2013 -- S 0459

=======

LC01314

=======

STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2013

____________

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

     Introduced By: Senators Jabour, McCaffrey, Archambault, and Lombardi

     Date Introduced: February 28, 2013

     Referred To: Senate Judiciary

It is enacted by the General Assembly as follows:

1-1

     SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled

1-2

"Confidentiality of Health Care Communications and Information Act" is hereby amended to read

1-3

as follows:

1-4

     5-37.3-4. Limitations on and permitted disclosures. -- (a) (1) Except as provided in

1-5

subsection (b) of this section or as specifically provided by the law, a patient's confidential health

1-6

care information shall not be released or transferred without the written consent of the patient or

1-7

his or her authorized representative, on a consent form meeting the requirements of subsection (d)

1-8

of this section. A copy of any notice used pursuant to subsection (d) of this section, and of any

1-9

signed consent shall, upon request, be provided to the patient prior to his or her signing a consent

1-10

form. Any and all managed care entities and managed care contractors writing policies in the state

1-11

shall be prohibited from providing any information related to enrollees which is personal in

1-12

nature and could reasonably lead to identification of an individual and is not essential for the

1-13

compilation of statistical data related to enrollees, to any international, national, regional, or local

1-14

medical information data base. This provision shall not restrict or prohibit the transfer of

1-15

information to the department of health to carry out its statutory duties and responsibilities.

1-16

      (2) Any person who violates the provisions of this section may be liable for actual and

1-17

punitive damages.

1-18

      (3) The court may award a reasonable attorney's fee at its discretion to the prevailing

1-19

party in any civil action under this section.

2-1

      (4) Any person who knowingly and intentionally violates the provisions of this section

2-2

shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation,

2-3

or imprisoned not more than six (6) months for each violation, or both.

2-4

      (5) Any contract or agreement which purports to waive the provisions of this section

2-5

shall be declared null and void as against public policy.

2-6

      (b) No consent for release or transfer of confidential health care information shall be

2-7

required in the following situations:

2-8

      (1) To a physician, dentist, or other medical personnel who believes, in good faith, that

2-9

the information is necessary for diagnosis or treatment of that individual in a medical or dental

2-10

emergency;

2-11

      (2) To medical and dental peer review boards, or the board of medical licensure and

2-12

discipline, or board of examiners in dentistry;

2-13

      (3) To qualified personnel for the purpose of conducting scientific research, management

2-14

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies;

2-15

provided, that personnel shall not identify, directly or indirectly, any individual patient in any

2-16

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

2-17

      (4) By a health care provider to appropriate law enforcement personnel, or to a person if

2-18

the health care provider believes that person or his or her family is in danger from a patient; or to

2-19

appropriate law enforcement personnel if the patient has or is attempting to obtain narcotic drugs

2-20

from the health care provider illegally; or to appropriate law enforcement personnel or

2-21

appropriate child protective agencies if the patient is a minor child or the parent or guardian of

2-22

said child and/or the health care provider believes, after providing health care services to the

2-23

patient, that the child is or has been physically, psychologically or sexually abused and neglected

2-24

as reportable pursuant to section 40-11-3; or to law enforcement personnel in the case of a

2-25

gunshot wound reportable under section 11-47-48; or to appropriate law enforcement personnel if

2-26

the health care provider providing treatment to a patient in a hospital if such disclosure appears

2-27

necessary to alert law enforcement to the commission and nature of a crime, the location of such

2-28

crime or the victim(s) of such crime; or the identity, description, location of the perpetrator of

2-29

such crime. Provided, however, if the health care provider reasonably believes that the patient

2-30

receiving treatment has been a victim of domestic violence or sexual assault, the health care

2-31

provider must receive the patient’s consent to the release of information to law enforcement

2-32

personnel. This exception shall not apply if the patient is unable to agree because of incapacity

2-33

and immediate enforcement activity would be materially and adversely affected by waiting until

2-34

the patient is able to consent to the release of information or the health care provider reasonably

3-1

believes that the patient’s personal representative is responsible for the patient’s injury and

3-2

informing the personal representative would not be in the best interests of the patient. The

3-3

disclosures authorized by this subsection being limited to the minimum amount of information

3-4

necessary to accomplish the intended purpose of the release of information.

3-5

      (5) Between or among qualified personnel and health care providers within the health

3-6

care system for purposes of coordination of health care services given to the patient and for

3-7

purposes of education and training within the same health care facility; or

3-8

      (6) To third party health insurers including to utilization review agents as provided by

3-9

section 23-17.12-9(c)(4), third party administrators licensed pursuant to chapter 20.7 of title 27

3-10

and other entities that provide operational support to adjudicate health insurance claims or

3-11

administer health benefits;

3-12

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

3-13

anticipate a medical liability action; or

3-14

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

3-15

the patient whose information is at issue brings a medical liability action against a health care

3-16

provider.

3-17

      (ii) Disclosure by a health care provider of a patient's health care information which is

3-18

relevant to a civil action brought by the patient against any person or persons other than that

3-19

health care provider may occur only under the discovery methods provided by the applicable

3-20

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

3-21

and not through informal ex parte contacts with the provider by persons other than the patient or

3-22

his or her legal representative. Nothing in this section shall limit the right of a patient or his or her

3-23

attorney to consult with that patient's own physician and to obtain that patient's own health care

3-24

information;

3-25

      (9) To public health authorities in order to carry out their functions as described in this

3-26

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

3-27

are not restricted to, investigations into the causes of disease, the control of public health hazards,

3-28

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

3-29

health professionals and facilities, review of health care such as that required by the federal

3-30

government and other governmental agencies;

3-31

      (10) To the state medical examiner in the event of a fatality that comes under his or her

3-32

jurisdiction;

3-33

      (11) In relation to information that is directly related to current claim for workers'

3-34

compensation benefits or to any proceeding before the workers' compensation commission or

4-1

before any court proceeding relating to workers' compensation;

4-2

      (12) To the attorneys for a health care provider whenever that provider considers that

4-3

release of information to be necessary in order to receive adequate legal representation;

4-4

      (13) By a health care provider to appropriate school authorities of disease, health

4-5

screening and/or immunization information required by the school; or when a school age child

4-6

transfers from one school or school district to another school or school district;

4-7

      (14) To a law enforcement authority to protect the legal interest of an insurance

4-8

institution, agent, or insurance-support organization in preventing and prosecuting the

4-9

perpetration of fraud upon them;

4-10

      (15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or

4-11

subpoena duces tecum when that information is required for the investigation or prosecution of

4-12

criminal wrongdoing by a health care provider relating to his or her or its provisions of health

4-13

care services and that information is unavailable from any other source; provided, that any

4-14

information so obtained is not admissible in any criminal proceeding against the patient to whom

4-15

that information pertains;

4-16

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

4-17

when that information is required to determine the eligibility of a person to vote by mail ballot

4-18

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

4-19

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

4-20

person's illness or disability, the date when that person was last examined and that it would be an

4-21

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

4-22

      (18) To the central cancer registry;

4-23

      (19) To the Medicaid fraud control unit of the attorney general's office for the

4-24

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

4-25

his or her or its provision of health care services to then Medicaid eligible recipients or patients,

4-26

residents, or former patients or residents of long term residential care facilities; provided, that any

4-27

information obtained shall not be admissible in any criminal proceeding against the patient to

4-28

whom that information pertains;

4-29

      (20) To the state department of children, youth, and families pertaining to the disclosure

4-30

of health care records of children in the custody of the department;

4-31

      (21) To the foster parent or parents pertaining to the disclosure of health care records of

4-32

children in the custody of the foster parent or parents; provided, that the foster parent or parents

4-33

receive appropriate training and have ongoing availability of supervisory assistance in the use of

4-34

sensitive information that may be the source of distress to these children;

5-1

      (22) A hospital may release the fact of a patient's admission and a general description of

5-2

a patient's condition to persons representing themselves as relatives or friends of the patient or as

5-3

a representative of the news media. The access to confidential health care information to persons

5-4

in accredited educational programs under appropriate provider supervision shall not be deemed

5-5

subject to release or transfer of that information under subsection (a) of this section; or

5-6

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

5-7

under sections 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care

5-8

information under any of the above exceptions is not the basis for any legal liability, civil or

5-9

criminal, nor considered a violation of this chapter; or

5-10

      (24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

5-11

attorneys, when the information is contained within a decision-making assessment tool which

5-12

conforms to the provisions of section 33-15-47.

5-13

      (c) Third parties receiving and retaining a patient's confidential health care information

5-14

must establish at least the following security procedures:

5-15

      (1) Limit authorized access to personally identifiable confidential health care

5-16

information to persons having a "need to know" that information; additional employees or agents

5-17

may have access to that information which does not contain information from which an individual

5-18

can be identified;

5-19

      (2) Identify an individual or individuals who have responsibility for maintaining security

5-20

procedures for confidential health care information;

5-21

      (3) Provide a written statement to each employee or agent as to the necessity of

5-22

maintaining the security and confidentiality of confidential health care information, and of the

5-23

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

5-24

information. The receipt of that statement shall be acknowledged by the employee or agent, who

5-25

signs and returns the statement to his or her employer or principal, who retains the signed

5-26

original. The employee or agent shall be furnished with a copy of the signed statement;

5-27

      (4) Take no disciplinary or punitive action against any employee or agent solely for

5-28

bringing evidence of violation of this chapter to the attention of any person.

5-29

      (d) Consent forms for the release or transfer of confidential health care information shall

5-30

contain, or in the course of an application or claim for insurance be accompanied by a notice

5-31

containing, the following information in a clear and conspicuous manner:

5-32

      (1) A statement of the need for and proposed uses of that information;

5-33

      (2) A statement that all information is to be released or clearly indicating the extent of

5-34

the information to be released; and

6-1

      (3) A statement that the consent for release or transfer of information may be withdrawn

6-2

at any future time and is subject to revocation, except where an authorization is executed in

6-3

connection with an application for a life or health insurance policy in which case the

6-4

authorization expires two (2) years from the issue date of the insurance policy, and when signed

6-5

in connection with a claim for benefits under any insurance policy the authorization shall be valid

6-6

during the pendency of that claim. Any revocation shall be transmitted in writing.

6-7

      (e) Except as specifically provided by law, an individual's confidential health care

6-8

information shall not be given, sold, transferred, or in any way relayed to any other person not

6-9

specified in the consent form or notice meeting the requirements of subsection (d) of this section

6-10

without first obtaining the individual's additional written consent on a form stating the need for

6-11

the proposed new use of this information or the need for its transfer to another person.

6-12

      (f) Nothing contained in this chapter shall be construed to limit the permitted disclosure

6-13

of confidential health care information and communications described in subsection (b) of this

6-14

section.

6-15

     SECTION 2. This act shall take effect upon passage.

=======

LC01314

========

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

***

7-1

     This act would require mandatory disclosure to appropriate law enforcement personnel if

7-2

a health care provider providing treatment to a patient in a hospital, if such disclosure appears

7-3

necessary to alert law enforcement to the commission and nature of a crime, the location of such

7-4

crime or the victim(s) of such crime, or the identity, description, location of the perpetrator of

7-5

such crime. If a health care provider reasonably believes that the patient receiving treatment has

7-6

been a victim of domestic violence or sexual assault, the health care provider must receive the

7-7

patient’s consent to the release of information to law enforcement personnel.

7-8

     This act would take effect upon passage.

=======

LC01314

=======