2012 -- S 2731

=======

LC02007

=======

STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2012

____________

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

     Introduced By: Senators Jabour, Pichardo, Crowley, and Hodgson

     Date Introduced: March 06, 2012

     Referred To: Senate Judiciary

It is enacted by the General Assembly as follows:

1-1

     SECTION 1. Sections 5-37.3-3 and 5-37.3-4 of the General Laws in Chapter 5-37.3

1-2

entitled "Confidentiality of Health Care Communications and Information Act" are hereby

1-3

amended to read as follows:

1-4

     5-37.3-3. Definitions. -- As used in this chapter:

1-5

      (1) "Authorized representative" means:

1-6

      (i) A person empowered by the patient/client to assert or to waive the confidentiality, or

1-7

to disclose or consent to the disclosure of confidential information, as established by this chapter.

1-8

That person is not, except by explicit authorization, empowered to waive confidentiality or to

1-9

disclose or consent to the disclosure of confidential information;

1-10

      (ii) A guardian or conservator, if the person whose right to confidentiality is protected

1-11

under this chapter is incompetent to assert or waive that right; or

1-12

      (iii) If the patient/client is deceased, his or her personal representative or, in the absence

1-13

of that representative, his or her heirs-at-law.

1-14

      (2) "Board of medical licensure and discipline" means the board created under chapter

1-15

37 of this title.

1-16

      (3) (i) "Confidential health care communication" means a communication of health care

1-17

information by an individual to a health care provider, including a transcription of any

1-18

information, not intended to be disclosed to third persons except if those persons are:

2-19

      (A) Present to further the interest of the patient in the consultation, examination or

2-20

interview;

2-21

      (B) Reasonably necessary for the transmission of the communication; or

2-22

      (C) Participating in the diagnosis and treatment under the direction of the health care

2-23

provider, including members of the patient's family.

2-24

      (ii) "Confidential health care information" means all information relating to a patient's

2-25

health care history, diagnosis, condition, treatment, or evaluation obtained from a health care

2-26

provider who has treated the patient.

2-27

     (4) “Crime of violence” includes murder, manslaughter, first degree sexual assault,

2-28

second degree sexual assault, first degree child molestation, second degree child molestation,

2-29

kidnapping, first degree arson, second degree arson, mayhem, robbery, felony assault with intent

2-30

to commit murder, robbery, sexual assault, burglary, or the abominable and detestable crime

2-31

against nature; or any offense punishable as a felony offense under section 12-29-5.

2-32

      (4) (5) "Health care provider" means any person licensed by this state to provide or

2-33

lawfully providing health care services, including, but not limited to, a physician, hospital,

2-34

intermediate care facility or other health care facility, dentist, nurse, optometrist, podiatrist,

2-35

physical therapist, psychiatric social worker, pharmacist or psychologist, and any officer,

2-36

employee, or agent of that provider acting in the course and scope of his or her employment or

2-37

agency related to or supportive of health services.

2-38

      (5) (6) "Health care services" means acts of diagnosis, treatment, medical evaluation, or

2-39

counseling or any other acts that may be permissible under the health care licensing statutes of

2-40

this state.

2-41

      (6) (7) "Managed care contractor" means a person that:

2-42

      (i) Establishes, operates, or maintains a network of participating providers;

2-43

      (ii) Conducts or arranges for utilization review activities; and

2-44

      (iii) Contracts with an insurance company, a hospital or medical service plan, an

2-45

employer, an employee organization, or any other entity providing coverage for health care

2-46

services to operate a managed care plan.

2-47

      (7) (8) "Managed care entity" includes a licensed insurance company, hospital or

2-48

medical service plan, health maintenance organization, an employer or employee organization, or

2-49

a managed care contractor as described in subdivision (6) of this section, that operates a managed

2-50

care plan.

2-51

      (8) (9)"Managed care plan" means a plan operated by a managed care entity as described

2-52

in subdivision (7) (8) of this section, that provides for the financing and delivery of health care

2-53

services to persons enrolled in the plan through:

3-1

      (i) Arrangements with selected providers to furnish health care services;

3-2

      (ii) Explicit standards for the selection of participating providers;

3-3

      (iii) Organizational arrangements for ongoing quality assurance, utilization review

3-4

programs, and dispute resolution; and

3-5

      (iv) Financial incentives for persons enrolled in the plan to use the participating

3-6

providers and procedures provided for by the plan.

3-7

      (9) (10) "Medical peer review board" means a peer review board under chapter 37 of this

3-8

title.

3-9

      (10) (11) "Nurse" means a registered nurse or licensed practical nurse licensed to

3-10

practice nursing in the state.

3-11

      (11) (12) "Participating provider" means a physician, hospital, pharmacy, laboratory,

3-12

dentist, or other state licensed or other state recognized provider of health care services or

3-13

supplies, that has entered into an agreement with a managed care entity to provide any services or

3-14

supplies to a patient enrolled in a managed care plan.

3-15

      (12) (13) "Patient" means a person who receives health care services from a health care

3-16

provider.

3-17

      (13) (14) "Personally identifiable confidential health care information" means

3-18

confidential health care information, which explicitly or by implication identifies a particular

3-19

patient.

3-20

      (14) (15) "Physician" means a person registered or licensed to practice allopathic or

3-21

osteopathic medicine in this state under Rhode Island general laws.

3-22

      (15) (16) "Psychiatric social worker" means a person holding a Master's or further

3-23

advanced degree from a school of social work accredited by the council of social work education.

3-24

      (16) (17) "Psychologist" means a certified psychologist under chapter 44 of this title.

3-25

      (17) (18) "Qualified personnel" means persons whose training and experience are

3-26

appropriate to the nature and level of the work in which they are engaged and who, when working

3-27

as part of an organization, are performing that work with published and adequate administrative

3-28

safeguards against disclosure unauthorized under this chapter.

3-29

      (18) (19) "Third party" means a person other than the patient to whom the confidential

3-30

health care information relates and other than a health care provider.

3-31

     5-37.3-4. Limitations on and permitted disclosures. -- (a) (1) Except as provided in

3-32

subsection (b) of this section or as specifically provided by the law, a patient's confidential health

3-33

care information shall not be released or transferred without the written consent of the patient or

3-34

his or her authorized representative, on a consent form meeting the requirements of subsection (d)

4-1

of this section. A copy of any notice used pursuant to subsection (d) of this section, and of any

4-2

signed consent shall, upon request, be provided to the patient prior to his or her signing a consent

4-3

form. Any and all managed care entities and managed care contractors writing policies in the state

4-4

shall be prohibited from providing any information related to enrollees which is personal in

4-5

nature and could reasonably lead to identification of an individual and is not essential for the

4-6

compilation of statistical data related to enrollees, to any international, national, regional, or local

4-7

medical information data base. This provision shall not restrict or prohibit the transfer of

4-8

information to the department of health to carry out its statutory duties and responsibilities.

4-9

      (2) Any person who violates the provisions of this section may be liable for actual and

4-10

punitive damages.

4-11

      (3) The court may award a reasonable attorney's fee at its discretion to the prevailing

4-12

party in any civil action under this section.

4-13

      (4) Any person who knowingly and intentionally violates the provisions of this section

4-14

shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation,

4-15

or imprisoned not more than six (6) months for each violation, or both.

4-16

      (5) Any contract or agreement which purports to waive the provisions of this section

4-17

shall be declared null and void as against public policy.

4-18

      (b) No consent for release or transfer of confidential health care information shall be

4-19

required in the following situations:

4-20

      (1) To a physician, dentist, or other medical personnel who believes, in good faith, that

4-21

the information is necessary for diagnosis or treatment of that individual in a medical or dental

4-22

emergency;

4-23

      (2) To medical and dental peer review boards, or the board of medical licensure and

4-24

discipline, or board of examiners in dentistry;

4-25

      (3) To qualified personnel for the purpose of conducting scientific research, management

4-26

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies;

4-27

provided, that personnel shall not identify, directly or indirectly, any individual patient in any

4-28

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

4-29

      (4) By a health care provider to appropriate law enforcement personnel, or to a person if

4-30

the health care provider believes that person or his or her family is in danger from a patient; or to

4-31

appropriate law enforcement personnel if the patient has or is attempting to obtain narcotic drugs

4-32

from the health care provider illegally; or to appropriate law enforcement personnel or

4-33

appropriate child protective agencies if the patient is a minor child or the parent or guardian of

4-34

said child and/or the health care provider believes, after providing health care services to the

5-1

patient, that the child is or has been physically, psychologically or sexually abused and neglected

5-2

as reportable pursuant to section 40-11-3; or to law enforcement personnel in the case of a

5-3

gunshot wound reportable under section 11-47-48; or to appropriate law enforcement personnel if

5-4

the health care provider comes into contact with or provides medical services to a patient whom

5-5

the provider reasonably suspects is suffering from injuries that are the result of a crime of

5-6

violence. The disclosures authorized by this subsection being limited to the minimum amount of

5-7

information necessary to accomplish the intended purpose of the release of information.

5-8

      (5) Between or among qualified personnel and health care providers within the health

5-9

care system for purposes of coordination of health care services given to the patient and for

5-10

purposes of education and training within the same health care facility; or

5-11

      (6) To third party health insurers including to utilization review agents as provided by

5-12

section 23-17.12-9(c)(4), third party administrators licensed pursuant to chapter 20.7 of title 27

5-13

and other entities that provide operational support to adjudicate health insurance claims or

5-14

administer health benefits;

5-15

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

5-16

anticipate a medical liability action; or

5-17

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

5-18

the patient whose information is at issue brings a medical liability action against a health care

5-19

provider.

5-20

      (ii) Disclosure by a health care provider of a patient's health care information which is

5-21

relevant to a civil action brought by the patient against any person or persons other than that

5-22

health care provider may occur only under the discovery methods provided by the applicable

5-23

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

5-24

and not through informal ex parte contacts with the provider by persons other than the patient or

5-25

his or her legal representative. Nothing in this section shall limit the right of a patient or his or her

5-26

attorney to consult with that patient's own physician and to obtain that patient's own health care

5-27

information;

5-28

      (9) To public health authorities in order to carry out their functions as described in this

5-29

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

5-30

are not restricted to, investigations into the causes of disease, the control of public health hazards,

5-31

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

5-32

health professionals and facilities, review of health care such as that required by the federal

5-33

government and other governmental agencies;

6-34

      (10) To the state medical examiner in the event of a fatality that comes under his or her

6-35

jurisdiction;

6-36

      (11) In relation to information that is directly related to current claim for workers'

6-37

compensation benefits or to any proceeding before the workers' compensation commission or

6-38

before any court proceeding relating to workers' compensation;

6-39

      (12) To the attorneys for a health care provider whenever that provider considers that

6-40

release of information to be necessary in order to receive adequate legal representation;

6-41

      (13) By a health care provider to appropriate school authorities of disease, health

6-42

screening and/or immunization information required by the school; or when a school age child

6-43

transfers from one school or school district to another school or school district;

6-44

      (14) To a law enforcement authority to protect the legal interest of an insurance

6-45

institution, agent, or insurance-support organization in preventing and prosecuting the

6-46

perpetration of fraud upon them;

6-47

      (15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or

6-48

subpoena duces tecum when that information is required for the investigation or prosecution of

6-49

criminal wrongdoing by a health care provider relating to his or her or its provisions of health

6-50

care services and that information is unavailable from any other source; provided, that any

6-51

information so obtained is not admissible in any criminal proceeding against the patient to whom

6-52

that information pertains;

6-53

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

6-54

when that information is required to determine the eligibility of a person to vote by mail ballot

6-55

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

6-56

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

6-57

person's illness or disability, the date when that person was last examined and that it would be an

6-58

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

6-59

      (18) To the central cancer registry;

6-60

      (19) To the Medicaid fraud control unit of the attorney general's office for the

6-61

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

6-62

his or her or its provision of health care services to then Medicaid eligible recipients or patients,

6-63

residents, or former patients or residents of long term residential care facilities; provided, that any

6-64

information obtained shall not be admissible in any criminal proceeding against the patient to

6-65

whom that information pertains;

6-66

      (20) To the state department of children, youth, and families pertaining to the disclosure

6-67

of health care records of children in the custody of the department;

7-68

      (21) To the foster parent or parents pertaining to the disclosure of health care records of

7-69

children in the custody of the foster parent or parents; provided, that the foster parent or parents

7-70

receive appropriate training and have ongoing availability of supervisory assistance in the use of

7-71

sensitive information that may be the source of distress to these children;

7-72

      (22) A hospital may release the fact of a patient's admission and a general description of

7-73

a patient's condition to persons representing themselves as relatives or friends of the patient or as

7-74

a representative of the news media. The access to confidential health care information to persons

7-75

in accredited educational programs under appropriate provider supervision shall not be deemed

7-76

subject to release or transfer of that information under subsection (a) of this section; or

7-77

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

7-78

under sections 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care

7-79

information under any of the above exceptions is not the basis for any legal liability, civil or

7-80

criminal, nor considered a violation of this chapter; or

7-81

      (24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

7-82

attorneys, when the information is contained within a decision-making assessment tool which

7-83

conforms to the provisions of section 33-15-47.

7-84

      (c) Third parties receiving and retaining a patient's confidential health care information

7-85

must establish at least the following security procedures:

7-86

      (1) Limit authorized access to personally identifiable confidential health care

7-87

information to persons having a "need to know" that information; additional employees or agents

7-88

may have access to that information which does not contain information from which an individual

7-89

can be identified;

7-90

      (2) Identify an individual or individuals who have responsibility for maintaining security

7-91

procedures for confidential health care information;

7-92

      (3) Provide a written statement to each employee or agent as to the necessity of

7-93

maintaining the security and confidentiality of confidential health care information, and of the

7-94

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

7-95

information. The receipt of that statement shall be acknowledged by the employee or agent, who

7-96

signs and returns the statement to his or her employer or principal, who retains the signed

7-97

original. The employee or agent shall be furnished with a copy of the signed statement;

7-98

      (4) Take no disciplinary or punitive action against any employee or agent solely for

7-99

bringing evidence of violation of this chapter to the attention of any person.

7-100

      (d) Consent forms for the release or transfer of confidential health care information shall

7-101

contain, or in the course of an application or claim for insurance be accompanied by a notice

7-102

containing, the following information in a clear and conspicuous manner:

8-1

      (1) A statement of the need for and proposed uses of that information;

8-2

      (2) A statement that all information is to be released or clearly indicating the extent of

8-3

the information to be released; and

8-4

      (3) A statement that the consent for release or transfer of information may be withdrawn

8-5

at any future time and is subject to revocation, except where an authorization is executed in

8-6

connection with an application for a life or health insurance policy in which case the

8-7

authorization expires two (2) years from the issue date of the insurance policy, and when signed

8-8

in connection with a claim for benefits under any insurance policy the authorization shall be valid

8-9

during the pendency of that claim. Any revocation shall be transmitted in writing.

8-10

      (e) Except as specifically provided by law, an individual's confidential health care

8-11

information shall not be given, sold, transferred, or in any way relayed to any other person not

8-12

specified in the consent form or notice meeting the requirements of subsection (d) of this section

8-13

without first obtaining the individual's additional written consent on a form stating the need for

8-14

the proposed new use of this information or the need for its transfer to another person.

8-15

      (f) Nothing contained in this chapter shall be construed to limit the permitted disclosure

8-16

of confidential health care information and communications described in subsection (b) of this

8-17

section.

8-18

     SECTION 2. This act shall take effect upon passage.

=======

LC02007

========

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

***

9-1

     This act would require mandatory disclosure to appropriate law enforcement personnel if

9-2

a health care provider comes into contact with or provides medical services to a patient whom the

9-3

provider reasonably suspects is suffering from injuries that are the result of a crime of violence.

9-4

     This act would take effect upon passage.

=======

LC02007

=======