2016 -- H 7786

========

LC005182

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2016

____________

A N   A C T

RELATING TO INSURANCE -- THE MEDICAL BILLING INNOVATION ACT OF 2016

     Introduced By: Representatives McKiernan, Carnevale, Carson, O'Brien, and Slater

     Date Introduced: March 02, 2016

     Referred To: House Corporations

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 27 of the General Laws entitled "INSURANCE" is hereby amended

by adding thereto the following chapter:

CHAPTER 20.12

THE MEDICAL BILLING INNOVATION ACT OF 2016

     27-20.12-1. Short title. -- This act shall be known and may be cited as the "Medical

Billing Innovation Act of 2016".

     27-20.12-2. Purpose.-- The purpose of this chapter is to:

     (1) Ensure that consumers of health care products and services have access to all

information required to make informed purchasing decisions;

     (2) Protect consumers of health care products and services by ensuring that they benefit

from the rights guaranteed to consumers of other products and services, including protection from

unfair, deceptive, and abusive acts and practices as defined in 12 U.S.C. §5531 prohibiting unfair,

deceptive, or abusive acts or practices (collectively, UDAAPs);

     (3) Facilitate innovation in Rhode Island by providing the foundation necessary for the

development of technologies that allow consumers greater understanding and control of their

health care related expenses; and

     (4) Increase patient accountability and participation by helping patients associate

financial costs with their health care decisions.

     27-20.12-3. Definitions.-- The following terms shall have the meanings given below for

purposes of this section:

     (1) "Application programming interface" means a software protocol that expresses a set

of operations inputs, outputs, and underlying types, that allows a second party's software to access

a defined set of information in real time.

     (2) "Certified health care information management software vendor" means any entity

which produces health care information management software and is certified pursuant to §27-

20.12-5.

     (3) "Health care facility" means an institution providing health care services or a health

care setting, including, but not limited to, hospitals and other licensed inpatient centers,

ambulatory surgical or treatment centers, skilled nursing centers, residential treatment centers,

diagnostic, laboratory and imaging centers, and rehabilitation and other therapeutic health

settings.

     (4) "Health care information management software" means software that presents

information associated with health care, and in particular, information related to billing, to

consumers.

     (5) "Health care professional" means a physician or other health care practitioner

licensed, accredited or certified to perform specified health care services consistent with state

law.

     (6) "Health care provider" means a health care professional or a health care facility.

     (7) "Health care services" means any services included in the furnishing to any individual

medical, podiatric, or dental care, or hospitalization, or incidental to the furnishing of that care or

hospitalization, or incidental to the furnishing to any person of any and all other services for the

purpose of preventing, alleviating, curing, or healing human illness, injury, or physical disability.

     (8) "Health insurer" means any person, firm or corporation offering and/or insuring health

care services on a prepaid basis, including, but not limited to, a nonprofit hospital service

corporation as defined in chapter 19 of title 27, a nonprofit medical service corporation as defined

in chapter 20 of title 27, a health maintenance organization as defined in chapter 41 of title 27, or

an entity offering a policy of accident and sickness insurance.

     (9) "Strong cryptography" means cryptography based on industry-tested and accepted

algorithms, along with strong key lengths (minimum 112-bits of effective key strength) and

proper key-management practices. Cryptography is a method to protect data and includes both

encryption (which is reversible) and hashing (which is not reversible, or "one way"). As of the

present time, examples of industry-tested and accepted standards and algorithms for minimum

encryption strength include AES (128 bits and higher), TDES (minimum triple-length keys), RSA

LC005182 - Page 2 of 5

(2048 bits and higher), ECC (160 bits and higher), and EIGamal (2048 bits and higher). See NIST

Special Publication 800-57 Part I (http://esrc.nist.gov/publications/) for more guidance on

cryptographic key strengths and algorithms.

     (10) "User" means a consumer who uses health care information management software.

     (11) "Valid identification information" means social security number or tax identification

number, and date of birth or a token indicating the prior communication thereof.

     27-20.12-4. Member access through application programming interface. -- Health

insurers shall ensure that from time to time and at any time any member may request via an

application programming interface any and all information related to the member's insurance

coverage and health care, and shall via the application programming interface all requested

information, whenever the request meets the following conditions:

     (1) The request includes valid identification information;

     (2) The information requested is currently or ordinarily provided to members; and

     (3) The request is made through a health care information management software provided

by a certified health care information management software vendor.

     27-20.12-5. Certification of health care information management software. -- (a) A

certified health care information management software vendor shall:

     (1) Implement measures to validate the identity of any user submitting a request through

the application programming interface;

     (2) Comply with §5-37.3-4(c), the "confidentiality of health care communications and

information act" provision governing third parties;

     (3) Present a notice to users initially and upon request that:

     (i) The vendor is a certified vendor of health care information management software

under §27-20.12-5;

     (ii) The user may instruct the vendor to request and receive information about the user's

health care bills from health care providers and health insurers;

     (iii) Any data requested by the user will exist on the vendor's secure servers in order to

provide the user with services; and

     (iv) As a user of the vendor's software, the user has the right to download the user's data,

and/or to instruct the vendor to delete the user's data from the vendor's servers at any time.

     (4) Utilize strong cryptography wherever protected health information, as defined by 45

CFR 160, 103, is stored or transmitted;

     (5) Maintain a publicly-available privacy policy covering users; and

     (6) Not release or transfer any patient information without written consent of the patient,

LC005182 - Page 3 of 5

or their authorized representative.

     (b) Vendors shall annually certify in writing that they comply with subsection (a)(3) of

this section..

     (c) The office of the health insurance commissioner shall maintain a register of valid

certifications, which it shall publish on its website.

     SECTION 2. This act shall take effect on June 1, 2017.

========

LC005182

========

LC005182 - Page 4 of 5

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO INSURANCE -- THE MEDICAL BILLING INNOVATION ACT OF 2016

***

     This act would ensure that health care consumers have access to all information to make

informed purchasing decisions, that they benefit from rights guaranteed to consumers of other

products and services, that consumers possesses technologies to understand and control their

health care related expenses and that patients participate in the association of financial costs with

their health care decisions.

     This act would take effect on June 1, 2017.

========

LC005182

========

LC005182 - Page 5 of 5