2013 -- S 0543

=======

LC00995

=======

STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2013

____________

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF

HEALTHCARE COMMUNICATIONS AND INFORMATION ACT

     Introduced By: Senators Cool Rumsey, and Satchell

     Date Introduced: February 28, 2013

     Referred To: Senate Judiciary

It is enacted by the General Assembly as follows:

1-1

     SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled

1-2

"Confidentiality of Health Care Communications and Information Act" is hereby amended to read

1-3

as follows:

1-4

     5-37.3-4. Limitations on and permitted disclosures. -- (a) (1) Except as provided in

1-5

subsection (b) of this section or as specifically provided by the law, a patient's confidential health

1-6

care information shall not be released or transferred without the written consent of the patient or

1-7

his or her authorized representative, on a consent form meeting the requirements of subsection (d)

1-8

of this section. A copy of any notice used pursuant to subsection (d) of this section, and of any

1-9

signed consent shall, upon request, be provided to the patient prior to his or her signing a consent

1-10

form. Any and all managed care entities and managed care contractors writing policies in the state

1-11

shall be prohibited from providing any information related to enrollees which is personal in

1-12

nature and could reasonably lead to identification of an individual and is not essential for the

1-13

compilation of statistical data related to enrollees, to any international, national, regional, or local

1-14

medical information data base. This provision shall not restrict or prohibit the transfer of

1-15

information to the department of health to carry out its statutory duties and responsibilities.

1-16

      (2) Any person who violates the provisions of this section may be liable for actual and

1-17

punitive damages.

1-18

      (3) The court may award a reasonable attorney's fee at its discretion to the prevailing

1-19

party in any civil action under this section.

2-1

      (4) Any person who knowingly and intentionally violates the provisions of this section

2-2

shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation,

2-3

or imprisoned not more than six (6) months for each violation, or both.

2-4

      (5) Any contract or agreement which purports to waive the provisions of this section

2-5

shall be declared null and void as against public policy.

2-6

      (b) No consent for release or transfer of confidential health care information shall be

2-7

required in the following situations:

2-8

      (1) To a physician, dentist, or other medical personnel who believes, in good faith, that

2-9

the information is necessary for diagnosis or treatment of that individual in a medical or dental

2-10

emergency;

2-11

      (2) To medical and dental peer review boards, or the board of medical licensure and

2-12

discipline, or board of examiners in dentistry;

2-13

      (3) To qualified personnel for the purpose of conducting scientific research, management

2-14

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies;

2-15

provided, that personnel shall not identify, directly or indirectly, any individual patient in any

2-16

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

2-17

      (4) By a health care provider to appropriate law enforcement personnel, or to a person if

2-18

the health care provider believes that person or his or her family is in danger from a patient; or to

2-19

appropriate law enforcement personnel if the patient has or is attempting to obtain narcotic drugs

2-20

from the health care provider illegally; or to appropriate law enforcement personnel or

2-21

appropriate child protective agencies if the patient is a minor child or the parent or guardian of

2-22

said child and/or the health care provider believes, after providing health care services to the

2-23

patient, that the child is or has been physically, psychologically or sexually abused and neglected

2-24

as reportable pursuant to section 40-11-3; or to appropriate law enforcement personnel if the

2-25

patient is an elder person and the healthcare provider believes, after providing healthcare services

2-26

to the patient, that the elder person is or has been physically, psychologically or sexually abused

2-27

or neglected; or to law enforcement personnel in the case of a gunshot wound reportable under

2-28

section 11-47-48; The disclosures authorized by this subsection being limited to the minimum

2-29

amount of information necessary to accomplish the intended purpose of the release of

2-30

information.

2-31

      (5) Between or among qualified personnel and health care providers within the health

2-32

care system for purposes of coordination of health care services given to the patient and for

2-33

purposes of education and training within the same health care facility; or

3-34

      (6) To third party health insurers including to utilization review agents as provided by

3-35

section 23-17.12-9(c)(4), third party administrators licensed pursuant to chapter 20.7 of title 27

3-36

and other entities that provide operational support to adjudicate health insurance claims or

3-37

administer health benefits;

3-38

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

3-39

anticipate a medical liability action; or

3-40

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

3-41

the patient whose information is at issue brings a medical liability action against a health care

3-42

provider.

3-43

      (ii) Disclosure by a health care provider of a patient's health care information which is

3-44

relevant to a civil action brought by the patient against any person or persons other than that

3-45

health care provider may occur only under the discovery methods provided by the applicable

3-46

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

3-47

and not through informal ex parte contacts with the provider by persons other than the patient or

3-48

his or her legal representative. Nothing in this section shall limit the right of a patient or his or her

3-49

attorney to consult with that patient's own physician and to obtain that patient's own health care

3-50

information;

3-51

      (9) To public health authorities in order to carry out their functions as described in this

3-52

title and titles 21 and 23, and rules promulgated under those titles. These functions include, but

3-53

are not restricted to, investigations into the causes of disease, the control of public health hazards,

3-54

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

3-55

health professionals and facilities, review of health care such as that required by the federal

3-56

government and other governmental agencies;

3-57

      (10) To the state medical examiner in the event of a fatality that comes under his or her

3-58

jurisdiction;

3-59

      (11) In relation to information that is directly related to current claim for workers'

3-60

compensation benefits or to any proceeding before the workers' compensation commission or

3-61

before any court proceeding relating to workers' compensation;

3-62

      (12) To the attorneys for a health care provider whenever that provider considers that

3-63

release of information to be necessary in order to receive adequate legal representation;

3-64

      (13) By a health care provider to appropriate school authorities of disease, health

3-65

screening and/or immunization information required by the school; or when a school age child

3-66

transfers from one school or school district to another school or school district;

3-67

      (14) To a law enforcement authority to protect the legal interest of an insurance

3-68

institution, agent, or insurance-support organization in preventing and prosecuting the

4-1

perpetration of fraud upon them;

4-2

      (15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or

4-3

subpoena duces tecum when that information is required for the investigation or prosecution of

4-4

criminal wrongdoing by a health care provider relating to his or her or its provisions of health

4-5

care services and that information is unavailable from any other source; provided, that any

4-6

information so obtained is not admissible in any criminal proceeding against the patient to whom

4-7

that information pertains;

4-8

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

4-9

when that information is required to determine the eligibility of a person to vote by mail ballot

4-10

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

4-11

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

4-12

person's illness or disability, the date when that person was last examined and that it would be an

4-13

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

4-14

      (18) To the central cancer registry;

4-15

      (19) To the Medicaid fraud control unit of the attorney general's office for the

4-16

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

4-17

his or her or its provision of health care services to then Medicaid eligible recipients or patients,

4-18

residents, or former patients or residents of long term residential care facilities; provided, that any

4-19

information obtained shall not be admissible in any criminal proceeding against the patient to

4-20

whom that information pertains;

4-21

      (20) To the state department of children, youth, and families pertaining to the disclosure

4-22

of health care records of children in the custody of the department;

4-23

      (21) To the foster parent or parents pertaining to the disclosure of health care records of

4-24

children in the custody of the foster parent or parents; provided, that the foster parent or parents

4-25

receive appropriate training and have ongoing availability of supervisory assistance in the use of

4-26

sensitive information that may be the source of distress to these children;

4-27

      (22) A hospital may release the fact of a patient's admission and a general description of

4-28

a patient's condition to persons representing themselves as relatives or friends of the patient or as

4-29

a representative of the news media. The access to confidential health care information to persons

4-30

in accredited educational programs under appropriate provider supervision shall not be deemed

4-31

subject to release or transfer of that information under subsection (a) of this section; or

4-32

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

4-33

under sections 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care

4-34

information under any of the above exceptions is not the basis for any legal liability, civil or

5-1

criminal, nor considered a violation of this chapter; or

5-2

      (24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

5-3

attorneys, when the information is contained within a decision-making assessment tool which

5-4

conforms to the provisions of section 33-15-47.

5-5

      (c) Third parties receiving and retaining a patient's confidential health care information

5-6

must establish at least the following security procedures:

5-7

      (1) Limit authorized access to personally identifiable confidential health care

5-8

information to persons having a "need to know" that information; additional employees or agents

5-9

may have access to that information which does not contain information from which an individual

5-10

can be identified;

5-11

      (2) Identify an individual or individuals who have responsibility for maintaining security

5-12

procedures for confidential health care information;

5-13

      (3) Provide a written statement to each employee or agent as to the necessity of

5-14

maintaining the security and confidentiality of confidential health care information, and of the

5-15

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

5-16

information. The receipt of that statement shall be acknowledged by the employee or agent, who

5-17

signs and returns the statement to his or her employer or principal, who retains the signed

5-18

original. The employee or agent shall be furnished with a copy of the signed statement;

5-19

      (4) Take no disciplinary or punitive action against any employee or agent solely for

5-20

bringing evidence of violation of this chapter to the attention of any person.

5-21

      (d) Consent forms for the release or transfer of confidential health care information shall

5-22

contain, or in the course of an application or claim for insurance be accompanied by a notice

5-23

containing, the following information in a clear and conspicuous manner:

5-24

      (1) A statement of the need for and proposed uses of that information;

5-25

      (2) A statement that all information is to be released or clearly indicating the extent of

5-26

the information to be released; and

5-27

      (3) A statement that the consent for release or transfer of information may be withdrawn

5-28

at any future time and is subject to revocation, except where an authorization is executed in

5-29

connection with an application for a life or health insurance policy in which case the

5-30

authorization expires two (2) years from the issue date of the insurance policy, and when signed

5-31

in connection with a claim for benefits under any insurance policy the authorization shall be valid

5-32

during the pendency of that claim. Any revocation shall be transmitted in writing.

5-33

      (e) Except as specifically provided by law, an individual's confidential health care

5-34

information shall not be given, sold, transferred, or in any way relayed to any other person not

6-1

specified in the consent form or notice meeting the requirements of subsection (d) of this section

6-2

without first obtaining the individual's additional written consent on a form stating the need for

6-3

the proposed new use of this information or the need for its transfer to another person.

6-4

      (f) Nothing contained in this chapter shall be construed to limit the permitted disclosure

6-5

of confidential health care information and communications described in subsection (b) of this

6-6

section.

6-7

     SECTION 2. This act shall take effect upon passage.

=======

LC00995

========

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF

HEALTHCARE COMMUNICATIONS AND INFORMATION ACT

***

7-1

     This act would allow the release of patient records for investigation and prosecution if a

7-2

healthcare provider believes, after providing healthcare services to an elder patient, that the

7-3

patient is or has been physically, psychologically or sexually abused or neglected.

7-4

     This act would take effect upon passage.

=======

LC00995

=======