Chapter 314

2004 -- H 7321

Enacted 07/03/04

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - - CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

Introduced By: Representatives Lewiss, Anguilla, Lima, Giannini, and Dennigan

Date Introduced: January 22, 2004

It is enacted by the General Assembly as follows:

     SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled

"Confidentiality of Health Care Communications and Information Act" is hereby amended to read

as follows:

5-37.3-4. Limitations on and permitted disclosures. -- (a) Except as provided in

subsection (b) or as specifically provided by the law, a patient's confidential health care

information shall not be released or transferred without the written consent of the patient or his or

her authorized representative, on a consent form meeting the requirements of subsection (d), a

copy of any notice used pursuant to subsection (d), and of any signed consent shall upon request,

be provided to the patient prior to his or her signing a consent form. Provided, that any and all

managed care entities and managed care contractors writing policies in the state are prohibited

from providing any information related to enrollees which is personal in nature and could

reasonably lead to identification of an individual and is not essential for the compilation of

statistical data related to enrollees, to any international, national, regional, or local medical

information data base. Provided, further, that this provision would not restrict or prohibit the

transfer of information to the department of health to carry out its statutory duties and

responsibilities.

      (1) Any person who violates the provisions of this section may be liable for actual and

punitive damages.

      (2) The court may award a reasonable attorney's fee at its discretion to the prevailing

party in any civil action under this section.

      (3) Any person who knowingly and intentionally violates the provisions of this section

shall upon conviction, be fined not more than five thousand ($5,000) dollars for each violation, or

imprisoned not more than six (6) months for each violation, or both.

      (4) Any contract or agreement which purports to waive the provisions of this section is

declared null and void as against public policy.

      (b) No consent for release or transfer of confidential health care information is required

in the following situations:

      (1) To a physician, dentist, or other medical personnel who believes in good faith that the

information is necessary for diagnosis or treatment of that individual in a medical or dental

emergency;

      (2) To medical and dental peer review boards, or the board of medical licensure and

discipline, or board of examiners in dentistry;

      (3) To qualified personnel for the purpose of conducting scientific research, management

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies,

provided that personnel shall not identify, directly or indirectly, any individual patient in any

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

      (4) By a health care provider to appropriate law enforcement personnel, or to a person if

the health care provider believes that person or his or her family to be in danger from a patient; or

to appropriate law enforcement personnel if the patient has or is attempting to obtain narcotic

drugs from the health care provider illegally; or to appropriate law enforcement personnel or

appropriate child protective agencies if the patient is a minor child who the health care provider

believes, after providing health care services to the patient, to have been physically or

psychologically abused; or to law enforcement personnel in the case of a gunshot wound

reportable under section 11-47-48;

      (5) Between or among qualified personnel and health care providers within the health

care system for purposes of coordination of health care services given to the patient and for

purposes of education and training within the same health care facility; or

      (6) To third party health insurers including to utilization review agents as provided by

section 23-17.12-9(11), third party administrators licensed pursuant to chapter 20.7 of title 27 and

other entities that provide operational support to adjudicate health insurance claims or administer

health benefits;

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

anticipate a medical liability action; or

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

the patient whose information is at issue brings a medical liability action against a health care

provider.

      (ii) Disclosure by a health care provider of a patient's health care information which is

relevant to a civil action brought by the patient against any person or persons other than that

health care provider may occur only under the discovery methods provided by the applicable

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

and not through informal ex parte contacts with the provider by persons other than the patient or

his or her legal representative. Nothing in this section limits the right of a patient or his or her

attorney to consult with that patient's own physician and to obtain that patient's own health care

information;

      (9) To public health authorities in order to carry out their functions as described in this

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

are not restricted to, investigations into the causes of disease, the control of public health hazards,

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

health professionals and facilities, review of health care such as that required by the federal

government and other governmental agencies;

      (10) To the state medical examiner in the event of a fatality that comes under his or her

jurisdiction;

      (11) In relation to information that is directly related to current claim for workers'

compensation benefits or to any proceeding before the workers' compensation commission or

before any court proceeding relating to workers' compensation;

      (12) To the attorneys for a health care provider whenever that provider considers that

release of information to be necessary in order to receive adequate legal representation;

      (13) By a health care provider to appropriate school authorities of disease, health

screening and/or immunization information required by the school; or when a school age child

transfers from one school or school district to another school or school district;

      (14) To a law enforcement authority to protect the legal interest of an insurance

institution, agent, or insurance-support organization in preventing and prosecuting the

perpetration of fraud upon them;

      (15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or

subpoena duces tecum when that information is required for the investigation or prosecution of

criminal wrongdoing by a health care provider relating to his or her or its provisions of health

care services and that information is unavailable from any other source; provided, that any

information so obtained is not admissible in any criminal proceeding against the patient to whom

that information pertains;

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

when that information is required to determine the eligibility of a person to vote by mail ballot

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

person's illness or disability, the date when that person was last examined and that it would be an

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

      (18) To the central cancer registry;

      (19) To the medicaid fraud control unit of the attorney general's office for the

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

his or her or its provision of health care services to then medicaid eligible recipients or patients,

residents, or former patients or residents of long term residential care facilities; provided, that any

information obtained is not admissible in any criminal proceeding against the patient to whom

that information pertains;

      (20) To the state department of children, youth, and families pertaining to the disclosure

of health care records of children in the custody of the department;

      (21) To the foster parent or parents pertaining to the disclosure of health care records of

children in the custody of the foster parent or parents; provided, that the foster parent or parents

receive appropriate training and have ongoing availability of supervisory assistance in the use of

sensitive information that may be the source of distress to these children;

      (22) A hospital may release the fact of a patient's admission and a general description of

a patient's condition to persons representing themselves as relatives or friends of the patient or as

a representative of the news media. The access to confidential health care information to persons

in accredited educational programs under appropriate provider supervision shall not be deemed

subject to release or transfer of that information under subsection (a); or

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

under sections 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care

information under any of the above exceptions is not the basis for any legal liability, civil or

criminal, nor considered a violation of this chapter. ; or

(24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

attorneys, when the information is contained within a decision-making assessment tool which

conforms to the provisions of section 33-15-47.

      (c) Third parties receiving and retaining a patient's confidential health care information

must establish at least the following security procedures:

      (1) Limit authorized access to personally identifiable confidential health care

information to persons having a "need to know" that information; additional employees or agents

may have access to that information which does not contain information from which an individual

can be identified;

      (2) Identify an individual or individuals who have responsibility for maintaining security

procedures for confidential health care information;

      (3) Provide a written statement to each employee or agent as to the necessity of

maintaining the security and confidentiality of confidential health care information, and of the

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

information. The receipt of that statement is acknowledged by the employee or agent, who signs

and returns the statement to his or her employer or principal, who retains the signed original. The

employee or agent is furnished with a copy of the signed statement;

      (4) Take no disciplinary or punitive action against any employee or agent solely for

bringing evidence of violation of this chapter to the attention of any person.

      (d) Consent forms for the release or transfer of confidential health care information shall

contain, or in the course of an application or claim for insurance be accompanied by a notice

containing, the following information in a clear and conspicuous manner:

      (1) A statement of the need for and proposed uses of that information;

      (2) A statement that all information is to be released or clearly indicating the extent of

the information to be released; and

      (3) A statement that the consent for release or transfer of information may be withdrawn

at any future time and is subject to revocation, except where an authorization is executed in

connection with an application for a life or health insurance policy in which case the

authorization expires two (2) years from the issue date of the insurance policy, and when signed

in connection with a claim for benefits under any insurance policy the authorization is valid

during the pendency of that claim. Any revocation is transmitted in writing.

      (e) Except as specifically provided by law an individual's confidential health care

information shall not be given, sold, transferred, or in any way relayed to any other person not

specified in the consent form or notice meeting the requirements of subsection (d) without first

obtaining the individual's additional written consent on a form stating the need for the proposed

new use of this information or the need for its transfer to another person.

      (f) Nothing contained in this chapter is construed to limit the permitted disclosure of

confidential health care information and communications described in subsection (b) of this

section.

     SECTION 2. Section 40.1-5-26 of the General Laws in Chapter 40.1-5 entitled "Mental

Health Law" is hereby amended to read as follows:

40.1-5-26. Disclosure of confidential information and records. -- (a) The fact of

admission or certification and all information and records compiled, obtained, or maintained in

the course of providing services to persons under this chapter shall be confidential.

      (b) Information and records may be disclosed only:

      (1) To any person, with the written consent of the patient or his or her guardian.

      (2) In communications among qualified medical or mental health professionals in the

provision of services or appropriate referrals, or in the course of court proceedings. The consent

of the patient, or his or her guardian, must be obtained before information or records may be

disclosed by a professional person employed by a facility to a professional person not employed

by the facility who does not have the medical responsibility for the patient's care.

      (3) When the person receiving services, or his or her guardian, designates persons to

whom information or records may be released, or if the person is a minor, when his or her parents

or guardian make the designation.

      (4) To the extent necessary for a recipient to make a claim, or for a claim to be made on

behalf of a recipient for aid, insurance, or medical assistance to which he or she may be entitled.

      (5) To proper medical authorities for the purpose of providing emergency medical

treatment where the person's life or health are in immediate jeopardy.

      (6) For program evaluation and/or research, provided that the director adopts rules for

the conduct of the evaluations and/or research. The rules shall include, but need not be limited to,

the requirement that all evaluators and researchers must sign an oath of confidentiality, agreeing

not to divulge, publish, or otherwise make known, to unauthorized persons or the public, any

information obtained in the course of the evaluation or research regarding persons who have

received services such that the person who received the services is identifiable.

      (7) To the courts and persons designated by judges thereof in accordance with applicable

rules of procedure. The records and files maintained in any court proceeding pursuant to this

chapter shall be confidential and available only to the person who was the subject of the

proceeding or his or her attorney.

      (8) To the state medical examiner in connection with the investigation of a fatality of a

current or former patient to the extent necessary to assist the medical examiner in determining the

cause of death.

      (9) To the director of health in accordance with and to the extent authorized by the

provisions of chapter 37.3 of title 5 and all applicable federal laws and regulations, provided

however that with respect to any information obtained, the department complies with all state and

federal confidentiality laws, including but not limited to, chapter 37.3 of title 5 and specifically

section 5-37.3-4(c), and that the name or name(s) of the patient(s) who is or are determined by the

director of health to be immaterial to the request, inquiry or investigation remain unidentifiable.

Any treatment facility which provides information to the director of health in accord with a

request under this subsection is not liable for wrongful disclosure arising out of any subsequent

disclosure by the director of health.

(10) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

attorneys, when the information is contained within a decision-making assessment tool which

conforms to the provisions of section 33-15-47.

     SECTION 3. This act shall take effect upon passage.

=======

LC00477

=======