2015 -- H 5893

========

LC001755

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2015

____________

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

     

     Introduced By: Representatives Canario, Edwards, Abney, Azzinaro, and Bennett

     Date Introduced: March 13, 2015

     Referred To: House Health, Education & Welfare

     (OHHS)

It is enacted by the General Assembly as follows:

1

     SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled

2

"Confidentiality of Health Care Communications and Information Act" is hereby amended to read

3

as follows:

4

     5-37.3-4. Limitations on and permitted disclosures. -- (a) (1) Except as provided in

5

subsection (b) of this section, or as specifically provided by the law, a patient's confidential health

6

care information shall not be released or transferred without the written consent of the patient, or

7

his or her authorized representative, on a consent form meeting the requirements of subsection (d)

8

of this section. A copy of any notice used pursuant to subsection (d) of this section, and of any

9

signed consent shall, upon request, be provided to the patient prior to his or her signing a consent

10

form. Any and all managed care entities and managed care contractors writing policies in the state

11

shall be prohibited from providing any information related to enrollees that is personal in nature

12

and could reasonably lead to identification of an individual and is not essential for the

13

compilation of statistical data related to enrollees, to any international, national, regional, or local

14

medical information database. This provision shall not restrict or prohibit the transfer of

15

information to the department of health to carry out its statutory duties and responsibilities.

16

      (2) Any person who violates the provisions of this section may be liable for actual and

17

punitive damages.

18

      (3) The court may award a reasonable attorney's fee at its discretion to the prevailing

 

1

party in any civil action under this section.

2

      (4) Any person who knowingly and intentionally violates the provisions of this section

3

shall, upon conviction, be fined not more than five thousand ($5,000) dollars for each violation,

4

or imprisoned not more than six (6) months for each violation, or both.

5

      (5) Any contract or agreement that purports to waive the provisions of this section shall

6

be declared null and void as against public policy.

7

      (b) No consent for release or transfer of confidential health care information shall be

8

required in the following situations:

9

      (1) To a physician, dentist, or other medical personnel who believes, in good faith, that

10

the information is necessary for diagnosis or treatment of that individual in a medical or dental

11

emergency;

12

      (2) To medical and dental peer review boards, or the board of medical licensure and

13

discipline, or board of examiners in dentistry;

14

      (3) To qualified personnel for the purpose of conducting scientific research, management

15

audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies;

16

provided, that personnel shall not identify, directly or indirectly, any individual patient in any

17

report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner;

18

      (4) (i) By a health care provider to appropriate law enforcement personnel, or to a person

19

if the health care provider believes that person, or his or her family, is in danger from a patient; or

20

to appropriate law enforcement personnel if the patient has, or is attempting to obtain, narcotic

21

drugs from the health care provider illegally; or to appropriate law enforcement personnel, or

22

appropriate child protective agencies, if the patient is a minor child or the parent or guardian of

23

said child and/or the health care provider believes, after providing health care services to the

24

patient, that the child is, or has been, physically, psychologically, or sexually abused and

25

neglected as reportable pursuant to § 40-11-3; or to appropriate law enforcement personnel or the

26

division of elderly affairs if the patient is an elder person and the healthcare provider believes,

27

after providing healthcare services to the patient, that the elder person is, or has been, abused,

28

neglected, or exploited as reportable pursuant to § 42-66-8; or to law enforcement personnel in

29

the case of a gunshot wound reportable under § 11-47-48; or to appropriate law enforcement

30

personnel or the department of behavioral healthcare, developmental disabilities and hospitals,

31

office of quality assurance, if the patient is an adult with severe impairments and/or if the health

32

care provider believes, after providing services to the patient, that the person with severe

33

impairments is, or has been, abused, neglected, mistreated, or exploited as reportable pursuant to

34

§§ 40.1-27-2 and/or 40-8.5-2;

 

LC001755 - Page 2 of 11

1

      (ii) A health care provider may disclose protected health information in response to a law

2

enforcement official's request for such information for the purpose of identifying or locating a

3

suspect, fugitive, material witness, or missing person, provided that the health care provider may

4

disclose only the following information:

5

      (A) Name and address;

6

      (B) Date and place of birth;

7

      (C) Social security number;

8

      (D) ABO blood type and rh factor;

9

      (E) Type of injury;

10

      (F) Date and time of treatment;

11

      (G) Date and time of death, if applicable; and

12

      (H) A description of distinguishing physical characteristics, including height, weight,

13

gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars,

14

and tattoos.

15

      (I) Except as permitted by this subsection, the health care provider may not disclose for

16

the purposes of identification or location under this subsection any protected health information

17

related to the patient's DNA or DNA analysis, dental records, or typing, samples, or analysis of

18

body fluids or tissue.

19

      (iii) A health care provider may disclose protected health information in response to a

20

law enforcement official's request for such information about a patient who is, or is suspected to

21

be, a victim of a crime, other than disclosures that are subject to subsection (b)(4)(vii) of this

22

section, if:

23

      (A) The patient agrees to the disclosure; or

24

      (B) The health care provider is unable to obtain the patient's agreement because of

25

incapacity or other emergency circumstances provided that:

26

      (1) The law enforcement official represents that such information is needed to determine

27

whether a violation of law by a person other than the victim has occurred, and such information is

28

not intended to be used against the victim;

29

      (2) The law enforcement official represents that immediate law enforcement activity that

30

depends upon the disclosure would be materially and adversely affected by waiting until the

31

patient is able to agree to the disclosure; and

32

      (3) The disclosure is in the best interests of the patient as determined by the health care

33

provider in the exercise of professional judgment.

34

      (iv) A health care provider may disclose protected health information about a patient

 

LC001755 - Page 3 of 11

1

who has died to a law enforcement official for the purpose of alerting law enforcement of the

2

death of the patient if the health care provider has a suspicion that such death may have resulted

3

from criminal conduct.

4

      (v) A health care provider may disclose to a law enforcement official protected health

5

information that the health care provider believes in good faith constitutes evidence of criminal

6

conduct that occurred on the premises of the health care provider.

7

      (vi) (A) A health care provider providing emergency health care in response to a medical

8

emergency, other than such emergency on the premises of the covered health care provider, may

9

disclose protected health information to a law enforcement official if such disclosure appears

10

necessary to alert law enforcement to:

11

      (1) The commission and nature of a crime;

12

      (2) The location of such crime or of the victim(s) of such crime; and

13

      (3) The identity, description, and location of the perpetrator of such crime.

14

      (B) If a health care provider believes that the medical emergency described in subsection

15

(b)(vi)(A) of this section is the result of abuse, neglect, or domestic violence of the individual in

16

need of emergency health care, subsection (b)(vi)(A) of this section does not apply and any

17

disclosure to a law enforcement official for law enforcement purposes is subject to subsection

18

(b)(4)(vii) of this section.

19

      (vii) (A) Except for reports permitted by subsection (b)(4)(i) of this section, a health care

20

provider may disclose protected health information about a patient the health care provider

21

reasonably believes to be a victim of abuse, neglect, or domestic violence to law enforcement or a

22

government authority, including a social service or protective services agency, authorized by law

23

to receive reports of such abuse, neglect, or domestic violence:

24

      (1) To the extent the disclosure is required by law and the disclosure complies with, and

25

is limited to, the relevant requirements of such law;

26

      (2) If the patient agrees to the disclosure; or

27

      (3) To the extent the disclosure is expressly authorized by statute or regulation and:

28

      (i) The health care provider, in the exercise of professional judgment, believes the

29

disclosure is necessary to prevent serious harm to the patient or other potential victims; or

30

      (ii) If the patient is unable to agree because of incapacity, a law enforcement or other

31

public official authorized to receive the report represents that the protected health information for

32

which disclosure is sought is not intended to be used against the patient and that an immediate

33

enforcement activity that depends upon the disclosure would be materially and adversely affected

34

by waiting until the patient is able to agree to the disclosure.

 

LC001755 - Page 4 of 11

1

      (B) A health care provider that makes a disclosure permitted by subsection (b)(4)(vii)(A)

2

of this section must promptly inform the patient that such a report has been, or will be, made,

3

except if:

4

      (1) The health care facility, in the exercise of professional judgment, believes informing

5

the patient would place the individual at risk of serious harm; or

6

      (2) The health care provider would be informing a personal representative, and the health

7

care provider reasonably believes the personal representative is responsible for the abuse, neglect,

8

or other injury, and that informing such person would not be in the best interests of the individual

9

as determined by the covered entity in the exercise of professional judgment.

10

      (viii) The disclosures authorized by this subsection shall be limited to the minimum

11

amount of information necessary to accomplish the intended purpose of the release of

12

information.

13

      (5) Between, or among, qualified personnel and health care providers within the health

14

care system for purposes of coordination of health care services given to the patient and for

15

purposes of education and training within the same health care facility; or

16

      (6) To third party health insurers, including to utilization review agents as provided by §

17

23-17.12-9(c)(4), third party administrators licensed pursuant to chapter 20.7 of title 27, and other

18

entities that provide operational support to adjudicate health insurance claims or administer health

19

benefits;

20

      (7) To a malpractice insurance carrier or lawyer if the health care provider has reason to

21

anticipate a medical liability action; or

22

      (8) (i) To the health care provider's own lawyer or medical liability insurance carrier if

23

the patient whose information is at issue brings a medical liability action against a health care

24

provider.

25

      (ii) Disclosure by a health care provider of a patient's health care information that is

26

relevant to a civil action brought by the patient against any person or persons other than that

27

health care provider may occur only under the discovery methods provided by the applicable

28

rules of civil procedure (federal or state). This disclosure shall not be through ex parte contacts

29

and not through informal ex parte contacts with the provider by persons other than the patient or

30

his or her legal representative.

31

      Nothing in this section shall limit the right of a patient, or his or her attorney, to consult

32

with that patient's own physician and to obtain that patient's own health care information;

33

      (9) To public health authorities in order to carry out their functions as described in this

34

title and titles 21 and 23 and rules promulgated under those titles. These functions include, but are

 

LC001755 - Page 5 of 11

1

not restricted to, investigations into the causes of disease, the control of public health hazards,

2

enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of

3

health professionals and facilities, review of health care such as that required by the federal

4

government and other governmental agencies;

5

      (10) To the state medical examiner in the event of a fatality that comes under his or her

6

jurisdiction;

7

      (11) In relation to information that is directly related to a current claim for workers'

8

compensation benefits or to any proceeding before the workers' compensation commission or

9

before any court proceeding relating to workers' compensation;

10

      (12) To the attorneys for a health care provider whenever that provider considers that

11

release of information to be necessary in order to receive adequate legal representation;

12

      (13) By a health care provider to appropriate school authorities of disease, health

13

screening, and/or immunization information required by the school; or when a school-age child

14

transfers from one school or school district to another school or school district;

15

      (14) To a law enforcement authority to protect the legal interest of an insurance

16

institution, agent, or insurance-support organization in preventing and prosecuting the

17

perpetration of fraud upon them;

18

      (15) To a grand jury, or to a court of competent jurisdiction, pursuant to a subpoena or

19

subpoena duces tecum when that information is required for the investigation or prosecution of

20

criminal wrongdoing by a health care provider relating to his, her or its provisions of health care

21

services and that information is unavailable from any other source; provided, that any information

22

so obtained, is not admissible in any criminal proceeding against the patient to whom that

23

information pertains;

24

      (16) To the state board of elections pursuant to a subpoena or subpoena duces tecum

25

when that information is required to determine the eligibility of a person to vote by mail ballot

26

and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability;

27

      (17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a

28

person's illness or disability, the date when that person was last examined and that it would be an

29

undue hardship for the person to vote at the polls so that the person may obtain a mail ballot;

30

      (18) To the central cancer registry;

31

      (19) To the Medicaid fraud control unit of the attorney general's office for the

32

investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to

33

his, her or its provision of health care services to then-Medicaid-eligible recipients or patients,

34

residents, or former patients or residents of long-term residential care facilities; provided, that any

 

LC001755 - Page 6 of 11

1

information obtained shall not be admissible in any criminal proceeding against the patient to

2

whom that information pertains;

3

      (20) To the state department of children, youth and families pertaining to the disclosure

4

of health care records of children in the custody of the department;

5

      (21) To the foster parent, or parents, pertaining to the disclosure of health care records of

6

children in the custody of the foster parent, or parents; provided, that the foster parent or parents

7

receive appropriate training and have ongoing availability of supervisory assistance in the use of

8

sensitive information that may be the source of distress to these children;

9

      (22) A hospital may release the fact of a patient's admission and a general description of

10

a patient's condition to persons representing themselves as relatives or friends of the patient or as

11

a representative of the news media. The access to confidential health care information to persons

12

in accredited educational programs under appropriate provider supervision shall not be deemed

13

subject to release or transfer of that information under subsection (a) of this section; or

14

      (23) To the workers' compensation fraud prevention unit for purposes of investigation

15

under §§ 42-16.1-12 -- 42-16.1-16. The release or transfer of confidential health care information

16

under any of the above exceptions is not the basis for any legal liability, civil or criminal, nor

17

considered a violation of this chapter; or

18

      (24) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

19

attorneys, when the information is contained within a decision-making assessment tool that

20

conforms to the provisions of § 33-15-47.

21

      (c) Third parties receiving, and retaining, a patient's confidential health care information

22

must establish at least the following security procedures:

23

      (1) Limit authorized access to personally identifiable, confidential health care

24

information to persons having a "need to know" that information; additional employees or agents

25

may have access to that information that does not contain information from which an individual

26

can be identified;

27

      (2) Identify an individual, or individuals, who have responsibility for maintaining

28

security procedures for confidential health care information;

29

      (3) Provide a written statement to each employee or agent as to the necessity of

30

maintaining the security and confidentiality of confidential health care information, and of the

31

penalties provided for in this chapter for the unauthorized release, use, or disclosure of this

32

information. The receipt of that statement shall be acknowledged by the employee or agent, who

33

signs and returns the statement to his or her employer or principal, who retains the signed

34

original. The employee or agent shall be furnished with a copy of the signed statement; and

 

LC001755 - Page 7 of 11

1

      (4) Take no disciplinary or punitive action against any employee or agent solely for

2

bringing evidence of violation of this chapter to the attention of any person.

3

      (d) Consent forms for the release or transfer of confidential health care information shall

4

contain, or in the course of an application or claim for insurance be accompanied by a notice

5

containing, the following information in a clear and conspicuous manner:

6

      (1) A statement of the need for and proposed uses of that information;

7

      (2) A statement that all information is to be released or clearly indicating the extent of

8

the information to be released; and

9

      (3) A statement that the consent for release or transfer of information may be withdrawn

10

at any future time and is subject to revocation, except where an authorization is executed in

11

connection with an application for a life or health insurance policy in which case the

12

authorization expires two (2) years from the issue date of the insurance policy, and when signed

13

in connection with a claim for benefits under any insurance policy, the authorization shall be

14

valid during the pendency of that claim. Any revocation shall be transmitted in writing.

15

      (e) Except as specifically provided by law, an individual's confidential health care

16

information shall not be given, sold, transferred, or in any way relayed to any other person not

17

specified in the consent form or notice meeting the requirements of subsection (d) of this section

18

without first obtaining the individual's additional written consent on a form stating the need for

19

the proposed new use of this information or the need for its transfer to another person.

20

      (f) Nothing contained in this chapter shall be construed to limit the permitted disclosure

21

of confidential health care information and communications described in subsection (b) of this

22

section.

23

     SECTION 2. Section 40.1-5-26 of the General Laws in Chapter 40.1-5 entitled "Mental

24

Health Law" is hereby amended to read as follows:

25

     40.1-5-26. Disclosure of confidential information and records. [Effective January 1,

26

2015.] -- (a) The fact of admission or certification, and all information and records compiled,

27

obtained, or maintained in the course of providing services to persons under this chapter, shall be

28

confidential.

29

      (b) Information and records may be disclosed only:

30

      (1) To any person, with the written consent of the patient or his or her guardian.

31

      (2) In communications among qualified medical or mental health professionals in the

32

provision of services or appropriate referrals, or in the course of court proceedings. The consent

33

of the patient, or his or her guardian, must be obtained before information or records may be

34

disclosed by a professional person employed by a facility to a professional person not employed

 

LC001755 - Page 8 of 11

1

by the facility who does not have the medical responsibility for the patient's care.

2

      (3) When the person receiving services, or his or her guardian, designates persons to

3

whom information or records may be released, or if the person is a minor, when his or her parents

4

or guardian make the designation.

5

      (4) To the extent necessary for a recipient to make a claim, or for a claim to be made on

6

behalf of a recipient for aid, insurance, or medical assistance to which he or she may be entitled.

7

      (5) To proper medical authorities for the purpose of providing emergency medical

8

treatment where the person's life or health are in immediate jeopardy.

9

      (6) For program evaluation and/or research, provided that the director adopts rules for

10

the conduct of the evaluations and/or research. The rules shall include, but need not be limited to,

11

the requirement that all evaluators and researchers must sign an oath of confidentiality, agreeing

12

not to divulge, publish, or otherwise make known, to unauthorized persons or the public, any

13

information obtained in the course of the evaluation or research regarding persons who have

14

received services such that the person who received the services is identifiable.

15

      (7) To the courts, and persons designated by judges thereof, in accordance with

16

applicable rules of procedure. The records and files maintained in any court proceeding pursuant

17

to this chapter shall be confidential and available only to the person who was the subject of the

18

proceeding or his or her attorney.

19

      (8) To the state medical examiner in connection with the investigation of a fatality of a

20

current or former patient to the extent necessary to assist the medical examiner in determining the

21

cause of death.

22

      (9) To the director of health in accordance with, and to the extent authorized by, the

23

provisions of chapter 37.3 of title 5 and all applicable federal laws and regulations; provided,

24

however, that with respect to any information obtained, the department complies with all state

25

and federal confidentiality laws, including, but not limited to, chapter 37.3 of title 5 and

26

specifically § 5-37.3-4(c), and that the name, or names, of the patient or patients who is or are

27

determined by the director of health to be immaterial to the request, inquiry, or investigation

28

remain unidentifiable. Any treatment facility that provides information to the director of health in

29

accord with a request under this subsection is not liable for wrongful disclosure arising out of any

30

subsequent disclosure by the director of health.

31

      (10) To a probate court of competent jurisdiction, petitioner, respondent, and/or their

32

attorneys, when the information is contained within a decision-making assessment tool that

33

conforms to the provisions of § 33-15-47.

34

      (11) To the department of children, youth, and families and/or the department's

 

LC001755 - Page 9 of 11

1

contracted designee for the purpose of facilitating effective care planning pursuant to § 42-72-

2

5.2(2) and in accordance with applicable state and federal laws, for a child hospitalized for

3

psychiatric services and such services are paid for in whole or in part by the state, or for a child

4

who may be discharged from an acute-care facility to an out-of-home mental or behavioral health

5

agency for services and when such services will be paid for in whole or in part by the state.

6

      (12) To the RIte Care health plans for any child enrolled in RIte Care.

7

      (13) To the NICS database for firearms disqualifying information provided that only

8

individual identifying information required by § 40.1-5-8-(l) is submitted.

9

      (14) To the department of behavioral healthcare, developmental disabilities and

10

hospitals, in order to carry out its functions as described in this title, and rules promulgated

11

pursuant to this title. These functions include, but are not restricted to, enforcement of the mental

12

health law and investigations into reportable incidents and complaints.

13

     SECTION 3. This act shall take effect upon passage.

========

LC001755

========

 

LC001755 - Page 10 of 11

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO BUSINESSES AND PROFESSIONS - CONFIDENTIALITY OF HEALTH

CARE COMMUNICATIONS AND INFORMATION ACT

***

1

     This act would authorize the department of behavioral healthcare, developmental

2

disabilities and hospitals to receive medical information in cases of abuse, neglect, mistreatment

3

or exploitation and access mental health records of elderly and disabled residents in a timely and

4

efficient manner without a release.

5

     This act would take effect upon passage.

========

LC001755

========

 

LC001755 - Page 11 of 11