1. Except as otherwise provided in subsection 2 of NRS 439.597, a patient must not be required to participate in a health information exchange. Before a patient’s health care records may be retrieved from a health information exchange, the patient must be fully informed and affirmatively consent, in the manner prescribed by the Director of the Authority. It is the public policy of this State that, except as otherwise provided in NRS 439.597, a patient’s health care records must not be retrieved from a health information exchange unless the patient provides such affirmative consent.
2. A patient must be notified in the manner prescribed by the Director of the Authority of any breach of the confidentiality of electronic health records of the patient or a health information exchange.
3. A patient who consents to the retrieval of his or her electronic health record from a health information exchange may at any time request that a health care provider access and provide the patient with his or her electronic health record in accordance with the provisions of 45 C.F.R. § 164.524.