Health Care Information

Clarifies the general rules regarding use and disclosure of
protected health care information for purposes other than the
health research project for which the information was obtained;
establishes temporary task force. (CD1)

THE SENATE                              S.B. NO.           S.D. 1
TWENTIETH LEGISLATURE, 2000                                H.D. 2
STATE OF HAWAII                                            C.D. 1

                   A  BILL  FOR  AN  ACT


 1      SECTION 1.  Section 323C-1, Hawaii Revised Statutes, is
 2 amended by amending the definition of "nonidentifiable health
 3 information" to read:
 4      ""Nonidentifiable health information" means any information
 5 that meets all of the following criteria:  would otherwise be
 6 protected health information except that the information in and
 7 of itself does not reveal the identity of the individual whose
 8 health or health care is the subject of the information and
 9 [there is no reasonable basis to believe that the information
10 could be used, either alone or with other information that is, or
11 should reasonably be, known to be available to recipients of the
12 information, to reveal the identity of that individual.] will not
13 be used in any way that would identify the subjects of the
14 information or would create protected health information."
15      SECTION 2.  Section 323C-21, Hawaii Revised Statutes, is
16 amended by amending subsection (b) to read as follows:
17      "(b)  For the purpose of treatment or qualified health care
18 operations, an entity may only use or disclose protected health
19 information [within the entity] if the use or disclosure is
20 properly noticed pursuant to sections 323C-13 and 323C-22.  For

Page 2                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        C.D. 1

 1 all other uses and disclosures, an entity may only use or
 2 disclose protected health information, if the use or disclosure
 3 is properly consented to pursuant to section 323C-23.  Disclosure
 4 to agents of an entity [described in subsection (a)] shall be
 5 considered as a disclosure within an entity."
 6      SECTION 3.  Section 323C-37, Hawaii Revised Statutes, is
 7 amended to read as follows:
 8      "[[]323C-37[]]  Health research.(a)  A health care
 9 provider, health plan, public health authority, employer,
10 insurer, or educational institution may disclose protected health
11 information to a health researcher if the following requirements
12 are met:
13      (1)  The research shall have been approved by an
14           institutional review board.  In evaluating a research
15           proposal, an institutional review board shall require
16           that the proposal demonstrate a clear purpose,
17           scientific integrity, and a realistic plan for
18           maintaining the confidentiality of protected health
19           information[;].  Research not otherwise subjected by
20           federal regulation to institutional review board review
21           shall be subject only to the review requirements of
22           this paragraph;
23      (2)  The health care provider, health plan, public health

Page 3                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        C.D. 1

 1           authority, employer, insurer, or educational
 2           institution shall only disclose protected health
 3           information which it has previously created or
 4           collected; and
 5      (3)  The holder of protected health information shall keep a
 6           record of all health researchers to whom protected
 7           health information has been made available.
 8      (b)  A health researcher who receives protected health
 9 information shall remove and destroy, at the earliest opportunity
10 consistent with the purposes of the project involved, any
11 information that would enable an individual to be identified.    
12      (c)  A health researcher who receives protected health
13 information shall not disclose or use the protected health
14 information or unique patient identifiers for any purposes not
15 reviewed by an institutional review board under this part or for
16 any purposes other than the health research project for which the
17 information was obtained, except that the health researcher may
18 disclose the information pursuant to section 323C-35(a)."
19      SECTION 4.  (a)  There is established the medical privacy
20 task force within the office of information practices for
21 administrative purposes.  The task force shall advise and assist
22 the office of information practices in analyzing health care
23 information issues for the purpose of drafting rules to implement

Page 4                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        C.D. 1

 1 the requirements of chapter 323C, Hawaii Revised Statutes.
 2      (b)  Members of the task force shall be chosen by the
 3 director of the office of information practices and the task
 4 force shall consist of at least one representative from each of
 5 the following groups:  health care consumer organizations,
 6 provider organizations, hospitals, individual and group medical
 7 practitioners, health insurance plans, health care data
 8 organizations, medical researchers, employers, pharmaceutical
 9 companies, department of health, and department of commerce and
10 consumer affairs.
11      (c)  The medical privacy task force shall submit a report of
12 findings and recommendations, including recommended legislation,
13 concerning health care issues that need statutory revision to
14 chapter 323C, Hawaii Revised Statutes, to the legislature no
15 later than twenty days prior to the convening of the regular
16 session of 2001.  The task force shall continue until terminated
17 by the director of the office of information practices.
18      SECTION 5.  Statutory material to be repealed is bracketed.
19 New statutory material is underscored.
20      SECTION 6.  This Act, upon its approval, shall take effect
21 on June 30, 2000.