Introduced By: Senators McDonald and Oster
Date Introduced : February 10, 1998
It is enacted by the General Assembly as follows:
SECTION 1. Section 5-37.3-4 of the General Laws in Chapter 5-37.3 entitled "Confidentiality of Health Care Communications and Information Act" is hereby amended to read as follows:
5-37.3-4. Limitations on and permitted disclosures. -- (a) Except as provided in subsection (b) or as otherwise specifically provided by the law, a patient's confidential health care information shall not be released or transferred without the written consent of such patient or his or her authorized representative, on a consent form meeting the requirements of subsection (d), a copy of any notice used pursuant to subsection (d), and of any signed consent shall upon request, be provided to the patient prior to his or her signing a consent form.
Provided however, that any and all managed care entities and managed care contractors writing policies in the state are hereby prohibited from providing any information related to enrollees which is personal in nature and could reasonably lead to identification of an individual and is not essential for the compilation of statistical data related to enrollees, to any international, national, regional or local medical information data base. Provided further however, that this provision would not restrict or otherwise prohibit the transfer of information to the department of health to carry out its statutory duties and responsibilities.
(1) Any person who violates the provisions of this section may be liable for actual and punitive damages.
(2) The court may award a reasonable attorney's fee at its discretion to the prevailing party in any civil action under this section.
(3) Any person who knowingly and intentionally violates the provisions of this section shall upon conviction, be fined not more than five thousand ($5,000) dollars for each violation or imprisoned not more than six (6) months for each violation, or both.
(4) Any contract or agreement which purports to waive the provisions of this section is hereby declared null and void as against public policy.
(b) No consent for release or transfer of confidential health care information is required in the following situations:
(1) To a physician, dentist, or other medical personnel who believes in good faith that the information is necessary for diagnosis or treatment of that individual in a medical or dental emergency; or
(2) To medical and dental peer review board, or the board of medical licensure and discipline; or board of examiners in dentistry; or
(3) To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies, provided that personnel shall not identify, directly or indirectly, any individual patient in any report of that research, audit, or evaluation, or otherwise disclose patient identities in any manner; or
(4) By a health care provider to appropriate law enforcement personnel, or to a person if the health care provider believes that person or his or her family to be in danger from a patient, or to appropriate law enforcement personnel if the patient has or is attempting to obtain narcotic drugs from the health care provider illegally, or to appropriate law enforcement personnel or appropriate child protective agencies if the patient is a minor child who the health care provider believes, after providing health care services to such patient, to have been physically or psychologically abused or to law enforcement personnel in the case of a gunshot wound reportable under section 11-47-48; or
(5) Between or among qualified personnel and health care providers within the health care system for purposes of coordination of health care services given to the patient and for purposes of education and training within the same health care facility; or
(6) To third party health insurers for the purpose of adjudicating health insurance claims including to utilization review agents as provided by section 23-17.12-9(11); or
(7) To a malpractice insurance carrier or lawyer if the health care provider has reason to anticipate a medical liability action; or
(8) To {DEL a court or DEL} {ADD the health care provider's
own ADD} lawyer or medical liability insurance carrier if {DEL a DEL}
{ADD the ADD} patient {ADD whose information is at issue ADD} brings
a medical liability action against a health care provider {DEL ;
or DEL} {ADD . ADD}
{ADD Disclosure by a health care provider of a patient's health care information which is relevant to a civil action brought by the patient against any person or persons other than that health care provider may occur only under the discovery methods provided by the applicable rules of civil procedure (federal or state). Such disclosure shall not be through ex parte contacts; and not through informal ex parte contacts with the provider by persons other than the patient or his legal representation. Nothing herein shall limit the right of a patient or his attorney to consult with that patient's own physician and to obtain that patient's own health care information. ADD}
(9) To public health authorities in order to carry out their functions as described in this title and titles 21 and 23, and rules promulgated thereunder. These functions include, but are not restricted to, investigations into the causes of disease, the control of public health hazards, enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of health professionals and facilities, review of health care such as that as required by the federal government and other governmental agencies; or
(10) To the state medical examiner in the event of a fatality that comes under his or her jurisdiction; or
(11) In relation to information that is directly related to current claim for workers' compensation benefits or to any proceeding before the workers' compensation commission or before any court proceeding relating to workers' compensation; or
(12) To the attorneys for a health care provider whenever that provider considers that release of information to be necessary in order to receive adequate legal representation; or
(13) By a health care provider to appropriate school authorities of disease, health screening and/or immunization information required by the school; or when a school age child transfers from one school or school district to another school or school district; or
(14) To a law enforcement authority to protect the legal interest of an insurance institution agent or insurance-support organization in preventing and prosecuting the perpetration of fraud upon them; or
(15) To a grand jury or to a court of competent jurisdiction pursuant to a subpoena or subpoena duces tecum when that information is required for the investigation or prosecution of criminal wrongdoing by a health care provider relating to his or her or its provisions of health care services and that information is unavailable from any other source; provided however, that any information so obtained shall not be admissible in any criminal proceeding against the patient to whom that information pertains; or
(16) To the state board of elections pursuant to a subpoena or subpoena duces tecum when that information is required to determine the eligibility of a person to vote by mail ballot and/or the legitimacy of a certification by a physician attesting to a voter's illness or disability; or
(17) To certify, pursuant to chapter 20 of title 17, the nature and permanency of a person's illness or disability, the date when that person was last examined and that it would be an undue hardship for the person to vote at the polls so that the person may obtain a mail ballot; or
(18) To the central cancer registry; or
(19) To the medicaid fraud control unit of the attorney general's office for the investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to his or her or its provision of health care services to then medicaid eligible recipients or patients, residents or former patients or residents of long term residential care facilities. Provided, however, that any information so obtained shall not be admissible in any criminal proceeding against the patient to whom said information pertains;
(20) To the state department of children, youth, and families pertaining to the disclosure of health care records of children in the custody of the department.
(21) To the foster parent or parents pertaining to the disclosure of health care records of children in the custody of the foster parent or parents, provided that the foster parent or parents receive appropriate training and have ongoing availability of supervisory assistance in the use of sensitive information that may be the source of distress to such children.
(22) A hospital may release the fact of a patient's admission and a general description of a patient's condition to persons representing themselves as relatives or friends of the patient or as a representative of the news media. The access to confidential health care information to persons in accredited educational programs under appropriate provider supervision shall not be deemed subject to release or transfer of that information under subsection (a). The release or transfer of confidential health care information under any of the above exceptions shall not be the basis for any legal liability, civil or criminal, nor considered a violation of this chapter.
(c) Third parties receiving and retaining a patient's confidential health care information must establish at least the following security procedures:
(1) Limit authorized access to personally identifiable confidential health care information to persons having a "need to know" that information; additional employees or agents may have access to that information which does not contain information from which an individual can be identified;
(2) Identify an individual or individuals who have responsibility for maintaining security procedures for confidential health care information;
(3) Provide a written statement to each employee or agent as to the necessity of maintaining the security and confidentiality of confidential health care information, and of the penalties provided for in this chapter for the unauthorized release, use, or disclosure of such information. The receipt of that statement shall be acknowledged by the employee or agent, who shall sign and return the statement to his or her employer or principal, who shall retain the signed original. The employee or agent shall be furnished with a copy of the signed statement;
(4) Take no disciplinary or punitive action against any employee or agent solely for bringing evidence of violation of this chapter to the attention of any person.
(d) Consent forms for the release or transfer of confidential health care information shall contain, or in the course of an application or claim for insurance be accompanied by a notice containing, the following information in a clear and conspicuous manner:
(1) A statement of the need for and proposed uses of that information;
(2) A statement that all information is to be released or clearly indicating the extent of the information to be released; and
(3) A statement that the consent for release or transfer of information may be withdrawn at any future time and is subject to revocation, except where an authorization is executed in connection with an application for a life or health insurance policy in which case the authorization shall expire two (2) years from the issue date of the insurance policy and when signed in connection with a claim for benefits under any insurance policy the authorization shall be valid during the pendency of that claim. Any revocation shall be transmitted in writing.
(e) Except as otherwise specifically provided by law an individual's confidential health care information shall not be given, sold, transferred, or in any way relayed to any other person not specified in the consent form or notice meeting the requirements of subsection (d) without first obtaining the individual's additional written consent on a form stating the need for the proposed new use of such information or the need for its transfer to another person.
(f) Nothing contained in this chapter shall be construed to limit the permitted disclosure of confidential health care information and communications set forth in subsection (b) of this section.
SECTION 2. This act shall take effect upon passage.
