Title 67 W. Va. C.S.R.

Human Services Human Services

W. Va. Code R. § 67-1-1 General

1.1. Scope. -- This rule establishes requirements to facilitate (1) the exchange of data and information with the Office of Drug Control Policy, the Department of Health and Human Resources, its successors, and its bureaus, the Department of Military Affairs and Public Safety, the Department of Administration, the Administrator of Courts, the Poison Control Center, the Office of National Drug Control Policy, the Board of Pharmacy, law enforcement, local health departments, and emergency medical service agencies in each county; and (2) the reporting of overdoses by law enforcement agencies, including state, county, and local police departments, health care providers, emergency response providers, medical examiners, and hospital emergency rooms.

1.2. Authority. -- W. Va. Code §16-5T-5.

1.3. Filing Date. -- June 18, 2024.

1.4. Effective Date. -- June 18, 2024.

1.5. Sunset Provision. -- This rule shall terminate and have no further force or effect on August 1, 2029.

1.6. Repeal and Replace. -- This legislative rule repeals and replaces WV 69CSR14 filed and effective April 13, 2020, pursuant to HB2006 passed during the 2023 Regular Legislative Session and effective May 23, 2023.

1.6.1.7. Applicability. -- This rule applies to the Office of Drug Control Policy, the Department of Health and Human Resources, its successors, and its bureaus, the Department of Military Affairs and Public Safety, the Department of Administration, the Administrator of Courts, the Poison Control Center, the Board of Pharmacy, law enforcement agencies, health care providers, emergency response providers, medical examiners, and hospital emergency rooms.

1.8. Background. -- The West Virginia Drug Control Policy Act (hereinafter referred to as “the Act”), amended during the 2023 Regular Legislative Session, continued the Office of Drug Control Policy (ODCP) within the Department. The director of the ODCP is administratively housed in the Department of Human Services, directly reports to the Office of the Governor, and works in cooperation with the State Health Officer, the Bureau for Public Health, and the Bureau for Behavioral Health. The ODCP is charged with creating a state drug control policy in coordination with the bureaus of the department and other state agencies. This policy must include all programs which are related to the prevention, treatment, and reduction of alcohol abuse, substance use disorder, and the use of tobacco.

The ODCP is required to (1) develop and implement a program to collect and store data from law enforcement agencies, emergency medical services, health care providers, and the Office of the Chief Medical Examiner on fatal and nonfatal overdoses caused by abuse and misuse of prescription and illicit drugs; (2) develop and implement a program that requires the collection and storage of data from law enforcement agencies, emergency medical services, health care providers, the Office of the Chief Medical Examiner, and other entities as required by the ODCP on the dispensing and use of an opioid antagonist; and (3) facilitate the collection and storage of data and issues.

Finally, the ODCP is authorized to exchange necessary data and information with the bureaus within the department, the Department of Military Affairs and Public Safety, the Department of Administration, the Administrator of Courts, the Poison Control Center, the Office of National Drug Control Policy, and the Board of Pharmacy. This data and information may include, but is not limited to, data from the Controlled Substance Monitoring Program; the criminal offender record information database; and the court activity record information.

1.9. Purpose. -- The purpose of this rule is to prescribe requirements for the collection of data and issues on fatal and nonfatal overdoses, caused by abuse and misuse of prescription and illicit drugs, and the exchange of data and information with the Department of Health and Human Resources, and its successors, the Department of Military Affairs and Public Safety, the Department of Administration, the Administrator of Courts, the Poison Control Center, and the Board of Pharmacy. The data and information may include, but is not limited to, data from the Controlled Substance Monitoring Program; the all-payer claims database; the criminal offender record information database; and the court activity record information.

Additionally, this rule contains requirements for health care providers; medical examiners; law enforcement agencies, including state, county, and local police departments; emergency response providers, and hospital emergency rooms to report all overdoses to the ODCP within 24 hours after the provider responds to the incident and via an appropriate information technology platform.

W. Va. Code R. § 67-1-2 Definitions

2.1. “Data and information” means a collection of numbers, characters, images, or other outputs from devices to convert physical quantities into symbols or images. Data includes, but is not limited to, numbers, words, and images. Data is typically further processed by a human or entered into a computer (input), stored and processed there, or transmitted (output) to another human, computer, or other system to create information.

2.2. “Data Request” means an inquiry from a participant for data or information collected by, housed, or maintained within the ODCP that requires compilation or aggregation by the ODCP staff.

2.3. “Department” means the West Virginia Department of Health and Human Resources and its successor departments.

2.4. “Director” means the Director of the Office of Drug Control Policy.

2.5. “Disclosure” means the release, transfer, provision, access to, or divulging in any other manner of information outside the ODCP.

2.6. “Drug” means:

2.6.1. Substances recognized as drugs in the official United States Pharmacopoeia, official Homeopathic Pharmacopoeia of the United States, or official National Formulary, or any supplement to any of them;

2.6.2. Substances intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease in man or animals;

2.6.3. Substances (other than food) intended to affect the structure or any function of the body of man or animals; and

2.6.4. Substances intended for use as components of any article specified in subdivisions a, b, or c, of this subsection. It does not include devices or their components, parts, or accessories.

2.7. “Emergency response provider” means any authority, person, corporation, partnership or other entity, public or private, that owns or operates a licensed emergency medical services agency providing emergency medical service in this state.

2.8. “Health care provider” means a person, partnership, corporation, licensed, certified, or authorized by law and as determined by the State Health Officer to provide professional health care service in this state to an individual during this individual’s medical, remedial, or behavioral health care, treatment or confinement.

2.9. “Information technology platform” means secure file transfer protocol and business intelligence tools including, but not limited to, the National Emergency Medical Services Information System (NEMSIS); Washington/Baltimore High Intensity Drug Trafficking Overdose Detection Mapping Application Program; Emergency Department Information Exchange (Edie); West Virginia Health Information Network (WVHIN); West Virginia Overdose Reporting System; and West Virginia Prehospital Information System (PreMIS).

2.10. “Law enforcement agency” means any duly authorized state, county, or municipal organization employing one or more persons whose responsibility is the enforcement of laws of the state or any county or municipality. “Law enforcement agency” does not include the Public Service Commission, nor any resort area district.

2.11. “Mandatory reporter” means a health care provider, medical examiner, law enforcement agency, emergency response provider, and hospital emergency rooms.

2.12. “Medical Examiner” means an individual appointed pursuant to W. Va. Code §§61-12-1 et seq. to perform death investigations and to establish the cause and manner of death. The term “medical examiner” includes any person designated by the medical examiner to perform any duties required by W. Va. Code §§16-19-1 et seq.

2.13. “ODCP” means the Office of Drug Control Policy within the department.

2.14. “Opioid antagonist” means a federal Food and Drug Administration-approved drug for the treatment of an opiate-related overdose, such as naloxone hydrochloride or other substance that, when administered, negates or neutralizes, in whole or in part, the pharmacological effects of an opioid in the body.

2.15. “Opioid” means any substance, as the parent compound or a metabolite, whose primary mechanism of action is via attachment to opioid receptors in the brain and whose opioid receptor activity is reversed by an opioid antagonist.

2.16. “Overdose” means an acute condition, including, but not limited to, extreme physical illness, decreased level of consciousness, respiratory depression, coma, or death believed to be caused by abuse and misuse of prescription or illicit drugs or by substances that a layperson would reasonably believe to be a drug.

2.17. “Overdose information” means data and information collected, maintained, or used by participants related to overdoses.

2.18. “Participants” means the Office of Drug Control Policy, the Department of Health and Human Resources, its successors, and its bureaus, the Department of Military Affairs and Public Safety, the Department of Administration, the Administrator of Courts, the Poison Control Center, the Board of Pharmacy, law enforcement, local health departments, and emergency medical service agencies in each county.

2.19. “Personally identifiable information” or “PII” means all information that identifies, or can be used to identify, locate, contact, or impersonate a particular individual. PII also includes protected health information (PHI) as that term is defined in subsection 2.20. PII is contained in public and non-public records. Examples may include, but are not limited to, a specific individual’s first name (or initial) and last name (current or former); geographical address; electronic address (including an e-mail address); personal cellular phone number; telephone number or fax number dedicated to contacting the individual at his or her physical place of residence; social security account number; biometric identifiers, including but not limited to, fingerprints, palm prints, facial recognition, full-face image and iris scans; driver identification number; birth date; birth, adoption, or death certificate numbers; physical description; genetic information; medical, disability, or employment records, including salary information; and criminal records and history. When connected with one or more of the items of information specified above, PII includes any other information concerning an individual that, if disclosed, identifies or can be used to identify a specific individual physically or electronically.

2.20. “Protected health information” or “PHI” is a subset of PII and means, with regard to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) covered entities (see 45 C.F.R. § 106.103), individually identifiable health information, including demographic information, whether oral or recorded in any form or medium that relates to an individual’s health, health care services and supplies, or payment for services or supplies, and which identifies the individual or could reasonably be used to identify the individual. This includes information that relates to the past, present, or future physical or mental health condition of an individual; the provision of health care to an individual including, but not limited to, preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, as well as counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status of an individual or that affects the structure or function of the body, such that the health information is linked to the individual.

2.21. “Reportable information” means the following information related to a mandatory reporter’s response to an overdose:

2.21.1. Date and time of the response;

2.21.2. The approximate address of where the person was picked up or where the overdose took place;

2.21.3. Gender of person suffering from an overdose;

2.21.4. Estimated or actual age of a person suffering from an overdose;

2.21.5. Drug suspected of causing the overdose;

2.21.6. Whether the individual has a history of a prior overdose;

2.21.7. Whether an opioid antagonist was administered;

2.21.8. If an opioid antagonist was administered, the following information:

2.21.8.a. The doses of opioid antagonist administered;

2.21.8.b. Whether the method of administration was auto injector or nasal spray;

2.21.7.c. 2.21.8.c. The response to the opioid antagonist; and

2.21.8.d. Disposition, including whether the person who was administered the opioid antagonist stayed in the same location; jail; emergency medical services transport; absconded; or death; and

2.21.9. Other data as the director may prescribe.

2.22. “System” means software, portal, platform, or other electronic medium controlled or utilized by the ODCP through which or by which participants exchange data and information under this rule. For purposes of this definition, it does not matter whether the ODCP controls or utilizes the software, portal, platform, or other medium through ownership, lease, license, or otherwise.

2.23. “West Virginia Overdose Reporting Program” means the process by which a mandatory reporter may transmit the reportable information to the ODCP via secure file transfer protocol server.

W. Va. Code R. § 67-1-3 Overdose reporting

3.1. A mandatory reporter who attends or treats, or who is requested to attend or treat, an overdose, or the administrator, or other person in charge of a health care provider in which an overdose is attended or treated or in which the attention or treatment is requested, shall report the case via an appropriate information technology platform with secure access.

3.2. Reports regarding an overdose shall include the reportable information within 24 hours after the incident response.

3.3. Reports must be submitted in accordance with state and federal security guidelines surrounding the transmission of confidential data.

3.4. The mandatory reporter making the report shall provide the reportable information concerning the person attended or treated or for whom treatment was sought.

3.5. All overdose reports submitted pursuant to this rule shall be handled in accordance with all applicable state and federal statutes and regulations pertaining to confidentiality of sensitive health care information.

W. Va. Code R. § 67-1-4 Exchange of data and information

4.1. Permitted Uses and Disclosures. The ODCP may disclose data for legitimate purposes relating to public health to participants. The ODCP shall have the sole discretion to determine what constitutes a legitimate purpose relating to public health.

4.2. Participants may use and disclose data and information in furtherance of the purposes and goals of participants relevant to the development and implementation of best practices and evidence-based substance use disorder prevention, cessation, treatment and recovery programs, and youth tobacco access, smoking cessation and prevention when necessary for their proper management, administration, or execution of their legal responsibilities and privileges established herein. The participants agree not to use or further disclose data and information other than as authorized by law.

4.3. Data and information maintained by the ODCP may not be disclosed for commercial purposes.

4.4. Overdose Information Maintained by Participants.

4.4.1. Participants will provide overdose information in electronic format as maintained on each participant’s system. The specific data elements that will be exchanged are the demographic and health information being requested from the originating participant’s system. The participants are not responsible for the absence of overdose information in a participant’s records and are only obligated to provide such information as they currently possess. The participants acknowledge that the overdose information provided is drawn from numerous sources and the overdose information provided may not include an entire record.

4.4.2. Participants shall provide overdose information to the ODCP in a timely manner.

4.4.3. Participants will reasonably determine that information disclosed is accurate and complete. If a participant becomes aware of any material inaccuracies in its own overdose information or system, it agrees to communicate such inaccuracy to the ODCP as soon as reasonably possible.

4.5. Access to Data and Information by Participants.

4.5.1. All data requests for data and information housed and maintained by the ODCP shall be submitted to the director in a form and manner as the director may prescribe, including electronic submission.

4.5.2. Functions of the Director. The director is responsible for overseeing the process from receipt of a data request to the release of the data to the requestor. Specific responsibilities include:

4.5.2.a. Reviewing each data request and identifying the information being requested;

4.5.2.b. Coordinating with the department's privacy officer to determine whether a request is valid and the information may be released under applicable law;

4.5.2.c. Routing the request to the appropriate person or data analyst for completion, and following up as necessary to ensure accurate and timely completion of the request;

4.5.2.d. Communicating with the requestor as necessary; and

4.5.2.e. Maintaining accurate records of the requests.

4.5.3. Prior to receiving any data, the director may require participants to execute a data use agreement, in the form and manner as the director may prescribe.

4.6. Ownership. Disclosure of data under this rule does not change the ownership of such information under state and federal law. This rule does not grant to a participant any rights in the system or any of the technology used to create, operate, enhance, or maintain the system of another participant.

4.7. Privacy and Security Safeguards.

4.7.1. If the data to be provided constitutes or includes PII or PHI, then only the minimum amount of PII or PHI necessary to accomplish the purposes for which the data is requested may be used or disclosed.

4.7.2. Participants shall establish procedures to prevent the disclosure of data that may contain indirectly identifying information.

4.7.3. Participants will use administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of data it receives and to prevent the use or disclosure of any data received other than as permitted or required by federal or state law and by this rule. To that end, participants shall:

4.7.3.a. Provide for identification and authentication of authorized users;

4.7.3.b. Provide access authorization;

4.7.3.c. Guard against unauthorized access to data; and

4.7.3.d. Provide security audit controls and documentation.

4.7.4. A participant shall apply sanctions against any person, subject to the participant’s policies and procedures, who fails to comply with such policies and procedures. The type and severity of sanctions applied shall be in accordance with the participant’s policies and procedures. Participants shall make employees, agents, and contractors aware that certain violations may result in notification by a participant to law enforcement officials as well as regulatory, accreditation, and licensure organizations, if applicable.

4.7.5. A participant may, at its discretion, deny access to any person it has reason to believe accessed, used, or disclosed data, other than as permitted under this rule.

4.7.6. Participants are also required to comply with the privacy and security provisions established by the state of West Virginia and are not required to adhere to the law or rules of or applicable to any other participant.

4.8. Breach of Privacy and Security Safeguards.

4.8.1. Breach of a material provision of the privacy and security safeguards contained in this section by a participant may be grounds for the director to discontinue the participant’s access to data and information. Upon becoming aware of such a material breach, the director may do one or more of the following:

4.8.1.a. Provide an opportunity for the participant who has committed a material breach of the privacy and security safeguard contained in this section to cure the violation within 30 days, and if the participant does not cure or end the violation within the time specified by the director, terminate the authority of the participant to access data and information;

4.8.1.b. Demand assurances from the participant that remedial actions will be taken to remedy the circumstances that gave rise to the violation within a time frame set by, or approved by, the director; and

4.8.1.c. Terminate the authority to access data and information.

4.8.2. A participant who is the subject of sanctions contained in subdivision 4.8.a. may request a hearing.

4.8.2.a. A request for a hearing must be made within 90 days of the date of the director’s notification of a sanction contained in subdivision 4.8.a.

4.8.2.b. The request for hearing must be made in writing and must clearly state the reasons for the request.

4.8.2.c. Hearings will be conducted pursuant to 64CSR1.

W. Va. Code R. § 67-1-5 Failure to report; enforcement; request for a hearing

5.1. If a mandatory reporter fails to report an overdose event or other reportable information to the ODCP within 24 hours of the overdose event, the ODCP may assess a civil penalty of not less than $500 or more than $1,000 per occurrence.

5.2. The ODCP shall not enforce a penalty on a mandatory reporter who makes a good faith attempt to collect the reportable information but is unable to do so. The mandatory reporter must, however, report the overdose event and any reportable information that it can ascertain within the appropriate time period.

5.3. The ODCP shall send written notice of any failure to report to the mandatory reporter. The notice shall contain the time period in which the failure occurred and the total amount of the fine.

5.4. A fined mandatory reporter may request a hearing related to the fine by sending a written request for a hearing to the ODCP within 30 days of receipt of the notice of the failure to report.

5.5. Hearings under this section will be conducted according to 69CSR1.