Revision: Jan. 26, 2009, midnight
HB 619 – AS INTRODUCED
2009 SESSION
01/10
HOUSE BILL 619
AN ACT relative to medical records and patient information.
SPONSORS: Rep. Rosenwald, Hills 22; Rep. Bridgham, Carr 2; Rep. Kurk, Hills 7; Rep. Batula, Hills 19; Rep. Case, Rock 1; Sen. Cilley, Dist 6; Sen. Fuller Clark, Dist 24
COMMITTEE: Health, Human Services and Elderly Affairs
This bill establishes procedures for access to health care information that is in the possession of health care providers and business associates of health care providers.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
09-0508
01/10
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand Nine
AN ACT relative to medical records and patient information.
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 Patient Information. Amend the chapter heading of RSA 332-I to read as follows:
MEDICAL RECORDS AND PATIENT INFORMATION
2 Medical Records and Patient Information. Amend the section heading of RSA 332-I:1 to read as follows:
332-I:1 Medical Records; Definitions.
3 Definitions Added. RSA 332-I:1, II is repealed and reenacted to read as follows:
II. In this chapter:
(a) The following terms have the same meaning as given in the regulations under sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA):
(1) Business associate;
(2) Use;
(3) Disclosure; and
(4) Protected health information.
(b) “Health care provider” means any person, corporation, facility, or institution either licensed by this state or otherwise lawfully providing health care services, including, but not limited to, a physician, hospital, office, clinic, health center or other health care facility, dentist, nurse, optometrist, pharmacist, podiatrist, physical therapist, or mental health professional, and any officer, employee, or agent of such provider acting in the course and scope of employment or agency related to or supportive of health care services.
(c) “Marketing” means:
(1) To make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless the communication is made by the individual’s health care provider;
(A) For treatment of the individual;
(B) For case management or care coordination for the individual;
(C) To direct or recommend to the individual:
(i) Alternative treatments or therapies if recommended by the individual’s health care provider;
(ii) Health care providers;
(iii) Settings of care; or
(D) For treatment-related reminders or health promotion activities by health care providers.
(2) An arrangement between a health care provider and any other person whereby the health care provider discloses protected health information to the other person, in exchange for direct or indirect remuneration, for the other person or an affiliate of the other person to make a communication about the person’s own product or service that encourages recipients of the communication to purchase or use that product or service.
4 New Sections; Use and Disclosure of Protected Health Information; Marketing; Fundraising. Amend RSA 332-I by inserting after section 2 the following new sections:
332-I:3 Use and Disclosure of Protected Health Information; Marketing; Fundraising.
I. A health care provider, or a business associate of the health care provider, shall obtain an authorization for any use or disclosure of protected health information for marketing or fundraising. Such authorization shall meet the authorization implementation specifications for marketing under the regulations adopted pursuant to sections 262 and 264 of HIPAA.
II. Protected health information disclosed for marketing or fundraising shall not be disclosed by voice mail, an unattended facsimile, or through other methods of communication that are not secure.
332-I:4 Use and Disclosure of Protected Health Information; Research. A business associate of a health care provider shall adhere to the standard for use and disclosure of protected health information for research purposes that applies to covered entities under the regulations adopted pursuant to sections 262 and 264 of HIPAA.
332-I:5 Unauthorized Disclosure. In the event of a disclosure, not permitted by this chapter, of protected health information by a business associate of a health care provider, the business associate shall promptly notify the health care provider and the attorney general. The health care provider shall promptly notify in writing the individual or individuals whose protected health information was disclosed. The business associate shall be responsible for the cost of such notification.
332-I:6 Complaints; Right of Action.
I. An individual may make a written complaint relative to a violation of 332-I by a business associate of a health care provider to the department of justice. Upon receipt of such complaint, the department of justice shall review the complaint, and where sufficient evidence of a violation is presented, conduct investigations to determine whether a violation of this subdivision has occurred. Any violation of these provisions by a business associate of a health care provider shall constitute an unfair and deceptive trade practice within the meaning of RSA 358-A:2. Any right or remedy set forth in RSA 358-A may be used to enforce the provisions.
II. An aggrieved individual may bring a civil action under this subdivision and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.
5 Effective Date. This act shall take effect January 1, 2010.