HB 1613 – AS INTRODUCED
2012 SESSION
01/09
HOUSE BILL 1613
AN ACT relative to protected health information.
SPONSORS: Rep. Rosenwald, Hills 22; Rep. Kurk, Hills 7
COMMITTEE: Health, Human Services and Elderly Affairs
This bill addresses potential breaches of protected health information under federal law.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
12-2372
01/09
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand Twelve
AN ACT relative to protected health information.
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 New Section; Potential Breaches in Disclosure of Protected Health Information. Amend RSA 332-I by inserting after section 5 the following new section:
332-I:5-a Potential Breaches in Disclosure of Protected Health Information.
I. When a covered entity, as defined in 45 C.F.R. section 160.103, or a business associate of a covered entity undertakes to determine whether a breach has occurred in instances not excluded by subparagraphs (1)(ii) and (2)(i)(ii), and (iii) of the definition of breach in 45 C.F.R. section 164.402, and involving the records of at least 10 individuals, the covered entity shall notify each individual whose protected health information may have been disclosed. Notification shall occur within 5 business days of the covered entity’s decision to investigate the potential breach. Notification shall include a brief description of what happened and when it happened in the potential breach, and notice that the individual is entitled to a copy of the full report of the final determination upon the individual’s request, to an address provided in the notification.
II. When a business associate undertakes a determination of whether a breach has occurred in instances not excluded by subparagraphs (1)(ii) and (2)(i)(ii), and (iii) of the definition of breach in 45 C.F.R. section 164.402, and involving the records of at least 10 individuals, the business associate shall, within 5 business days, notify the covered entity for each individual whose protected health information may have been disclosed, providing information sufficient for the required notice to individuals. The business associate shall provide the covered entity with a full report of the final determination within 2 business days of its completion. In such instances, the business associate shall reimburse the covered entity for any costs the covered entity may incur in notification of individuals and in furnishing a full report of the final determination when requested.
III. If a law enforcement official, as defined in 45 C.F.R. section 164.103, states to a covered entity or business associate that the notification required under paragraphs I and II would impede a criminal investigation or cause damage to national security, the covered entity or business entity shall:
(a) If the statement is in writing and specifies the time for which a delay is required, delay such notification for the time period specified by the official.
(b) If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in subparagraph (a) of this paragraph is submitted during that time.
2 Effective Date. This act shall take effect January 1, 2013.