology data system I I Mental health records used for gun purchases | I Property tax I I Voter registration | I Vulnerable populations registry | I Total 2364 54

*Primary use indicates information used for treatment purposes. Secondary use indicates uses of health information for purposes other than patient treatment. Laws collected using the WestlawNext database. Use categories were established from a literature review (conducted in January 2014) of articles published since 2009 and identification and distinguishable uses of electronic health information described in the laws.

“Main codes indicate the general purpose of the electronic health information reflected in the law or the general activity of the law’s focus.

4 Public Health Reports XX(X)

Table 2. Number of electronic health information statutes and regulations in the United States, as of January 2014

US State or Territory No. of Statutes No. of Regulations Total No. of Laws Alabama 8 20 28 Alaska 9 33 42 Arizona 21 22 43 Arkansas 17 38 55 California 68 35 103 Colorado 12 28 40 Connecticut 27 31 58 Delaware 4 I] 15 District of Columbia 9 13 22 Florida 27 33 60 Georgia 13 12 25 Guam | | 2 Hawaii 5 9 14 Idaho 7 26 33 Illinois 48 46 94 Indiana 12 I] 23 lowa 13 27 40 Kansas 15 17 32 Kentucky 15 21 36 Louisiana 23 31 54 Maine 16 19 35 Maryland 18 65 83 Massachusetts 30 29 59 Michigan 19 10 29 Minnesota 35 19 54 Mississippi 17 15 32 Missouri 2I 14 35 Montana 8 20 28 Nebraska 12 21 33 Nevada 23 10 33 New Hampshire 25 19 44 New Jersey 28 50 78 New Mexico 20 35 55 New York 24 23 47 North Carolina 19 16 35 North Dakota 22 8 30 Ohio 23 38 6l Oklahoma 19 31 50 Oregon 28 76 104 Pennsylvania 10 10 20 Puerto Rico 5 0 5 Rhode Island 22 29 5 South Carolina 7 7 14 South Dakota 7 10 17 Tennessee 19 4 60 Texas 75 70 145 Utah 20 17 37 Vermont 43 19 62 Virgin Islands 9 0 9 Virginia 21 17 38 Washington 25 36 61 West Virginia 14 32 46 Wisconsin 17 10 27 Wyoming 3 25 28

Total 1058 1306 2364

Schmit et al

of laws had >1 cross-reference (ie, addressed multiple uses of EHI).

Discussion

Our review of EHI laws in the United States that existed on January 17, 2014, showed that they were large in number. The sheer number of laws itself can be seen as a legal risk- management issue. For example, we identified 9 legal pro- visions addressing health information exchange in Arizona and 298 legal provisions nationally. Thus, a health informa- tion exchange software developer would need to synthesize the requirements in 9 legal provisions if the company restricted distribution to Arizona, or in 298 laws to distribute the software nationally.

The laws were also diverse. We found 49 distinct EHI use categories, indicating that these laws covered various uses, from anatomical gifts to vital statistics. Many laws had multiple purposes; nearly 1 in 3 addressed multiple EHI uses, with 228 combinations of main codes and cross- reference codes. This type of overlap complicates legal analysis. For example, a state’s health information exchange law might briefly mention the use of EHI for the state’s immunization registry. However, the state might have other provisions that regulate the use of immunization information system data that are not located in the health information exchange law. This means that laws relating to a specific EHI use might not be colocated in a state’s legal code, forcing attorneys to find and synthesize legal provi- sions across code titles and chapters.

Our study revealed great variation among jurisdictions. A total of 18 EHI uses were regulated by 10 or more jurisdic- tions. Among the 15 states within 300 miles of New Jersey, at least 11 oversight entities monitored health information exchanges, and none of these states had similar health infor- mation exchange-specific data-protection requirements (excluding 3 states without health information exchange- specific data protections).**>* Such jurisdictional variations can complicate efforts to apply national health information technology solutions to public health challenges.**

The overall complexity of these laws is especially proble- matic, because, even in the absence of such legal complexity, regulation of EHI presents unique challenges. Rapidly changing EHI technology is a moving target, with sudden and unpredictable developments.°° Complexity in regulation can exacerbate these challenges. In addition, EHI may be especially vulnerable to variations in regulation, in part because many future applications require the portability of EHI among different users.°° For example, EHI technology developers must consider legal variations if they want to distribute products across jurisdictional lines.

Our findings corroborate the complexity of health infor- mation legal issues documented by other researchers.'*!° Scholars have described the interactions between complex regulatory frameworks and emerging technology, noting that complex frameworks can stall technological development

and impair adaptation of regulatory oversight.°°°’>? Among other issues, the existence of multiple regulatory actors can raise the risk of duplicative, overlapping, or conflicting stan- dards that can create inconsistencies for agencies, users of the regulated technology, and other stakeholders.*° To avoid this risk, some observers have recommended regulatory approaches to emerging technologies that are sufficiently flexible to rapidly respond to new developments and infor- mation and can properly incorporate changing risks and ben- efits.°? The complexity of the current EHI legal landscape likely makes it quite inflexible. Governmental bodies cannot nimbly amend all 2300 EHI legal provisions with interrelated standards and restrictions on 49 EHI uses as EHI technology advances.

A 2004 review of a biotechnology governance framework in Australia puts our findings in perspective.°* The review identified 8 jurisdictional variations for 3 biotechnology-use cases as responsible for a major biotechnology company’s decision to terminate research operations. In comparison, our study identified 49 EHI-use cases in 54 jurisdictions.

Another potential consequence of complex legal frame- works is that EHI users will adopt conservative policies to lower the risk of legal violations. This practice may inhibit otherwise lawful uses and contribute to misconceptions about what the law actually authorizes or prohibits. For example, health care entities might adopt intraorganizational policies that are more restrictive than the requirements of the Health Insurance Portability and Accountability Act (HIPAA) to simplify compliance (eg, all health information is assumed to be identifiable and covered by HIPAA).°° In this way, complex frameworks can create implementation differences within a jurisdiction.

Nevertheless, some research has found that the number of state EHI laws may correlate to certain desirable health system outcomes. For example, using our data, Schmit et al*° found that the number of EHI laws relating to health information exchange was positively correlated with the percentage change in information-exchange activity in non- federal acute care hospitals. Similarly, the number of laws relating to health information technology oversight was positively correlated with the percentage of nonfederal acute care hospitals that electronically submitted syndromic surveillance, laboratory, and immunization data to local health departments. These findings highlight the need for further research on EHI uses.

Implications for De-Siloing Health Information

One common criticism of EHI is that it is heavily siloed, meaning that data are often stored in separate systems based on primary or secondary EHI use. Databases containing sim- ilar EHI types sometimes have minimal connectivity, which limits the ability to aggregate study data and can be a barrier to big-data analytical applications.°! The 754 laws addres- sing multiple EHI uses that we identified in our study might represent state efforts to reduce the barriers across EHI silos.

Public Health Reports XX(X)

For example, more than 60 laws with the health information exchange/health information organization main code had at least 2 cross-references. Some of these laws could represent legal efforts to use health information exchange organiza- tions and infrastructure to unify and connect various discrete EHI data systems, such as systems for public health report- ing, vital statistics, health care quality monitoring, and patient treatment records.

However, EHI databases are still heavily siloe and some laws with multiple codes may represent prohibitions on additional uses rather than permissions. In addition, what is permissible in law does not always reflect real-world practice. For example, in a recent study of health record access during an outbreak, public health officials struggled against legal misconceptions and consistently reported “perceived HIPAA barriers as a reason that health care facilities were hesitant to provide health departments with access to patient information,” despite the HIPAA rules permitting such a disclosure for public health purposes.'”"* Similarly, laws intended to de-silo EHI might not actually have that effect for various reasons, including misconcep- tions of perceived legal barriers.

61,62 d,

Limitations

This study had several limitations. First, it focused only on those laws that explicitly referenced EHI in their text. Some laws that do not explicitly reference EHI might still place legal requirements on the use of EHI. For example, a law that authorizes a health department to examine patient records during an outbreak would likely apply to electronic records, even though it never mentions electronic records explicitly.°'"°* Thus, our explicit reference requirement may have been an important limitation of this study. Sec- ond, the study focused on general categories, and we did not further analyze the content of specific provisions. For example, we evaluated whether states had laws relating to immunization information systems, but we did not evaluate the legal privacy requirements for the immunization infor- mation system. Subsequent phases of this research will explore these attributes in greater detail. Third, our reported counts of laws were not in standardized units. Some laws were longer or more complicated than other laws. The com- plexity of an individual state’s EHI framework should be interpreted with caution and in light of the number of unique EHI uses the state regulates and the laws that address multiple EHI uses.

Conclusions

This study demonstrates the size and diversity of the EHI legal landscape and corroborates the complexity of health information legal issues documented by other researchers.'*'® At the time of the study, more than 2300 laws governed EHI users in 54 jurisdictions. These laws addressed nearly 50 distinct EHI uses in 228 ways. The

number of laws in each jurisdiction and EHI uses addressed by those laws varied considerably. Health information tech- nology developers, entrepreneurs, and industry must reckon with this landscape if they seek to innovate on a national scale. It is no wonder that legal barriers to health informa- tion technology adoption and use are often discussed amor- phously, ambiguously, and without specificity. The EHI legal landscape is simply too complicated for succinct discussion and analysis.

It is often noted that health care has trailed other sectors in adopting information technology.” This study might provide insight as to why. The literature suggests that a complex landscape of laws might be detrimental to the development of emerging technology.°*°’>? This study provides empiri- cal evidence that a complex landscape of laws exists for EHI and health information technology.

Acknowledgments

The Centers for Disease Control and Prevention Public Health Law Program cannot provide legal advice on any issue and cannot rep- resent any individual or entity in any matter. The Public Health Law Program recommends seeking the advice of an attorney or other qualified professional with questions about the application of law to a specific circumstance. The findings and conclusions in this article are those of the authors and do not necessarily represent the official views of the Centers for Disease Control and Prevention.

Declaration of Conflicting Interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

The authors disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: Research conducted for this article was supported by the Oak Ridge Institute for Science and Education and the Centers for Disease Control and Prevention.

References

1. Ramanathan T, Schmit C, Menon A, Fox C. The role of law in supporting secondary uses of electronic health information. J Law Med Ethics. 2015;43(supp! 1):48-51.

2. Pub L No. 111-5, Div A, Title XIII, §13001 et seq, Div B, Title IV, §4001 et seq (2009).

3. Safran C, Bloomrosen M, Hammond WE, et al. Toward a national framework for the secondary use of health data: an American Medical Informatics Association white paper. J Am Med Inform Assoc. 2007;14(1):1-9.

4. Blumenthal D, Tavenner M. The “meaningful use” regulation for electronic health records. N Engl J Med. 2010;363(6): 501-504.

5. Hills RA, Lober WB, Painter IS. Biosurveillance, case report- ing, and decision support: public health interactions with a health information exchange. In: Zeng D, Chen H, Rolka H, Lober B, eds. Biosurveillance and Biosecurity. Berlin, Heidel- berg: Springer Berlin Heidelberg; 2008:10-21.

Schmit et al

10.

11.

12.

13.

14.

15.

16.

17.

18.

19.

20.

. Rajeev D, Staes CJ, Evans RS, et al. Development of an electronic

public health case report using HL7 v2.5 to meet public health needs. J Am Med Inform Assoc. 2010;17(1):34-41.

. Calderwood MS, Platt R, Hou X, et al. Real-time surveillance

for tuberculosis using electronic health record data from an ambulatory practice in eastern Massachusetts. Public Health Rep. 2010;125(6):843-850.

. Tang PC, Ralston M, Arrigotti MF, Qureshi L, Graham J.

Comparison of methodologies for calculating quality measures based on administrative data versus clinical data from an electronic health record system: implications for performance measures. J Am Med Inform Assoc. 2007;14(1):10-15.

. Gardner W, Morton S, Tinoco A, Scholle SH, Canan BD,

Kelleher KJ. Is it feasible to use electronic health records for quality measurement of adolescent care? J Healthc Qual. 2016; 38(3):164-174.

Dolin RH, Goodrich K, Kallem C, Alschuler L, Holtz P. Setting the standard: EHR quality reporting rises in prominence due to meaningful use. J Am Health Inf Manage Assoc. 2014;85(1): 42-48.

El-Gayar O, Timsina P. Opportunities for business intelligence and big data analytics in evidence based medicine. Paper pre- sented at: 47th Hawaii International Conference on System Sciences; January 6-9, 2014; Waikoloa, HI.

Pathak J, Simon G, Li D, et al. Detecting associations between major depressive disorder treatment and essential hypertension using electronic health records. AMIA Jt Summits Transl Sci Proc. 2014;2014:91-96.

Musen MA, Middleton B, Greenes RA. Clinical decision- support systems. In: Shortcliffe EH, Cimino JJ, eds. Biomedical Informatics. London, UK: Springer London; 2014:643-674. Pevnick JM, Claver M, Dobalian A, et al. Provider stakeholders’ perceived benefit from a nascent health information exchange: a qualitative analysis. J Med Syst. 2012;36(2):601-613.

Bomash K. Privacy and public health in the information age: electronic health records and the Minnesota Health Records Act. Minn J Law Sci Tech. 2009;10(1):117-141.

Grady A. Electronic health records: how the United States can learn from the French dossier medical personnel. Wisconsin Int Law J. 2012;30(2):374-400.

Terry N. To HIPAA, a son: assessing the technical, conceptual, and legal frameworks for patient safety information. Widener Law Rev. 2006;12(1):133-188.

Johnson SH, Ransom GM III. A guide to federal and state incentives for health care technology implementation. Md Bar J. 2013;46(2):4-11.

Association of State and Territorial Health Officials. Improving your access to electronic health records during outbreaks of healthcare-associated infections. http://www.astho.org/ Toolkit/Improving-Access-to-EHRs-During-Outbreaks. Pub- lished 2016. Accessed December 20, 2016.

Schmit C, Pepin D, Menon A. Assessing the impact of state laws related to electronic health information in the Centers for Medicare & Medicaid Services State Innovation Models Initia- tive. Paper presented at: NACCHO Annual Meeting; July 7-9, 2015; Kansas City, MO.

21.

22.

23. 24. 235% 26. 27. 28. 29. 30. 31. 32. 33: 34. 35. 36. bye 38. 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. 49. 50. 51. 52. 53. 54.

55.

56.

58.

59.

60.

Thomson Reuters. Thomson Reuters Westlaw. https://www. westlaw.com. Published 2017. Accessed June 23, 2017. Schmit C, Sunshine G, Menon A, Ramanathan T. Assessment of state laws related to electronic health information: scoping statement and protocol. Centers for Disease Control and Prevention. https://data.cdc.gov. In press.

Conn Stat §17b-59a et al (2016).

Del Stat Title 16 §806C (2016).

Del Stat Title 16 §1201 (2016).

Del Stat Title 16 §10301 et al (2016).

1 Del Admin Code 102-4.0 (2016).

Mass Stat 118] et al (2016).

Mass Stat 40 J §6D (2016).

Md Health Gen §19-143 (2016).

Md Health Gen §4-301 et al (2016).

Md Code Regs 10.25.18.01 et al (2016).

Md Code Regs 10.37.07.01 et al (2016).

Md Code Regs 10.25.06.06 (2016).

Me Stat Title 22 §1711-C (2016).

Me Stat Title 5 §19203 (2016).

Me Stat Title 5 §19203-D (2016).

Me Stat Title 34-B §1207 (2016).

NC Stat §90-414.1 et al (2016).

NH Stat §332-I:1 et al (2016).

NY Pub Health §206 (2016).

NY Pub Health §2959-A (2016).

10 NY Comp Codes R & Regs 300.1 et al (2016).

Ohio Stat §3798.01 et al (2016).

35 Pa Cons Stat §510.101 et al (2016).

RI Stat §5-37.7-1 et al (2016).

RI Admin Code 31-1-39:1 et al (2016).

Vt Stat Title 18 §9351 et al (2016).

Vt Stat Title 18 §9375 (2016).

Vt Stat Title 18 §9456 (2016).

Vt ADC 12-3-217:5370 §102.3 (2016).

W Va Stat §16-29B-6 (2016).

W Va Stat §16-29G-1 (2016).

Council of State and Territorial Epidemiologists. Surveillance/

informatics: Reportable Condition Kowledge Management System. 2017. http://www.cste.org/group/RCKMS. Published 2017. Accessed May 9, 2017.

Marchant GE, Abbott KW, Allenby BR. Innovative Govern- ance Models for Emerging Technologies. Cheltenham, UK: Edward Elgar Publishing; 2013.

The White House. Precision Medicine Initiative. https://obama whitehouse.archives.gov/node/333101. Published 2015. Accessed April 24, 2017.

Gervais D. The regulation of inchoate technologies. Houst Law Rev. 2010;47(3):665-705.

Ludlow K. Cultivating chaos: state responses to releases of genetically modified organisms. Deakin Law Rev. 2004;9(1): 1-40.

Mandel G. Regulating emerging technologies. Law, Innov Technol. 2009;1(1):75-88.

Quashie RY. Electronic health information: assessing the impact of law. Centers for Disease Control and Prevention