How Patient Opt Out Works

Zus Uses a “Default Opt In” HIE Model

As permitted by HIPAA (45 CFR 164.506), Zus generally operates on a “default opt in” basis for the health information exchanges in which it participates, the health information networks to which it is connected, and for all of the health care organizations that are directly connected to the Zus Platform (collectively, the “Zus Network”). This means that when you access or share Patient Data through a patient’s ZAP (or Zus Aggregated Profile) the patient is automatically opted in to sharing with organizations connected to the Zus Network without the patient needing to sign a specific HIE consent or release of information form.

Two Types of Exceptions to “Default Opt In”

There are two situations where Zus cannot enable “default opt in” to sharing and access of information from a patient’s ZAP. First, any information that has been tagged as Specially Regulated Data (e.g., HIV status, psychotherapy notes, mental health information, substance use disorder information) included in the ZAP may not be shared without a specific patient consent. Second, in a few states certain HIE activities may only be enabled if a patient signs an HIE consent. In these states, Zus does not enable data access or sharing through the patient’s ZAP unless the Builder indicates they have obtained a valid HIE consent.

Patients Can Opt Out at Any Time

Because Zus is committed to the principle of respecting individual choice, Zus enables patients to opt out of data sharing through the Zus Network if they choose. Zus has published a Patient Notice that introduces Zus, describes how we enable sharing of the patient’s health records, and explains how a patient can opt-out of their information being shared with healthcare organizations that participate in the Zus Network. If a patient decides to opt out, they must either complete the Zus Opt Out Form and send it directly to Zus, or complete the Builder’s HIE opt out process.

Implementation Guidelines

At a minimum, Zus encourages Builders to include a description of Zus in their HIPAA Notice of Privacy Practices. Builders may also provide their patients with a copy of the Zus Patient Notice. Zus recommends that Builders direct patients who wish to opt out of sharing through Zus to complete the Zus Opt Out Form and submit it to Zus for processing. Conversely, if a Builder already has an HIE opt out form and process for processing that form, Zus enables a Builder to identify patients for whom the Builder has separately collected an HIE opt out form through the process outlined below.

If you maintain your own opt-out process and receive a request from a patient, please submit a ticket to [email protected] with the following information:

1. The patient’s Zus Universal Patient Identifier (UPID)
2. The date of the opt-out request
3. The scope of the opt-out request:
   1. The patient opts out of data sharing only; they still allow retrieval of data from third-party networks, OR
   2. The patient opts out of both data sharing and retrieval of data from third-party networks