HB 580-FN – AS AMENDED BY THE HOUSE
24Mar2009… 0867h
2009 SESSION
01/10
HOUSE BILL 580-FN
AN ACT relative to health information and patient rights.
SPONSORS: Rep. Bridgham, Carr 2; Rep. Rosenwald, Hills 22; Rep. Kurk, Hills 7; Rep. Batula, Hills 19
COMMITTEE: Health, Human Services and Elderly Affairs
This bill establishes procedures for access to health care information that is in the possession of health care providers. The bill specifies the rights of the individual who is the subject of the health care information.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
24Mar2009… 0867h
09-0357
01/10
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand Nine
AN ACT relative to health information and patient rights.
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 Statement of Purpose and Intent. The general court:
I. Believes that informational privacy is a core value of New Hampshire citizens.
II. Recognizes that the confidentiality of personal health information has been an ethical standard of health care providers since the time of Hippocrates.
III. Recognizes that a critical element in an individual’s relationship with a health care provider is trust in the health care provider’s confidentiality ethics, as well as established confidentiality rules. This trust encourages individuals to share information they would not want publicly known. This trust also promotes public health, as individuals with potentially contagious or communicable diseases are not inhibited from seeking treatment.
IV. Recognizes that there are clinical, societal, and economic reasons for a shift to electronic health records and an interoperable network of such, if there are reasonable privacy and confidentiality measures. A paper-based health records system has clinically incomplete and fragmented information, as well as challenges in achieving security and clear auditable trails of record access. While this fragmentation often has the positive privacy consequence of preventing unauthorized disclosure of personal health information, an individual is at risk of vital information not being available in emergencies, of difficulty in maintaining continuity of care, and of adverse health outcomes due to errors. Societal concerns include an unnecessary waste of health care resources and an inability to compile aggregate data on health measures and outcomes.
V. Recognizes that people differ widely in their opinions regarding privacy and confidentiality, opinions that may be influenced by the individual’s health condition as well as cultural, religious, or other beliefs, traditions, or practices. By providing individuals with reasonable choices concerning the uses and disclosures of their personal health information, the health care system and society demonstrate respect for persons. Furthermore, limiting excessive and unnecessary disclosure of personal health information helps to prevent health-based discrimination.
VI. Recognizes that public support for the electronic health record exchange depends upon public confidence and trust that personal health information will be protected. In an age in which electronic transactions are increasingly common and security lapses are reported widely, the health care industry must commit to incorporating privacy and confidentiality protections that permeate the entire health records system and respect the individual.
VII. Recognizes the difficulty in balancing the interests of privacy and confidentiality against the clinical, economic, and societal benefits of the electronic health record exchange. However, individual and societal interests are not necessarily inconsistent. There is a strong societal interest in privacy and confidentiality to promote the full candor on the part of the individual needed for quality health care. At the same time, individuals have a strong interest in giving health professionals the ability to access their personal health information to treat health conditions and safely and efficiently operate the health care system. Both the society as a whole and each individual have an interest in improvements in public health, research, and other uses of personal health information.
2 Health Care Information and Rights. RSA 332-I is repealed and reenacted to read as follows:
CHAPTER 332-I
HEALTH CARE INFORMATION AND RIGHTS
332-I:1 Purpose.
I. The general court finds that:
(a) Health information is the property of the individual and should be protected at all times;
(b) Individuals are entitled to control access to their protected health information and to obtain a report of access to their protected health information based on an audit trail.
II. The purpose of this chapter is to recognize the individual’s ownership of his or her health information, to recognize the individual’s right to privacy in the content of his or her health information, and to establish safeguards to protect health information that exceed the regulatory requirements under sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA):
332-I:2 Definitions. In this chapter:
I. The following terms have the same meaning as given in the regulations under sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA):
(a) Disclosure;
(b) Health care operations;
(c) Health plan;
(d) Individually identifiable health information;
(e) Protected health information;
(f) Person;
(g) Treatment;
(h) Use; and
(i) Payment.
II. “Audit trail” means a chronological record identifying specific persons who have accessed an electronic medical record, the date and time the record was accessed, and, if such information is available, the area of the record that was accessed. An audit trail shall not be considered a part of a person’s medical care.
III. “Commissioner” means the commissioner of the department of health and human services.
IV. “Department” means the department of health and human services.
V. “Health care provider” means any person, corporation, facility, or institution either licensed by this state or otherwise lawfully providing health care services, including, but not limited to, a physician, hospital, office, clinic, health center, or other health care facility licensed under RSA 151, dentist, nurse, optometrist, pharmacist, podiatrist, physical therapist, or mental health professional, and any officer, employee, or agent of such provider acting in the course and scope of employment or agency related to or supportive of health care services. If not otherwise included in the foregoing, “health care provider” also has the meaning provided in the regulations adopted under sections 262 and 264 of HIPAA.
VI. “Individual” means the subject of the protected health information, including a guardian or other legal representative, as appropriate.
VII. “Medical emergency” means medically necessary care which is immediately needed to preserve life, prevent serious impairment to bodily functions, organs, or parts, or prevent placing the physical or mental health of the patient in serious jeopardy.
VIII. “Medical record” means any report, notes, orders, photographs, diagnostic imaging, or other recorded data or information whether maintained in written, electronic, or other form which is received or produced by a health care provider and contains information relating to the medical history, examination, diagnosis, or treatment of an individual.
332-I:3 Protected Health Information; Rights of the Individual. The individual has the following rights in regards to his or her protected health information that is in the possession of a health care provider:
I. All medical information contained in the medical records in the possession of any health care provider shall be deemed to be the property of the individual.
II. The charge for the copying of an individual’s medical records shall not exceed $15 for the first 30 pages or $.50 per page, whichever is greater; provided, that copies of filmed records such as radiograms, x-rays, and sonograms shall be copied at a reasonable cost. When available and at a reasonable cost, the individual may request and receive a copy of his or her protected health information in an electronic format.
III. When an individual’s medical record is maintained in electronic form, the individual has the right to a report, based on whatever audit trail of that record is then maintained, of access to the record by a health care provider named by the individual within an identified period in the prior 3 years. The report shall indicate whether the named provider had access, or did not have access, or whether access could not be determined with the available data. If the named provider had access, the report shall summarize, as the available data permit, the extent of access to the record. This paragraph shall not apply to individuals being held in correctional facilities within the state.
IV. The individual has the right to prohibit disclosure of protected health information in accordance with section 332-I:4.
332-I:4 Protected Health Information; Disclosure for Treatment.
I. As necessary, a health care provider may disclose an individual’s protected health information for treatment of the individual, unless the individual elects otherwise in writing in accordance with paragraph III.
II.(a) For the purposes of this section, one or more health care providers who as of January 1, 2010 are affiliated or business associates for the purpose of sharing an electronic medical record system or comprise an organized health care arrangement, shall be considered one health care provider, if the following criteria are met:
(1) The electronic medical record system is not structured to restrict disclosure as required by this section; and
(2) After January 1, 2010, only active medical staff or other health care providers in the local community or service area who were offered the opportunity to share in the electronic medical record system prior to such date may be added to the foregoing arrangement.
(b) Active medical staff or other health care providers who have not received an offer to share in an electronic medical records system prior to January 1, 2010 may share in such an electronic medical record arrangement only when the electronic medical record system restricts disclosure between the separate providers in accordance with this section.
III. At the initial encounter with an individual, a health care provider shall inform the individual of the right to elect to prohibit disclosure for treatment of the individual’s protected health information pursuant to paragraph I. The following procedures shall apply to such election:
(a) If the individual elects to prohibit disclosure for treatment, at the initial encounter or any time thereafter, the health care provider shall inform the individual of the possible consequences associated with such an election. The health care provider shall also supply a form, as described in paragraph VII, on which the individual shall make the election to prohibit disclosure for treatment in writing, including by electronic signature. The election is effective on the date the written election is made and the health care provider is not liable for disclosures made prior to receipt of such election.
(b) An individual may at any time revoke an election to prohibit disclosure for treatment. Such revocation is effective on the date an oral or written election to revoke is made, received, and documented by the health care provider. The health care provider shall not be liable for an access denial made prior to such election.
IV. Notwithstanding an election by an individual to prohibit disclosure, a health care provider may disclose protected health information to:
(a) An insurance issuer or other person when a written request for protected health information from the insurance issuer or other person includes the individual’s signature authorizing disclosure;
(b) A pharmacist when the health care provider arranges with the individual to submit a prescription directly to the pharmacy, by phone, electronic format, or other direct submission method, and the individual does not object or request a paper prescription; or
(c) The state, when required by state law.
V. An election to prohibit disclosure under this section shall not prohibit the disclosure of protected health information during a medical emergency when the treating health care provider is unable to obtain the individual’s authorization due to the individual’s condition or the nature of the medical emergency. The treating health care provider shall make the clinical determination as to whether or not a medical emergency exists.
VI. A health care provider shall not be required to provide treatment to an individual who elects not to disclose protected health information that the health care provider deems clinically necessary, unless such treatment is required by law. No health care provider who, in good faith, renders reasonable care shall be held liable for any adverse health outcome to an individual that results from that individual’s election to limit access to his or her protected health information permitted by this section.
VII. The form on which an individual elects to prohibit disclosure of protected health information shall be developed, and revised as necessary by the commissioner, and that process shall be exempt from the requirements of RSA 541-A. At a minimum, the form shall:
(a) Be written in clear, plain language, in large-type font;
(b) Contain the name of the health care provider;
(c) Meet any applicable requirements of the regulations under sections 262 and 264 of HIPAA; and
(d) Contain the following in a clear and conspicuous manner:
(1) A statement of the election;
(2) A statement that the election may be revoked at any future time, orally or in writing;
(3) A statement that the authorization will be effective until revoked;
(4) A statement that the individual has been informed of the risks and benefits associated with such an election; and
(5) Contact information for the department of justice for submission of a complaint.
332-I:5 Unauthorized Disclosure. In the event of a disclosure for treatment, not permitted by this chapter, of protected health information by a health care provider, the health care provider shall promptly notify in writing the individual or individuals whose protected health information was disclosed.
332-I:6 Complaints; Right of Action.
I. An individual may make a written complaint relative to a violation of 332-I:1 through 332-I:5 by a health care provider to the board or agency that licenses or certifies the health care provider. Upon receipt of such complaint, the board or agency shall review the complaint and, where sufficient evidence of a violation is presented, conduct investigations to determine whether a violation of this subdivision has occurred and take appropriate action against the health care provider.
II. An aggrieved individual may bring a civil action under this subdivision and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.
Health Care Rights
332-I:7 Health Care Rights of the Individual.
I.(a) The individual has the right to courtesy, respect, dignity, responsiveness, and timely attention to his or her needs.
(b) The individual has the right to receive information from the health care provider and to discuss the benefits, risks, and costs of appropriate treatment alternatives.
(c) The individual shall be fully informed by the health care provider of his or her medical condition, health care needs, and diagnostic test results, including the manner by which such results will be provided and the expected time interval between testing and receiving results, unless medically inadvisable and so documented in the medical record.
(d) The individual has the right to make decisions regarding the health care that is recommended by the health care provider. Accordingly, unless required by state law, individuals may accept or refuse any recommended medical treatment and be involved in experimental research upon the individual’s written consent only.
(e) The health care provider shall not reveal confidential communications or information without the consent of the individual, unless provided for by law or by the need to protect the welfare of the individual or the public interest.
II. Facilities subject to RSA 151:21 and RSA 151:21-b shall be exempt from paragraph I.
3 Effective Date. This act shall take effect January 1, 2010.
LBAO
09-0357
Amended 04/08/09
HB 580 FISCAL NOTE
AN ACT relative to health information and patient rights.
FISCAL IMPACT:
The Legislative Budget Assistant has determined that this legislation, as amended by the House (Amendment #2009-0867h), has a total fiscal impact of less than $10,000 in each of the fiscal years 2009 through 2013.