REPORT TITLE:
Health Care Info Privacy


DESCRIPTION:
Protects privacy of health care information by stipulating
conditions under which information can be disclosed.  Provides
penalties.

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                        
HOUSE OF REPRESENTATIVES                H.B. NO.351        
TWENTIETH LEGISLATURE, 1999                                
STATE OF HAWAII                                            
                                                             
________________________________________________________________
________________________________________________________________


                   A  BILL  FOR  AN  ACT

RELATING TO PRIVACY OF HEALTH CARE INFORMATION.



BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 1      SECTION 1.  The legislature finds that individuals have a
 
 2 constitutional right to privacy with respect to personal health
 
 3 information and records, and with respect to information about
 
 4 medical care and health status, this right to privacy is at risk.
 
 5 Erosion of the right to privacy may reduce the willingness of
 
 6 patients to confide in physicians and other practitioners, thus
 
 7 jeopardizing the provision of quality health care.  Misuse of
 
 8 medical information may also be devastating to an individual's
 
 9 well being.  An individual's right to privacy means that an
 
10 individual's consent is needed to disclose his or her protected
 
11 health information, except in limited circumstances required by
 
12 the overriding public interest.  Any disclosure of protected
 
13 health information should be limited to only that information or
 
14 portion of the medical record necessary to fulfill the purpose of
 
15 the disclosure.
 
16      The legislature also finds that use of nonidentifiable
 
17 health information should be encouraged where appropriate and
 
18 that the continuing availability of timely and accurate personal
 
19 health data for the delivery of health care services throughout
 

 
Page 2                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1 the State is needed.  In addition, personal health information
 
 2 may be essential for selected types of medical research and
 
 3 public health uses of personal health information that are
 
 4 critical to both personal health as well as public health.  The
 
 5 privacy of an individual's health information must be assured
 
 6 without unduly jeopardizing clinical and epidemiological research
 
 7 undertaken to improve health care and health outcomes and to
 
 8 assure the quality and efficiency of health care.
 
 9      The purpose of this Act is to:
 
10      (1)  Implement the right of the people to privacy
 
11           established under section 6 of article I of the
 
12           Constitution of the State of Hawaii which provides that
 
13           the legislature shall take affirmative steps to
 
14           implement the right to privacy through legislation;
 
15      (2)  Protect individuals from the adverse effects of the
 
16           improper disclosure of protected health information in
 
17           medical records;
 
18      (3)  Establish strong and effective mechanisms to protect
 
19           against the unauthorized and inappropriate use of
 
20           protected health information that is created or
 
21           maintained as part of health care treatment, diagnosis,
 
22           enrollment, payment, plan administration, testing, or
 
23           research processes;
 

 
Page 3                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1      (4)  Promote the effective exchange and transfer of health
 
 2           information in a manner that will ensure the
 
 3           confidentiality of protected health information without
 
 4           impeding the delivery of high quality health care;
 
 5      (5)  Create incentives to turn personal health information
 
 6           into nonidentifiable health information for oversight,
 
 7           health research, public health, law enforcement,
 
 8           judicial, and administrative purposes, where
 
 9           appropriate; and
 
10      (6)  Establish strong and effective remedies for violations
 
11           of this Act.
 
12      SECTION 2.  The Hawaii Revised Statutes is amended by adding
 
13 a new chapter to be appropriately designated and to read as
 
14 follows:
 
15                             "CHAPTER
 
16                PRIVACY OF HEALTH CARE INFORMATION
 
17                    PART I.  GENERAL PROVISIONS
 
18         -1  Definitions.  As used in this chapter, except as
 
19 otherwise specifically provided:
 
20      "Accrediting body" means a committee, organization, or
 
21 institution that has been authorized by law or is recognized by a
 
22 health care regulating authority as an accrediting entity or any
 
23 other entity that has been similarly authorized or recognized by
 

 
Page 4                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1 law to perform specific accreditation, licensing, or
 
 2 credentialing activities.
 
 3      "Agent" means a person who represents and acts for another
 
 4 under a contract or relationship of agency, or whose function is
 
 5 to bring about, modify, affect, accept performance of, or
 
 6 terminate contractual obligations between the principal and a
 
 7 third person, including a contractor.
 
 8      "Designated individual's representative" means a person who
 
 9 is authorized by law (based on grounds other than the minority of
 
10 an individual), or by an instrument recognized under law, to act
 
11 as an agent, attorney, guardian, proxy, or other legal
 
12 representative of a protected individual.  The term includes a
 
13 health care power of attorney.
 
14      "Director" means the director of the office of information
 
15 practices.
 
16      "Disclose" means to release, transfer, provide access to,
 
17 share, or otherwise divulge protected health information to any
 
18 person other than the individual who is the subject of the
 
19 information.  The term includes the initial disclosure and any
 
20 subsequent redisclosures of protected health information.
 
21      "Employer" means any individual or type of organization,
 
22 including any partnership, association, trust, estate, joint
 
23 stock company, insurance company, or corporation, whether
 

 
Page 5                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1 domestic or foreign, a debtor in possession or receiver or
 
 2 trustee in bankruptcy, or a legal representative of a deceased
 
 3 person, who has one or more regular individuals in his or her
 
 4 employment.
 
 5      "Employment" means services performed for wages under any
 
 6 contract of hire, written or oral, expressed or implied, with an
 
 7 employer.
 
 8      "Health care" means:
 
 9      (1)  Preventive, diagnostic, therapeutic, rehabilitative,
 
10           palliative, or maintenance services:
 
11           (A)  With respect to the physical or mental condition
 
12                of an individual; or
 
13           (B)  Affecting the structure or function of the human
 
14                body or any part of the human body, including the
 
15                banking of blood, sperm, organs, or any other
 
16                tissue; or
 
17      (2)  Any sale or dispensing of a drug, device, equipment, or
 
18           other health care-related item to an individual, or for
 
19           the use of an individual pursuant to a prescription or
 
20           order by a health care provider.
 
21      "Health care data organization" means a for-profit or
 
22 nonprofit private corporation that engages primarily in the
 
23 business of collecting, analyzing, and disseminating identifiable
 

 
Page 6                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1 and nonidentifiable patient information.  A health care data
 
 2 organization is not a health care provider, an insurer, a health
 
 3 researcher, or a health oversight agency.
 
 4      "Health care provider" means a person who, with respect to
 
 5 any protected health information, receives, creates, uses,
 
 6 maintains, or discloses the protected health information while
 
 7 acting in whole or in part in the capacity of:
 
 8      (1)  A person who is licensed, certified, registered, or
 
 9           otherwise authorized by federal or state law to provide
 
10           an item or service that constitutes health care in the
 
11           ordinary course of business, or practice of a
 
12           profession;
 
13      (2)  A federal, state, or employer-sponsored program that
 
14           directly provides items or services that constitute
 
15           health care to beneficiaries; or
 
16      (3)  An officer, employee, or agent of a person described in
 
17           paragraph (1) or (2).
 
18      "Health oversight agency" means a person who, with respect
 
19 to any protected health information, receives, creates, uses,
 
20 maintains, or discloses the information while acting in whole or
 
21 in part in the capacity of:
 
22      (1)  A person who performs or oversees the performance of an
 
23           assessment, evaluation, determination, or
 

 
Page 7                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1           investigation, relating to the licensing,
 
 2           accreditation, or credentialing of health care
 
 3           providers; or
 
 4      (2)  A person who:
 
 5           (A)  Performs or oversees the performance of an audit,
 
 6                assessment, evaluation, determination, or
 
 7                investigation relating to the effectiveness of,
 
 8                compliance with, or applicability of, legal,
 
 9                fiscal, medical, or scientific standards or
 
10                aspects of performance related to the delivery of,
 
11                or payment for, health care; and
 
12           (B)  Is a public agency, acting on behalf of a public
 
13                agency, acting pursuant to a requirement of a
 
14                public agency, or carrying out activities under a
 
15                federal or state law governing the assessment,
 
16                evaluation, determination, investigation, or
 
17                prosecution for violations of paragraph (1).
 
18      "Health plan" means any health insurance plan, including any
 
19 hospital or medical service plan, dental or other health service
 
20 plan or health maintenance organization plan, provider-sponsored
 
21 organization, or other program providing or arranging for the
 
22 provision of health benefits, whether or not funded through the
 
23 purchase of insurance.
 

 
Page 8                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1      "Health researcher" means a person, or an officer, employee
 
 2 or independent contractor of a person, who receives protected
 
 3 health information as part of a systematic investigation,
 
 4 testing, or evaluation designed to develop or contribute to
 
 5 generalized scientific and clinical knowledge.
 
 6      "Institutional review board" means a research committee
 
 7 established and operating in accord with title 45 C.F.R. 46
 
 8 Sections 107, 108, 109, and 115.
 
 9      "Insurer" means all entities which have protected health
 
10 information and are regulated by chapter 431 or 432, except those
 
11 coming under the definition of "health plan".
 
12      "Law enforcement inquiry" means a lawful investigation
 
13 conducted by an appropriate government agency or official
 
14 inquiring into a violation of, or failure to comply with, any
 
15 criminal or civil statute or any regulation, rule, or order
 
16 issued pursuant to such a statute.
 
17      "Nonidentifiable health information" means any information
 
18 that would otherwise be protected health information except that
 
19 the information does not reveal the identity of the individual
 
20 whose health or health care is the subject of the information and
 
21 there is no reasonable basis to believe that the information
 
22 could be used, either alone or with other information that is, or
 
23 should reasonably be known, to be available to recipients of the
 

 
Page 9                                                     
                                     H.B. NO.           
                                                        
                                                        

 
 1 information, to reveal the identity of that individual.
 
 2      "Office of information practices" shall be as defined by
 
 3 chapter 92F.
 
 4      "Payment" means the activities undertaken by a health plan
 
 5 or provider, which are reasonably necessary to determine
 
 6 responsibility for coverage, services, and the actual payment for
 
 7 services, if any.
 
 8      "Person" means a government, governmental subdivision,
 
 9 agency or authority, corporation, company, association, firm,
 
10 partnership, insurer, estate, trust, joint venture, individual,
 
11 individual representative, and any other legal entity.
 
12      "Protected health information" means any information,
 
13 identifiable to an individual, including demographic information,
 
14 whether or not recorded in any form or medium that relates
 
15 directly or indirectly to the past, present, or future:
 
16      (1)  Physical or mental health or condition of a person,
 
17           including tissue and genetic information;
 
18      (2)  Provision of health care to an individual; or
 
19      (3)  Payment for the provision of health care to an
 
20           individual.
 
21      "Public health authority" means an agency of the State or a
 
22 county that is:
 
23      (1)  Primarily responsible for public health matters; and
 

 
Page 10                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1      (2)  Primarily engaged in activities such as disease and
 
 2           injury reporting, public health surveillance, and
 
 3           public health investigation or intervention.
 
 4      "Qualified health care operations" means:
 
 5      (1)  Only those services provided by or on behalf of a
 
 6           health plan or health care provider for the purpose of
 
 7           carrying out the management functions of a health care
 
 8           provider or health plan, or implementing the terms of a
 
 9           contract for health plan benefits as follows:
 
10           (A)  Conducting quality assurance activities or
 
11                outcomes assessments;
 
12           (B)  Reviewing the competence or qualifications of
 
13                health care professionals;
 
14           (C)  Performing accreditation, licensing, or
 
15                credentialing activities;
 
16           (D)  Analyzing health plan claims or health care
 
17                records data;
 
18           (E)  Evaluating provider clinical performance;
 
19           (F)  Carrying out utilization management; or
 
20           (G)  Conducting or arranging for auditing services in
 
21                accordance with statute, rule, or accreditation
 
22                requirements;
 
23      (2)  A qualified health care operation must:
 

 
Page 11                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           (A)  Be an operation which cannot be carried on with
 
 2                reasonable effectiveness and efficiency without
 
 3                identifiable patient information;
 
 4           (B)  Be limited to only that protected health
 
 5                information collected under the terms of the
 
 6                contract for health plan benefits and without
 
 7                which the operation cannot be carried on with
 
 8                reasonable effectiveness and efficiency;
 
 9           (C)  Be limited to the minimum amount of protected
 
10                health information, including the minimum number
 
11                of records and the minimum number of documents
 
12                within each patient's record, necessary to carry
 
13                on the operation with reasonable effectiveness and
 
14                efficiency; and
 
15           (D)  Limit the handling and examination of protected
 
16                health information, to those persons who are
 
17                reasonably well qualified, by training,
 
18                credentials, or experience, to conduct the phase
 
19                of the operation in which they are involved.
 
20      "Treatment" means the provision of health care by, or the
 
21 coordination of health care among, health care providers, or the
 
22 referral of a patient from one provider to another, or
 
23 coordination of health care or other services among health care
 

 
Page 12                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 providers and third parties authorized by the health plan or the
 
 2 plan member.
 
 3      "Unique patient identifier" means a number or alpha-numeric
 
 4 string assigned to an individual, which can be or is used to
 
 5 identify individuals' protected health information.
 
 6      "Writing" means writing in either a paper-based or computer-
 
 7 based form, including electronic signatures.
 
 8                   PART II.  INDIVIDUAL'S RIGHTS
 
 9         -11  Inspection and copying of protected health
 
10 information.(a)  At the request in writing of an individual and
 
11 except as provided in subsection (b), a health care provider,
 
12 health plan, employer, health care data organization, insurer, or
 
13 educational institution shall permit an individual who is the
 
14 subject of protected health information or the individual's
 
15 designee, to inspect and copy protected health information
 
16 concerning the individual, including records created under
 
17 section    -12, that the entity maintains.  The entity may set
 
18 forth appropriate procedures to be followed for the inspection or
 
19 copying and may require an individual to pay reasonable costs
 
20 associated with the inspection or copying.
 
21      (b)  Unless ordered by a court of competent jurisdiction, an
 
22 entity described in subsection (a) is not required to permit the
 
23 inspection or copying of protected health information if any of
 

 
Page 13                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 the following conditions are met:
 
 2      (1)  The entity determines that the disclosure of the
 
 3           information could reasonably be expected to endanger
 
 4           the life or physical safety of, or cause substantial
 
 5           mental harm to, the individual who is the subject of
 
 6           the record;
 
 7      (2)  The information identifies, or could reasonably lead to
 
 8           the identification of, a person who provided
 
 9           information under a promise of confidentiality
 
10           concerning the individual who is the subject of the
 
11           information unless the confidential source can be
 
12           protected by redaction or other similar means;
 
13      (3)  The information is:
 
14           (A)  Subject to attorney-client privilege or attorney
 
15                work product; or
 
16           (B)  Protected from discovery as provided in section
 
17                624-25.5;
 
18      (4)  The information was collected for or during a clinical
 
19           trial monitored by an institutional review board, the
 
20           trial is not complete, and the researcher reasonably
 
21           believes that access would harm the conduct of the
 
22           trial.
 
23      (c)  If an entity described in subsection (a) denies a
 

 
Page 14                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 request for inspection or copying pursuant to subsection (b), the
 
 2 entity shall inform the individual in writing of:
 
 3      (1)  The reasons for the denial of the request for
 
 4           inspection or copying;
 
 5      (2)  Any procedures for further review of the denial; and
 
 6      (3)  The individual's right to file with the entity a
 
 7           concise statement setting forth the request for
 
 8           inspection or copying.
 
 9      (d)  If an individual has filed a statement under subsection
 
10 (c)(3), the entity in any subsequent disclosure of the portion of
 
11 the information requested under subsection (a) shall include:
 
12      (1)  A copy of the individual's statement; and
 
13      (2)  A concise statement of the reasons for denying the
 
14           request for inspection or copying.
 
15      (e)  An entity described in subsection (a) shall permit the
 
16 inspection and copying under subsection (a) of any reasonably
 
17 segregable portion of a record after deletion of any portion that
 
18 is exempt under subsection (b).
 
19      (f)  An entity described in subsection (a) shall comply with
 
20 or deny, in accordance with subsection (c), a request for
 
21 inspection or copying of protected health information under this
 
22 section not later than thirty days after the date on which the
 
23 entity receives the request.
 

 
Page 15                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1      (g)  An agent of an entity described in subsection (a) shall
 
 2 not be required to provide for the inspection and copying of
 
 3 protected health information, except where:
 
 4      (1)  The protected health information is retained by the
 
 5           agent; and
 
 6      (2)  The agent has received in writing a request from the
 
 7           entity involved to fulfill the requirements of this
 
 8           section, at which time this information shall be
 
 9           provided to the requesting entity.  The requesting
 
10           entity shall comply with subsection (f) with respect to
 
11           any such information.
 
12      (h)  The entity shall afford at least one level of appeal by
 
13 parties not involved in the original decision.
 
14      (i)  This section shall not be construed to require that an
 
15 entity described in subsection (a) conduct a formal, informal, or
 
16 other hearing or proceeding concerning a request for inspection
 
17 or copying of protected health information.
 
18         -12  Additions to protected health information.(a)  A
 
19 health care provider is the owner of the medical records in the
 
20 health care provider's possession that were created by the health
 
21 care provider in treating a patient.  An individual or the
 
22 individual's authorized representative may request in writing
 
23 that a health care provider that generated certain health care
 

 
Page 16                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 information append additional information to the record in order
 
 2 to improve the accuracy or completeness of the information;
 
 3 provided that appending this information does not erase or
 
 4 obliterate any of the original information.  A health care
 
 5 provider shall do one of the following:
 
 6      (1)  Append the information as requested; or
 
 7      (2)  Notify the individual that the request has been denied,
 
 8           the reason for the denial, and that the individual may
 
 9           file a statement of reasonable length explaining the
 
10           correctness or relevance of existing information or as
 
11           to the addition of new information.  The statement or
 
12           copies shall be appended to the medical record and at
 
13           all times accompany that part of the information in
 
14           contention.
 
15         -13  Notice of confidentiality practices; forms of
 
16 notices.(a)  A health care provider, health care data
 
17 organization, health plan, health oversight agency, public health
 
18 authority, employer, insurer, health researcher, or educational
 
19 institution, as required by section    -22, shall post or provide
 
20 in writing, and in a clear and conspicuous manner in plain
 
21 language, the current notice of the entity's confidentiality
 
22 practices.  For the purpose of informing each individual of the
 
23 individual's rights under this chapter, the notice shall include:
 

 
Page 17                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1      (1)  A description of an individual's rights with respect to
 
 2           protected health information;
 
 3      (2)  The uses and disclosures of protected health
 
 4           information authorized under this chapter;
 
 5      (3)  The right of the individual to limit disclosure of
 
 6           protected health information by deciding not to utilize
 
 7           any health insurance or other third party payment as
 
 8           payment for the service, as set forth in section
 
 9              -21(c);
 
10      (4)  The procedures for giving consent to disclosures of
 
11           protected health information and for revoking consents
 
12           to disclose;
 
13      (5)  The description of procedures established by the entity
 
14           for the exercise of the individual's rights; and
 
15      (6)  The right to obtain a copy of the notice of the
 
16           confidentiality practices required under this chapter.
 
17      (b)  The actual procedures established by the entities for
 
18 the exercise of individual rights under this part shall be
 
19 available in writing upon request.
 
20         -14  Establishment of safeguards.(a)  A health care
 
21 provider, health plan, health oversight agency, public health
 
22 authority, employer, insurer, health researcher, law enforcement
 
23 official, or educational institution shall establish and maintain
 

 
Page 18                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 appropriate administrative, technical, and physical safeguards to
 
 2 protect the confidentiality, security, accuracy, and integrity of
 
 3 protected health information created, received, obtained,
 
 4 maintained, used, transmitted, or disposed of by the entity.
 
 5      (b)  The office of information practices, in consultation
 
 6 with the persons referenced in subsection (a), entities, and
 
 7 professional organizations, including organizations representing
 
 8 physicians, and after notice and opportunity for public comment,
 
 9 shall adopt rules under chapter 91 to implement subsection (a).
 
10           PART III.  RESTRICTIONS ON USE AND DISCLOSURE
 
11         -21  General rules regarding use and disclosure.(a)  A
 
12 health care provider, health care data organization, health plan,
 
13 health oversight agency, public health authority, employer,
 
14 insurer, health researcher, law enforcement official, or
 
15 educational institution may not use or disclose protected health
 
16 information except as authorized under this part and under part
 
17 IV.  Disclosure of health information in the form of
 
18 nonidentifiable health information shall not be construed as a
 
19 disclosure of protected health information.
 
20      (b)  For the purpose of treatment, payment, or qualified
 
21 health care operations, an entity described in subsection (a) may
 
22 only use or disclose protected health information within the
 
23 entity if the use or disclosure is properly noticed pursuant to
 

 
Page 19                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 sections    -13 and    -22.  For all other uses and disclosures,
 
 2 an entity may only use or disclose protected health information,
 
 3 if the use or disclosure is properly consented to pursuant to
 
 4 section    -23, and the use or disclosure is consistent with the
 
 5 limitations under subsection (d) on the scope of disclosure.
 
 6 Disclosure to agents of an entity described in subsection (a)
 
 7 shall be considered as a disclosure within an entity.
 
 8      (c)  If an individual does not want protected health
 
 9 information released pursuant to section (b), the individual
 
10 shall advise the provider that the relevant protected health
 
11 information shall not be disclosed pursuant to subsection (b) and
 
12 shall pay the health care provider directly for health care
 
13 services.  Protected health information related to health care
 
14 services paid for directly by the individual shall not be
 
15 disclosed without a consent to disclose pursuant to section
 
16    -23, by law, or by a court order.
 
17      (d)  An agent who receives protected health information from
 
18 an entity described in subsection (a) shall be subject to all
 
19 rules of disclosure and safeguard requirements under this part.
 
20      (e)  Every use and or disclosure of protected health
 
21 information by an entity under this part shall be limited to the
 
22 information necessary to accomplish the purpose for which the
 
23 information is disclosed.  Every use and or disclosure of
 

 
Page 20                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 protected health information shall be limited to the purpose for
 
 2 which it was collected.  Any other use without a valid consent to
 
 3 disclose shall be an unauthorized disclosure.
 
 4      (f)  Nothing in this part permitting the disclosure of
 
 5 protected health information shall be construed to require
 
 6 disclosure.
 
 7      (g)  Except as otherwise provided in this part, protected
 
 8 health information may not be disclosed unless the information is
 
 9 clearly identified as protected health information that is
 
10 subject to this chapter.
 
11      (h)  An entity described in subsection (a) may disclose
 
12 protected health information to an employee or agent of the
 
13 entity for purposes of creating nonidentifiable information, if
 
14 the entity prohibits the employee or agent of the entity from
 
15 using or disclosing the protected health information for purposes
 
16 other than the sole purpose of creating nonidentifiable
 
17 information as specified by the entity.
 
18      (i)  Any individual or entity who manipulates or uses a
 
19 nonidentifiable database in order to identify an individual shall
 
20 be deemed to have disclosed protected health information.  The
 
21 disclosure or transmission of a unique patient identifier shall
 
22 be deemed to be a disclosure of protected health information.
 
23         -22  Giving notice regarding disclosure of protected
 

 


 

Page 21                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 health information for treatment, payment, or qualified health
 
 2 care operations.(a)  The notice required by section    -13
 
 3 shall be:
 
 4      (1)  Given upon enrollment, annually, and when
 
 5           confidentiality practices are substantially amended by
 
 6           each health plan to each individual who is eligible to
 
 7           receive care under the health plan, or to the
 
 8           individual's parent or guardian if the individual is a
 
 9           minor or incompetent; or
 
10      (2)  Posted in a conspicuous place or provided by those
 
11           entities other than health plans identified in section
 
12              -21(a).
 
13      (b)  Except as provided for in this chapter, a notice
 
14 required by this section shall not be construed as a waiver of
 
15 any rights that the individual has under other federal or state
 
16 laws, the rules of evidence, or common law.
 
17      (c)  Notices under this section shall not authorize the
 
18 disclosure of protected health information by a person with the
 
19 intent to sell, transfer, or use protected health information for
 
20 commercial purpose or advantage.  For such disclosures, a consent
 
21 is required as set forth by section    -23(a).
 
22         -23  Consent to disclose protected health information
 
23 other than for treatment, payment, or qualified health care
 

 


 

Page 22                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 operations.(a)  A health care provider, health care data
 
 2 organization, health plan, health oversight, health researcher,
 
 3 public health authority, law enforcement official agency,
 
 4 employer, insurer, law enforcement official, or educational
 
 5 institution, pursuant to a consent to disclose, may disclose
 
 6 protected health information, for purposes other than those
 
 7 noticed under section    -22, which consent has been executed by
 
 8 the individual who is the subject of the information.  The
 
 9 consent to disclose must meet the requirements of subsection (d).
 
10      (b)  Sections    -31 to    -40 provide for exceptions to the
 
11 requirement for the consent to disclose.
 
12      (c)  An individual, in writing, may revoke or amend a
 
13 consent to disclose as described in subsection (d).  An entity
 
14 described in subsection (a) that discloses protected health
 
15 information pursuant to a consent to disclose that has been
 
16 revoked under this subsection shall not be subject to any
 
17 liability or penalty under this part if that entity had no actual
 
18 or constructive notice of the revocation.
 
19      (d)  To be valid, a consent to disclose protected health
 
20 information shall:
 
21      (1)  Identify the person or entity authorized to disclose
 
22           protected health information;
 
23      (2)  Identify the individual who is the subject of the
 

 
Page 23                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           protected health information;
 
 2      (3)  Describe the nature of and the time span of the
 
 3           protected health information to be disclosed;
 
 4      (4)  Identify the person to whom the information is to be
 
 5           disclosed;
 
 6      (5)  Describe the purpose of the disclosure;
 
 7      (6)  State that it is subject to revocation by the
 
 8           individual and indicate that the consent to disclose is
 
 9           valid until revocation by the individual;
 
10      (7)  Include the date at which the consent to disclose ends;
 
11           and
 
12      (8)  (A)  Be either:
 
13                (i)  In writing, dated, and signed by the
 
14                     individual; or
 
15               (ii)  In electronic form, dated, and authenticated
 
16                     by the individual using a unique identifier;
 
17                     and
 
18           (B)  Not have been revoked under subsection (b).
 
19      (e)  An individual may revoke in writing a consent to
 
20 disclose under this section at any time.  An individual's consent
 
21 to disclose is deemed to be revoked at the time of the
 
22 cancellation or nonrenewal of enrollment in the health plan.  An
 
23 individual may not maintain an action against a person for
 

 
Page 24                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 disclosure of protected health information which disclosure was
 
 2 made in good faith reliance on the individual's consent to
 
 3 disclose at the time disclosure was made.
 
 4      (f)  A recipient of protected health information pursuant to
 
 5 a consent to disclose under this section may use the information
 
 6 solely to carry out the purpose for which the information was
 
 7 authorized for release.
 
 8      (g)  Each person collecting or storing protected health
 
 9 information shall maintain a record for a period of seven years
 
10 for each consent to disclose of an individual and revocation
 
11 thereof.
 
12      (h)  Except as provided for in this chapter, the receipt of
 
13 the notice required by sections    -13 and    -22 by an
 
14 individual shall not be construed as a waiver of any rights that
 
15 the individual has under other federal or state laws, the rules
 
16 of evidence, or common law.
 
17      (i)  The office of information practices, after notice and
 
18 opportunity for public comment, shall develop and disseminate
 
19 model written consents to disclose of the type described in
 
20 subsection (a).
 
21              PART IV.  EXCEPTED USES AND DISCLOSURES
 
22         -31  Coroner or medical examiner.  When a coroner or
 
23 medical examiner or their duly appointed deputies seek protected
 

 
Page 25                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 health information for the purpose of inquiry into and
 
 2 determination of, the cause, manner, and circumstances of a
 
 3 death, any person shall provide the requested protected health
 
 4 information to the coroner or medical examiner or to the duly
 
 5 appointed deputies without undue delay.  If a coroner or medical
 
 6 examiner or their duly appointed deputies receives protected
 
 7 health information, this protected health information shall
 
 8 remain protected health information unless it is attached to or
 
 9 otherwise made a part of a coroner's or medical examiner's
 
10 official report.  Health information attached to or otherwise
 
11 made a part of a coroner's or medical examiner's official report
 
12 shall be exempt from this chapter except as provided for in this
 
13 subsection.
 
14         -32  Designated individual's representative, relative,
 
15 or friend, and directory information.(a)  A health care
 
16 provider, or a person who receives protected health information
 
17 under subsection (b), may disclose any protected health
 
18 information regarding an individual to a designated individual's
 
19 representative, relative, or friend if:
 
20      (1)  The individual who is the subject of the information:
 
21           (A)  Has been notified of the individual's right to
 
22                object to the disclosure and the individual has
 
23                not objected to the disclosure; or
 

 
Page 26                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           (B)  Is in a physical or mental condition such that
 
 2                the individual is not capable of objecting, and
 
 3                there are no prior indications that the
 
 4                individual would object;
 
 5      (2)  The information disclosed is for the purpose of
 
 6           providing health care to that individual; or
 
 7      (3)  The disclosure of the protected health information is
 
 8           consistent with good medical or professional practice.
 
 9      (b)  Except as provided in subsection (d), an entity
 
10 described in subsection (a) may disclose the information
 
11 described in subsection (c) to any other person if the individual
 
12 who is the subject of the information:
 
13      (1)  Has been notified of the individual's right to object
 
14           and the individual has not objected to the disclosure;
 
15           or
 
16      (2)  Is in a physical or mental condition such that the
 
17           individual is not capable of objecting;
 
18      (3)  The designated individual's representative, relative,
 
19           or friend has not objected; and
 
20      (4)  There are no prior indications that the individual
 
21           would object.
 
22      (c)  Information that may be disclosed in this section is
 
23 only that information that consists of any of the following
 

 
Page 27                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 items:
 
 2      (1)  The name of the individual who is the subject of the
 
 3           information;
 
 4      (2)  The general health status of the individual, described
 
 5           as critical, poor, fair, stable, or satisfactory or in
 
 6           terms denoting similar conditions; or
 
 7      (3)  The location of the individual on premises controlled
 
 8           by a provider.  This disclosure shall not be made if
 
 9           the information would reveal specific information about
 
10           the physical or mental condition of the individual,
 
11           unless the individual expressly authorizes the
 
12           disclosure.
 
13      (d)  A disclosure shall not be made under this section if
 
14 the health care provider involved has reason to believe that the
 
15 disclosure of this information could lead to the physical or
 
16 mental harm of the individual, unless the individual expressly
 
17 authorizes the disclosure.
 
18         -33  Identification of deceased individuals.  An entity
 
19 described in section    -32 may disclose protected health
 
20 information if the disclosure is necessary to assist in the
 
21 identification or safe handling of a deceased individual.
 
22         -34  Emergency circumstances.  Any person who creates or
 
23 receives protected health information under this chapter may use
 

 
Page 28                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 or disclose protected health information in emergency
 
 2 circumstances when the use or disclosure is necessary to protect
 
 3 the health or safety of the individual who is the subject of the
 
 4 information from serious, imminent harm.  No disclosure made in
 
 5 the good faith belief that the use or disclosure was necessary to
 
 6 protect the health or safety or an individual from serious,
 
 7 imminent harm shall be in violation of, or punishable under, this
 
 8 chapter.
 
 9         -35  Disclosures for health oversight.(a)  Any person
 
10 may disclose protected health information to a health oversight
 
11 agency for purposes of an oversight function authorized by law.
 
12      (b)  A public health authority or health researcher may
 
13 disclose protected health information to a health oversight
 
14 agency for purposes of an oversight function of the public health
 
15 authority or health researcher authorized by law.
 
16      (c)  For purposes of this section, the individual with
 
17 authority to authorize the health oversight function involved
 
18 shall provide to the persons described in subsection (a) or (b) a
 
19 statement that the protected health information is being sought
 
20 for a legally authorized oversight function.
 
21      (d)  Protected health information about an individual that
 
22 is disclosed under this section may not be used in, or disclosed
 
23 to any person for use in, an administrative, civil, or criminal
 

 
Page 29                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 action or investigation directed against the individual unless
 
 2 the action or investigation arises out of and is directly related
 
 3 to:
 
 4      (1)  The receipt of health care or payment for health care;
 
 5      (2)  An action involving a fraudulent claim related to
 
 6           health; or
 
 7      (3)  An action involving oversight of a public health
 
 8           authority or a health researcher.
 
 9         -36  Public health.(a)  Any person or entity may
 
10 disclose protected health information to a public health
 
11 authority or other person authorized by law for use in a legally
 
12 authorized:
 
13      (1)  Disease or injury report;
 
14      (2)  Public health surveillance;
 
15      (3)  Public health investigation or intervention; or
 
16      (4)  Health or disease registry.
 
17      (b)  No person or entity shall be liable for the disclosure
 
18 of protected health information, which is authorized by this
 
19 part, to a public health authority or other person authorized by
 
20 law.
 
21      (c)  Limitations or prohibitions on disclosure of health
 
22 information in this chapter shall not limit the requirements for
 
23 disclosure and confidentiality otherwise established by law.
 

 
Page 30                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1         -37  Health research.  A health care provider, health
 
 2 plan, public health authority, employer, insurer, or educational
 
 3 institution may disclose protected health information to a health
 
 4 researcher if the following requirements are met:
 
 5      (1)  The research has been approved by an institutional
 
 6           review board.  In evaluating a research proposal, an
 
 7           institutional review board shall require that the
 
 8           proposal demonstrate a clear purpose, scientific
 
 9           integrity, and a realistic plan for maintaining the
 
10           confidentiality of protected health information;
 
11      (2)  The research involves analysis of protected health
 
12           information previously created or collected by the
 
13           holder of protected health information;
 
14      (3)  The person who receives protected health information
 
15           removes or destroys, at the earliest opportunity
 
16           consistent with the purposes of the project involved,
 
17           information that would enable an individual to be
 
18           identified;
 
19      (4)  The person who receives protected health information
 
20           shall not disclose or use the protected health
 
21           information for any purposes other than the health
 
22           research project for which the information was
 
23           obtained, except that the health researcher may also
 

 
Page 31                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           disclose the information pursuant to sections    -34
 
 2           and    -35(b).
 
 3      (5)  The holder of protected health information keeps a
 
 4           record of all health researchers to whom protected
 
 5           health information has been made available; and
 
 6      (6)  Any disclosure of the information to other persons is
 
 7           not made.
 
 8         -38  Disclosure in civil, judicial, and administrative
 
 9 procedures.(a)  Any person may disclose protected health
 
10 information pursuant to a discovery request or subpoena in a
 
11 civil action brought in a state court or a request or subpoena
 
12 related to a state administrative proceeding, but only if the
 
13 disclosure is made pursuant to a court order as provided for in
 
14 subsection (b).
 
15      (b)  Any subpoena or discovery request for protected health
 
16 information is valid only if accompanied by a court order from a
 
17 competent jurisdiction.  In considering a request for a court
 
18 order regarding the disclosure of protected health information
 
19 under subsection (a), the court shall issue an order if the court
 
20 determines that without the disclosure of the information, the
 
21 person requesting the order would be impaired from establishing a
 
22 claim or defense.  An order issued under this subsection shall:
 
23      (1)  Provide that the protected health information involved
 

 
Page 32                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           is subject to court protection;
 
 2      (2)  Specify to whom the information may be disclosed;
 
 3      (3)  Specify that the information may not otherwise be
 
 4           disclosed or used; and
 
 5      (4)  Meet any other requirements that the court determines
 
 6           are needed to protect the confidentiality of the
 
 7           information.
 
 8      (c)  This section shall not apply in a case in which the
 
 9 protected health information sought under the discovery request
 
10 or subpoena is:
 
11      (1)  Nonidentifiable health information;
 
12      (2)  Related to a party to the litigation whose medical
 
13           condition is at issue; or
 
14      (3)  Could be disclosed under any of sections    -22,
 
15              -23,    -31 through    -37,    -39, and    -40.
 
16      (d)  This section shall not be construed to supersede any
 
17 grounds that may apply under federal or state law for objecting
 
18 to turning over the protected health information.
 
19      (e)  Any provider shall be immune to any action, civil or
 
20 criminal, related to the release of any protected health
 
21 information pursuant to this section.
 
22         -39  Disclosure for law enforcement purposes.(a)
 
23 Except as to disclosures to a health oversight agency, which are
 

 
Page 33                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 governed by section    -35, a health care provider, health plan,
 
 2 health oversight agency, employer, insurer, educational
 
 3 institution, or person who receives protected health information
 
 4 pursuant to sections    -23 and    -31 through    -37, may
 
 5 disclose protected health information under this section, if the
 
 6 disclosure is pursuant to:
 
 7      (1)  A subpoena issued under the authority of a grand jury;
 
 8           or
 
 9      (2)  An administrative subpoena or summons or judicial
 
10           subpoena or warrant.
 
11      (b)  A subpoena or summons for a disclosure under subsection
 
12 (a)(1) or (2) shall only be issued if the law enforcement agency
 
13 involved shows that there is probable cause to believe that the
 
14 information is relevant to a legitimate law enforcement inquiry.
 
15      (c)  When the matter or need for which protected health
 
16 information was disclosed to a law enforcement agency or grand
 
17 jury under subsection (a) has concluded, including any derivative
 
18 matters arising from the matter or need, the law enforcement
 
19 agency or grand jury shall either destroy the protected health
 
20 information, or return all of the protected health information to
 
21 the person from whom it was obtained.
 
22      (d)  To the extent practicable, and consistent with the
 
23 requirements of due process, a law enforcement agency shall
 

 
Page 34                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 redact personally identifying information from protected health
 
 2 information prior to the public disclosure of the protected
 
 3 information in a judicial or administrative proceeding.
 
 4      (e)  Protected health information obtained by a law
 
 5 enforcement agency pursuant to this section may only be used for
 
 6 purposes of a legitimate law enforcement activity.
 
 7      (f)  If protected health information is obtained without
 
 8 meeting the requirements of subsection (a)(1) or (2), any
 
 9 information that is unlawfully obtained shall be excluded from
 
10 court proceedings unless the defendant requests otherwise.
 
11      (g)  Any health care provider shall have immunity from any
 
12 action, civil or criminal, related to the disclosure of any
 
13 protected health information pursuant to this section.
 
14         -40  Payment card and electronic payment transaction.
 
15 (a)  If an individual pays for health care by presenting a debit,
 
16 credit, or other payment card or account number, or by any other
 
17 electronic payment means, the entity receiving payment may
 
18 disclose to a person described in subsection (b) only such
 
19 protected health information about the individual as is necessary
 
20 for the processing of the payment transaction or the billing or
 
21 collection of amounts charged to, debited from, or otherwise paid
 
22 by, the individual using the card, number, or other electronic
 
23 means.
 

 
Page 35                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1      (b)  A person who is a debit, credit, or other payment card
 
 2 issuer, or is otherwise directly involved in the processing of
 
 3 payment transactions involving such cards or other electronic
 
 4 payment transactions, or is otherwise directly involved in the
 
 5 billing or collection of amounts paid through these means, may
 
 6 use or disclose protected health information about an individual
 
 7 that has been disclosed in accordance with subsection (a) only
 
 8 when necessary for:
 
 9      (1)  The settlement, billing, or collection of amounts
 
10           charged to, debited from, or otherwise paid by the
 
11           individual using a debit, credit, or other payment card
 
12           or account number, or by other electronic payment
 
13           means;
 
14      (2)  The transfer of receivables, accounts, or interest
 
15           therein;
 
16      (3)  The internal audit of the debit, credit, or other
 
17           payment card account information;
 
18      (4)  Compliance with federal, state, or county law; or
 
19      (5)  Compliance with a properly authorized civil, criminal,
 
20           or regulatory investigation by federal, state, or
 
21           county authorities as governed by the requirements of
 
22           this section.
 
23         -41  Standards for electronic disclosures.  The office
 

 
Page 36                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 of information practices shall adopt rules to establish standards
 
 2 for disclosing, authorizing, and authenticating, protected health
 
 3 information in electronic form consistent with this part.
 
 4         -42  Rights of minors.(a)  In the case of an
 
 5 individual:
 
 6      (1)  Who is eighteen years of age or older, all rights of
 
 7           the individual under this chapter shall be exercised by
 
 8           the individual; or
 
 9      (2)  Who, acting alone, can obtain a type of health care
 
10           without violating any applicable federal or state law,
 
11           and who has sought this care, the individual shall
 
12           exercise all rights of the individual under this
 
13           chapter with respect to protected health information
 
14           relating to the health care.
 
15      (b)  Except as provided in subsection (a)(2), in the case of
 
16 an individual who is:
 
17      (1)  Under fourteen years of age, all of the individual's
 
18           rights under this chapter shall be exercised only
 
19           through the parent or legal guardian; or
 
20      (2)  At least fourteen but under eighteen years of age, the
 
21           rights of inspection and amendment, and the right to
 
22           authorize use and disclosure of protected health
 
23           information of the individual shall be exercised by the
 

 
Page 37                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           individual, or by the parent or legal guardian of the
 
 2           individual.
 
 3         -43  Deceased individuals.  This chapter shall continue
 
 4 to apply to protected health information concerning a deceased
 
 5 individual for a period of two years following the death of that
 
 6 individual.  A person who is authorized by law or by an
 
 7 instrument recognized under law, to act as an executor of the
 
 8 estate of a deceased individual, or otherwise to exercise the
 
 9 rights of the deceased individual, to the extent so authorized,
 
10 may exercise and discharge the rights of the deceased individual
 
11 under this chapter for a period of two years following the death
 
12 of that individual.
 
13                        PART V.  SANCTIONS
 
14         -51  Wrongful disclosure of protected health
 
15 information.(a)  The penalties described in subsection (b)
 
16 shall apply to a person that knowingly and intentionally:
 
17      (1)  Obtains protected health information relating to an
 
18           individual in violation of this chapter; or
 
19      (2)  Discloses protected health information to another
 
20           person in violation of this chapter.
 
21      (b)  A person described in subsection (a) shall:
 
22      (1)  Be guilty of a class C felony;
 
23      (2)  If the offense is committed with the intent to sell,
 

 
Page 38                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           transfer, or use protected health information for
 
 2           commercial advantage, personal gain, or malicious harm,
 
 3           be guilty of a class B felony.
 
 4         -52  Civil actions by individuals.(a)  Any individual
 
 5 whose rights under this chapter have been knowingly, or
 
 6 negligently violated may bring a civil action to recover:
 
 7      (1)  Any preliminary and equitable relief as the court
 
 8           determines to be appropriate; and
 
 9      (2)  The greater of compensatory damages or liquidated
 
10           damages of $5,000 for each violation.
 
11      (b)  In any action brought under this section in which the
 
12 individual has prevailed because of a knowing violation of a
 
13 provision of this chapter, the court, in addition to any relief
 
14 awarded under subsection (a), may award any punitive damages that
 
15 may be appropriate.
 
16      (c)  In the case of a civil action brought under subsection
 
17 (a) in which the individual has substantially prevailed, the
 
18 court may assess against the respondent a reasonable attorney's
 
19 fee and other litigation costs and expenses (including expert
 
20 fees) reasonably incurred.
 
21      (d)  No action may be commenced under this section more than
 
22 two years after the date on which the violation was or should
 
23 reasonably have been discovered.
 

 
Page 39                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1         -53  Prevention and deterrence.  To promote the
 
 2 prevention and deterrence of acts and or omissions which violate
 
 3 laws designed to safeguard the protected health information in a
 
 4 manner consistent with this chapter, the director of the office
 
 5 of information practices, with any other appropriate individual,
 
 6 organization, or agency, may provide advice, training, technical
 
 7 assistance, and guidance regarding ways to prevent improper
 
 8 disclosure of protected health information.
 
 9         -54  Cease and desist orders; civil penalty.(a)
 
10 Whenever the director has reason to believe that any person has
 
11 materially and substantially violated any provision of this
 
12 chapter, and that a proceeding by the director in respect thereto
 
13 would be in the interest of the public, the director shall issue
 
14 and serve upon the person:
 
15      (1)  A statement of the charges in that respect; and
 
16      (2)  A notice of a hearing, to be held at a time and place
 
17           fixed in the notice, which shall not be less than
 
18           fifteen days after the date of service.
 
19      (b)  At the time and place fixed for the hearing, the person
 
20 shall have an opportunity to be heard and to show cause why an
 
21 order should not be made by the director requiring the person to
 
22 cease and desist from the acts, methods, or practices which are
 
23 the subject of the statement or otherwise to comply with the
 

 
Page 40                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 requirements of this chapter.
 
 2      (c)  The hearing shall be deemed a contested case hearing
 
 3 pursuant to chapter 91.
 
 4      (d)  All remedies, penalties, and proceedings set forth in
 
 5 this section are to be invoked solely and exclusively by the
 
 6 director.
 
 7      (e)  If, after the hearing, the director determines that the
 
 8 person charged has violated any provision of this chapter, the
 
 9 director shall reduce the findings to writing and shall issue and
 
10 cause to be served upon the person charged with the violation a
 
11 copy of the findings and an order requiring the person to cease
 
12 and desist from violating this chapter or otherwise to comply
 
13 with the requirements of this chapter.  The director, at the
 
14 director's discretion, may also order any one or more of the
 
15 following:
 
16      (1)  In a case in which the violation relates to part II,
 
17           payment of a civil penalty of not more than $500 for
 
18           each and every act or violation but not to exceed
 
19           $5,000 in the aggregate for multiple violations;
 
20      (2)  In a case in which the violation relates to part III or
 
21           part IV, payment of a civil penalty of not more than
 
22           $10,000 for each and every act or violation but not to
 
23           exceed $50,000 in the aggregate for multiple
 

 
Page 41                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           violations; and
 
 2      (3)  In a case in which the director finds that violations
 
 3           have occurred with such frequency as to constitute a
 
 4           general business practice, a civil penalty of not more
 
 5           than $100,000.
 
 6      (f)  Any person who violates a cease and desist order or a
 
 7 compliance order of the director under this section may be
 
 8 subject at the discretion of the director, after notice and
 
 9 hearing and upon order of the director, to a civil penalty of not
 
10 more than $10,000 for each and every act in violation of the
 
11 cease and desist order.
 
12      (g)  No order of the director pursuant to this section or
 
13 order of court to enforce it shall in any way relieve or absolve
 
14 any person affected by the order from any other liability,
 
15 penalty, or forfeiture required by law.
 
16      (h)  No fact found or decision made in a hearing held under
 
17 this section shall be binding on any party in any subsequent
 
18 civil action to recover damages based upon the same or similar
 
19 facts.
 
20      (i)  Any person aggrieved by an order of the director under
 
21 this section may obtain judicial review of the order in the
 
22 manner provided for by chapter 91.
 
23      (j)  The powers vested in the director by this article shall
 

 
Page 42                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 be additional to any other power to enforce penalties or civil
 
 2 penalties authorized by law with respect to the methods, acts,
 
 3 and practices which violate this chapter.
 
 4         -55  Injunctive relief.(a)  Whenever the director has
 
 5 reason to believe that any person has engaged, is engaging, or is
 
 6 about to engage in any activity which makes the person subject to
 
 7 a civil monetary penalty under section    -56, the director may
 
 8 bring an action in an appropriate circuit court to enjoin the
 
 9 activity, or to enjoin the person from concealing, removing,
 
10 encumbering, or disposing of assets which may be required in
 
11 order to pay a civil monetary penalty if any such penalty were to
 
12 be imposed or to seek other appropriate relief.
 
13      (b)  A principal is liable for penalties under section
 
14    -54 for the actions of the principal's agent acting within the
 
15 scope of the agency.
 
16         -56  Report on use of existing enforcement mechanisms.
 
17 In addition to the criminal and civil penalties that may be
 
18 applied under this chapter, the director shall prepare and submit
 
19 to the legislature a report regarding the use of existing
 
20 licensure, certification, and regulatory mechanisms for the
 
21 imposition of sanctions or penalties for the wrongful disclosure
 
22 of protected health information.
 
23         -57  No liability for permissible disclosures.  A health
 

 
Page 43                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 care provider, health care data organization, health plan, health
 
 2 oversight agency, health researcher, public health authority, law
 
 3 enforcement official, employer, insurer, or educational
 
 4 institution who makes a disclosure of protected health
 
 5 information about an individual that is permitted by this chapter
 
 6 shall not be liable to the individual for the disclosure under
 
 7 common law.
 
 8         -58  Relationship to other laws.(a)  Nothing in this
 
 9 chapter shall be construed to preempt or modify any provisions of
 
10 state law concerning a privilege of a witness or person in a
 
11 court of the State.  Receipt of notice pursuant to section    -22
 
12 or consent to disclose pursuant to section    -23 shall not be
 
13 construed as a waiver of these privileges.
 
14      (b)  Nothing in this chapter shall be construed to preempt,
 
15 supersede, or modify the operation of any state law that:
 
16      (1)  Provides for the reporting of vital statistics such as
 
17           birth or death information;
 
18      (2)  Requires the reporting of abuse or neglect information
 
19           about any individual;
 
20      (3)  Relates to public or mental health and that prevents or
 
21           otherwise restricts disclosure of information otherwise
 
22           permissible under this chapter; or
 
23      (4)  Governs a minor's right to access protected health
 

 
Page 44                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           information or health care services."
 
 2      SECTION 3.  Section 622-52, Hawaii Revised Statutes, is
 
 3 amended to read as follows:
 
 4      "622-52  Subpoena duces tecum for medical records,
 
 5 compliance.(a)  Whenever a subpoena duces tecum accompanied by
 
 6 a court order obtained as described in subsection (d) is served
 
 7 upon the custodian of medical records or other qualified witness
 
 8 from a health care provider, health plan, public health
 
 9 authority, employer, insurer, law enforcement official,
 
10 educational institution, or medical facility, in [an] a civil
 
11 action or other proceeding [on a claim for personal injuries] in
 
12 which the custodian or the custodian's employer is neither a
 
13 party to the action or proceeding nor is it alleged that the
 
14 claim arose at the medical facility, and such subpoena requires
 
15 the production in court, or before an officer, board, commission,
 
16 or tribunal, of all or any part of the medical records of a
 
17 patient who is or has been cared for or treated at the medical
 
18 facility, it shall be sufficient compliance therewith if the
 
19 custodian or other qualified witness within five days after
 
20 receipt of such subpoena, delivers by registered or certified
 
21 mail or by messenger a true and correct copy (which may be by any
 
22 method described in rule 1001(4), Hawaii rules of evidence) of
 
23 all the medical records described in such subpoena to the clerk
 

 
Page 45                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 of the court or the clerk's deputy authorized to issue it,
 
 2 together with the affidavit described in section 622-53.
 
 3      (b)  The copy of the medical records shall be separately
 
 4 enclosed in an inner envelope or wrapper, sealed, with the title
 
 5 and number of the action, name of the custodian or other
 
 6 qualified witness, and date of the subpoena clearly inscribed
 
 7 thereon; the sealed envelope or wrapper shall then be enclosed in
 
 8 an outer envelope or wrapper, sealed, and directed as follows:
 
 9      (1)  If the subpoena directs attendance in court, to the
 
10           clerk of such court or the clerk's deputy authorized to
 
11           issue it, at the courthouse.
 
12      (2)  In other cases, to the officer, board, commission, or
 
13           tribunal conducting the hearing, at the place
 
14           designated in the subpoena.
 
15      (c)  The copy of the medical records shall remain sealed and
 
16 shall be opened only at the time of trial, or other hearing, upon
 
17 the direction of the judge, officer, board, commission, or
 
18 tribunal conducting the proceeding, in the presence of all
 
19 parties who have appeared in person or by counsel at such trial,
 
20 or hearing, unless the parties or counsel in the proceeding
 
21 otherwise agree, or unless the sealed envelope or wrapper is
 
22 returned to the custodian or other qualified witness who is to
 
23 appear personally.  Copies of medical records which are not
 

 
Page 46                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1 introduced in evidence or required as part of the record shall be
 
 2 returned by registered or certified mail or by messenger to the
 
 3 person or entity from whom received.  If the copies of the
 
 4 medical records are introduced in evidence or are required as
 
 5 part of the record, they shall be returned by registered or
 
 6 certified mail or messenger to the person or entity from whom
 
 7 received as soon as their use is no longer needed, after the
 
 8 trial, or other hearing.
 
 9      (d)  Any subpoena or discovery request for protected health
 
10 information is valid only if accompanied by a court order from a
 
11 competent jurisdiction.
 
12      (1)  In considering a request for a court order regarding
 
13           the disclosure of protected health information under
 
14           subsection (a), the court shall issue an order if the
 
15           court determines that without the disclosure of the
 
16           information, the person requesting the order would be
 
17           impaired from establishing a claim or defense;
 
18      (2)  An order issued under paragraph (1) shall:
 
19           (A)  Provide that the protected health information
 
20                involved is subject to court protection;
 
21           (B)  Specify to whom the information may be disclosed;
 
22           (C)  Specify that the information may not otherwise be
 
23                disclosed or used; and
 

 
Page 47                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1           (D)  Meet any other requirements that the court
 
 2                determines are needed to protect the
 
 3                confidentiality of the information.
 
 4      (e)  This section shall not apply in a case in which the
 
 5 protected health information sought under discovery request or
 
 6 subpoena:
 
 7      (1)  Is nonidentifiable health information;
 
 8      (2)  Is related to a party to the litigation whose medical
 
 9           condition is at issue; or
 
10      (3)  Could be disclosed under any of sections    -22,
 
11              -23,    -31 through    -37,    -39, and    -40.
 
12      (f)  This section shall not be construed to supersede any
 
13 grounds that may apply under federal or state law for objecting
 
14 to turning over the protected health information.
 
15      (g)  Any provider shall be immune to any action, civil or
 
16 criminal, related to the release of any protected health
 
17 information pursuant to this section."
 
18      SECTION 4.  If any provision of this Act, or the application
 
19 thereof to any person or circumstance is held invalid, the
 
20 invalidity does not affect other provisions or applications of
 
21 this Act which can be given affect without the invalid provision
 
22 or application, and to this end the provisions of this Act are
 
23 severable.
 

 
Page 48                                                    
                                     H.B. NO.           
                                                        
                                                        

 
 1      SECTION 5.  Statutory material to be repealed is bracketed.
 
 2 New statutory material is underscored.
 
 3      SECTION 6.  This Act shall take effect on July 1, 2000,
 
 4 except that all sections in this Act requiring the development
 
 5 and adoption of rules shall be effective upon its approval. 
 
 6 
 
 7                           INTRODUCED BY:  _______________________