2013 -- S 0459 SUBSTITUTE A

=======

LC01314/SUB A

=======

STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2013

____________

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

     Introduced By: Senators Jabour, McCaffrey, Archambault, and Lombardi

     Date Introduced: February 28, 2013

     Referred To: Senate Judiciary

(Attorney General)

It is enacted by the General Assembly as follows:

1-1

     `SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled

1-2

"Confidentiality of Health Care Communications and Information Act" is hereby amended to read

1-3

as follows:

1-4

     5-37.3-4. Limitations on and permitted disclosures. -- (a) (1) Except as provided in

1-5

subsection (b) of this section or as specifically provided by the law, a patient's confidential health

1-6

care information shall not be released or transferred without the written consent of the patient or

1-7

his or her authorized representative, on a consent form meeting the requirements of subsection (d)

1-8

of this section. A copy of any notice used pursuant to subsection (d) of this section, and of any

1-9

signed consent shall, upon request, be provided to the patient prior to his or her signing a consent

1-10

form. Any and all managed care entities and managed care contractors writing policies in the state

1-11

shall be prohibited from providing any information related to enrollees which is personal in

1-12

nature and could reasonably lead to identification of an individual and is not essential for the

1-13

compilation of statistical data related to enrollees, to any international, national, regional, or local

1-14

medical information data base. This provision shall not restrict or prohibit the transfer of

1-15

information to the department of health to carry out its statutory duties and responsibilities.

1-16

      (2) Any person who violates the provisions of this section may be liable for actual and

1-17

punitive damages.

1-18

      (3) The court may award a reasonable attorney's fee at its discretion to the prevailing

1-19

party in any civil action under this section.

2-1

      (4) Any person who knowingly and intentionally violates the provisions of this section

2-2

shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation,

2-3

or imprisoned not more than six (6) months for each violation, or both.

2-4

      (5) Any contract or agreement which purports to waive the provisions of this section

2-5

shall be declared null and void as against public policy.

2-6

      (b) No consent for release or transfer of confidential health care information shall be

2-7

required in the following situations:

2-8

      (1) To a physician, dentist, or other medical personnel who believes, in good faith, that

2-9

the information is necessary for diagnosis or treatment of that individual in a medical or dental

2-10

emergency;

2-11

      (2) To medical and dental peer review boards, or the board of medical licensure and

2-12

discipline, or board of examiners in dentistry;

2-13

      (3) To qualified personnel for the purpose of conducting scientific research, management

2-14

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies;

2-15

provided, that personnel shall not identify, directly or indirectly, any individual patient in any

2-16

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

2-17

      (4) (i) By a health care provider to appropriate law enforcement personnel, or to a

2-18

person if the health care provider believes that person or his or her family is in danger from a

2-19

patient; or to appropriate law enforcement personnel if the patient has or is attempting to obtain

2-20

narcotic drugs from the health care provider illegally; or to appropriate law enforcement

2-21

personnel or appropriate child protective agencies if the patient is a minor child or the parent or

2-22

guardian of said child and/or the health care provider believes, after providing health care

2-23

services to the patient, that the child is or has been physically, psychologically or sexually abused

2-24

and neglected as reportable pursuant to section 40-11-3; or to law enforcement personnel in the

2-25

case of a gunshot wound reportable under section 11-47-48;

2-26

     (ii) A health care provider may disclose protected health information in response to a law

2-27

enforcement official's request for such information for the purpose of identifying or locating a

2-28

suspect, fugitive, material witness, or missing person, provided that the health care provider may

2-29

disclose only the following information:

2-30

     (A) Name and address;

2-31

     (B) Date and place of birth;

2-32

     (C) Social security number;

2-33

     (D) ABO blood type and rh factor;

3-34

     (E) Type of injury;

3-35

     (F) Date and time of treatment;

3-36

     (G) Date and time of death, if applicable; and

3-37

     (H) A description of distinguishing physical characteristics, including height, weight,

3-38

gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars,

3-39

and tattoos.

3-40

     (I) Except as permitted by this subsection, the health care provider may not disclose for

3-41

the purposes of identification or location under this subsection any protected health information

3-42

related to the patient’s DNA or DNA analysis, dental records, or typing, samples or analysis of

3-43

body fluids or tissue.

3-44

     (iii) A health care provider may disclose protected health information in response to a law

3-45

enforcement official's request for such information about a patient who is or is suspected to be a

3-46

victim of a crime, other than disclosures that are subject to subsection (b)(4)(vii) of this section,

3-47

if:

3-48

     (A) The patient agrees to the disclosure; or

3-49

     (B) The health care provider is unable to obtain the patient’s agreement because of

3-50

incapacity or other emergency circumstances provided that:

3-51

     (i) The law enforcement official represents that such information is needed to determine

3-52

whether a violation of law by a person other than the victim has occurred, and such information is

3-53

not intended to be used against the victim;

3-54

     (ii) The law enforcement official represents that immediate law enforcement activity that

3-55

depends upon the disclosure would be materially and adversely affected by waiting until the

3-56

patient is able to agree to the disclosure; and

3-57

     (iii) The disclosure is in the best interests of the patient as determined by the health care

3-58

provider, in the exercise of professional judgment.

3-59

     (iv) A health care provider may disclose protected health information about a patient who

3-60

has died to a law enforcement official for the purpose of alerting law enforcement of the death of

3-61

the patient if the health care provider has a suspicion that such death may have resulted from

3-62

criminal conduct.

3-63

     (v) A health care provider may disclose to a law enforcement official protected health

3-64

information that the health care provider believes in good faith constitutes evidence of criminal

3-65

conduct that occurred on the premises of the health care provider.

3-66

     (vi) (A) A health care provider providing emergency health care in response to a medical

3-67

emergency, other than such emergency on the premises of the covered health care provider, may

3-68

disclose protected health information to a law enforcement official if such disclosure appears

4-1

necessary to alert law enforcement to:

4-2

     (1) The commission and nature of a crime;

4-3

     (2) The location of such crime or of the victim(s) of such crime; and

4-4

     (3) The identity, description, and location of the perpetrator of such crime.

4-5

     (B) If a health care provider believes that the medical emergency described in subsection

4-6

(b)(vi)(A) of this section is the result of abuse, neglect, or domestic violence of the individual in

4-7

need of emergency health care, subsection (b)(vi)(A) of this section does not apply and any

4-8

disclosure to a law enforcement official for law enforcement purposes is subject to subsection

4-9

(b)(4)(vii) of this section.

4-10

     (vii) (A) Except for reports permitted by subsection (b)(4)(i) of this section, a health care

4-11

provider may disclose protected health information about a patient whom the health care provider

4-12

reasonably believes to be a victim of abuse, neglect, or domestic violence to law enforcement or a

4-13

government authority, including a social service or protective services agency, authorized by law

4-14

to receive reports of such abuse, neglect, or domestic violence:

4-15

     (1) To the extent the disclosure is required by law and the disclosure complies with and is

4-16

limited to the relevant requirements of such law;

4-17

     (2) If the patient agrees to the disclosure; or

4-18

     (3) To the extent the disclosure is expressly authorized by statute or regulation and:

4-19

     (i) The health care provider, in the exercise of professional judgment, believes the

4-20

disclosure is necessary to prevent serious harm to the patient or other potential victims; or

4-21

     (ii) If the patient is unable to agree because of incapacity, a law enforcement or other

4-22

public official authorized to receive the report represents that the protected health information for

4-23

which disclosure is sought is not intended to be used against the patient and that an immediate

4-24

enforcement activity that depends upon the disclosure would be materially and adversely affected

4-25

by waiting until the patient is able to agree to the disclosure.

4-26

     (B) A health care provider that makes a disclosure permitted by subsection (b)(4)(vii)(A)

4-27

of this section must promptly inform the patient that such a report has been or will be made,

4-28

except if:

4-29

     (1) The health care facility, in the exercise of professional judgment, believes informing

4-30

the patient would place the individual at risk of serious harm; or

4-31

     (2) The health care provider would be informing a personal representative, and the health

4-32

care provider reasonably believes the personal representative is responsible for the abuse, neglect,

4-33

or other injury, and that informing such person would not be in the best interests of the individual

4-34

as determined by the covered entity, in the exercise of professional judgment.

5-1

     (viii) The disclosures authorized by this subsection being shall be limited to the minimum

5-2

amount of information necessary to accomplish the intended purpose of the release of

5-3

information.

5-4

      (5) Between or among qualified personnel and health care providers within the health

5-5

care system for purposes of coordination of health care services given to the patient and for

5-6

purposes of education and training within the same health care facility; or

5-7

      (6) To third party health insurers including to utilization review agents as provided by

5-8

section 23-17.12-9(c)(4), third party administrators licensed pursuant to chapter 20.7 of title 27

5-9

and other entities that provide operational support to adjudicate health insurance claims or

5-10

administer health benefits;

5-11

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

5-12

anticipate a medical liability action; or

5-13

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

5-14

the patient whose information is at issue brings a medical liability action against a health care

5-15

provider.

5-16

      (ii) Disclosure by a health care provider of a patient's health care information which is

5-17

relevant to a civil action brought by the patient against any person or persons other than that

5-18

health care provider may occur only under the discovery methods provided by the applicable

5-19

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

5-20

and not through informal ex parte contacts with the provider by persons other than the patient or

5-21

his or her legal representative. Nothing in this section shall limit the right of a patient or his or her

5-22

attorney to consult with that patient's own physician and to obtain that patient's own health care

5-23

information;

5-24

      (9) To public health authorities in order to carry out their functions as described in this

5-25

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

5-26

are not restricted to, investigations into the causes of disease, the control of public health hazards,

5-27

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

5-28

health professionals and facilities, review of health care such as that required by the federal

5-29

government and other governmental agencies;

5-30

      (10) To the state medical examiner in the event of a fatality that comes under his or her

5-31

jurisdiction;

5-32

      (11) In relation to information that is directly related to current claim for workers'

5-33

compensation benefits or to any proceeding before the workers' compensation commission or

5-34

before any court proceeding relating to workers' compensation;

6-1

      (12) To the attorneys for a health care provider whenever that provider considers that

6-2

release of information to be necessary in order to receive adequate legal representation;

6-3

      (13) By a health care provider to appropriate school authorities of disease, health

6-4

screening and/or immunization information required by the school; or when a school age child

6-5

transfers from one school or school district to another school or school district;

6-6

      (14) To a law enforcement authority to protect the legal interest of an insurance

6-7

institution, agent, or insurance-support organization in preventing and prosecuting the

6-8

perpetration of fraud upon them;

6-9

      (15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or

6-10

subpoena duces tecum when that information is required for the investigation or prosecution of

6-11

criminal wrongdoing by a health care provider relating to his or her or its provisions of health

6-12

care services and that information is unavailable from any other source; provided, that any

6-13

information so obtained is not admissible in any criminal proceeding against the patient to whom

6-14

that information pertains;

6-15

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

6-16

when that information is required to determine the eligibility of a person to vote by mail ballot

6-17

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

6-18

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

6-19

person's illness or disability, the date when that person was last examined and that it would be an

6-20

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

6-21

      (18) To the central cancer registry;

6-22

      (19) To the Medicaid fraud control unit of the attorney general's office for the

6-23

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

6-24

his or her or its provision of health care services to then Medicaid eligible recipients or patients,

6-25

residents, or former patients or residents of long term residential care facilities; provided, that any

6-26

information obtained shall not be admissible in any criminal proceeding against the patient to

6-27

whom that information pertains;

6-28

      (20) To the state department of children, youth, and families pertaining to the disclosure

6-29

of health care records of children in the custody of the department;

6-30

      (21) To the foster parent or parents pertaining to the disclosure of health care records of

6-31

children in the custody of the foster parent or parents; provided, that the foster parent or parents

6-32

receive appropriate training and have ongoing availability of supervisory assistance in the use of

6-33

sensitive information that may be the source of distress to these children;

7-34

      (22) A hospital may release the fact of a patient's admission and a general description of

7-35

a patient's condition to persons representing themselves as relatives or friends of the patient or as

7-36

a representative of the news media. The access to confidential health care information to persons

7-37

in accredited educational programs under appropriate provider supervision shall not be deemed

7-38

subject to release or transfer of that information under subsection (a) of this section; or

7-39

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

7-40

under sections 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care

7-41

information under any of the above exceptions is not the basis for any legal liability, civil or

7-42

criminal, nor considered a violation of this chapter; or

7-43

      (24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

7-44

attorneys, when the information is contained within a decision-making assessment tool which

7-45

conforms to the provisions of section 33-15-47.

7-46

      (c) Third parties receiving and retaining a patient's confidential health care information

7-47

must establish at least the following security procedures:

7-48

      (1) Limit authorized access to personally identifiable confidential health care

7-49

information to persons having a "need to know" that information; additional employees or agents

7-50

may have access to that information which does not contain information from which an individual

7-51

can be identified;

7-52

      (2) Identify an individual or individuals who have responsibility for maintaining security

7-53

procedures for confidential health care information;

7-54

      (3) Provide a written statement to each employee or agent as to the necessity of

7-55

maintaining the security and confidentiality of confidential health care information, and of the

7-56

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

7-57

information. The receipt of that statement shall be acknowledged by the employee or agent, who

7-58

signs and returns the statement to his or her employer or principal, who retains the signed

7-59

original. The employee or agent shall be furnished with a copy of the signed statement;

7-60

      (4) Take no disciplinary or punitive action against any employee or agent solely for

7-61

bringing evidence of violation of this chapter to the attention of any person.

7-62

      (d) Consent forms for the release or transfer of confidential health care information shall

7-63

contain, or in the course of an application or claim for insurance be accompanied by a notice

7-64

containing, the following information in a clear and conspicuous manner:

7-65

      (1) A statement of the need for and proposed uses of that information;

7-66

      (2) A statement that all information is to be released or clearly indicating the extent of

7-67

the information to be released; and

8-68

      (3) A statement that the consent for release or transfer of information may be withdrawn

8-69

at any future time and is subject to revocation, except where an authorization is executed in

8-70

connection with an application for a life or health insurance policy in which case the

8-71

authorization expires two (2) years from the issue date of the insurance policy, and when signed

8-72

in connection with a claim for benefits under any insurance policy the authorization shall be valid

8-73

during the pendency of that claim. Any revocation shall be transmitted in writing.

8-74

      (e) Except as specifically provided by law, an individual's confidential health care

8-75

information shall not be given, sold, transferred, or in any way relayed to any other person not

8-76

specified in the consent form or notice meeting the requirements of subsection (d) of this section

8-77

without first obtaining the individual's additional written consent on a form stating the need for

8-78

the proposed new use of this information or the need for its transfer to another person.

8-79

      (f) Nothing contained in this chapter shall be construed to limit the permitted disclosure

8-80

of confidential health care information and communications described in subsection (b) of this

8-81

section.

8-82

     SECTION 2. This act shall take effect upon passage.

=======

LC01314/SUB A

========

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS -- CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

***

9-1

     This act would require mandatory disclosure to appropriate law enforcement personnel if

9-2

a health care provider providing treatment to a patient in a hospital, if such disclosure appears

9-3

necessary to alert law enforcement to the commission and nature of a crime, the location of such

9-4

crime or the victim(s) of such crime, or the identity, description, location of the perpetrator of

9-5

such crime. If a health care provider reasonably believes that the patient receiving treatment has

9-6

been a victim of domestic violence or sexual assault, the health care provider must receive the

9-7

patient’s consent to the release of information to law enforcement personnel.

9-8

     This act would take effect upon passage.

=======

LC01314/SUB A

=======