HB832: relative to the privacy of medical records.

HB 832-FN - AS INTRODUCED

2003 SESSION

03-1036

01/09

HOUSE BILL 832-FN

AN ACT relative to the privacy of medical records.

SPONSORS: Rep. Kurk, Hills 48; Rep. Pilliod, Belk 31; Rep. M. Smith, Straf 72; Rep. Dalrymple, Rock 76; Sen. Martel, Dist 18; Sen. Flanders, Dist 7

COMMITTEE: Commerce

ANALYSIS

This bill establishes the parameters for the privacy of medical records. Under this bill, any violation of the medical records law is also a violation of the consumer protection law.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

03-1036

01/09

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Three

AN ACT relative to the privacy of medical records.

Be it Enacted by the Senate and House of Representatives in General Court convened:

1 Medical Records. RSA 332-I:1 is repealed and reenacted to read as follows:

332-I:1 Medical Records.

I. In this chapter:

(a) "Health care provider" means any person, corporation, facility, or institution either licensed by this state or otherwise lawfully providing health care services, including, but not limited to, a physician, hospital or other health care facility, dentist, nurse, optometrist, pharmacist, pharmacy, podiatrist, physical therapist, or psychologist, and any officer, employee, or agent of such provider acting in the course and scope of employment or agency related to or supportive of health care services.

(b) "Marketing" means any communication about a product or service:

(1) Which encourages the recipient to purchase or use the product or service; or

(2) Where a health care provider or medical record holder receives direct or indirect remuneration from a third party for making the communication or releasing patient identifying medical information.

(c) "Medical record holder" means any person, corporation or entity, including but not limited to, life, accident and health insurers, pharmacies, pharmacy benefits management companies, laboratories, health benefits management entities, clearinghouses, billing agents and pharmaceutical manufacturers, that possesses patient identifiable medical information.

II. The medical information contained in the medical records in the possession of any health care provider shall be deemed to be the property of the patient. The patient shall be entitled to a copy of such records upon request. The charge for the copying of a patient's medical records shall not exceed $15 for the first 30 pages or $.50 per page, whichever is greater; provided, that copies of filmed records such as radiograms, x-rays, and sonograms shall be copied at a reasonable cost.

III. Medical records in the possession of health care providers or medical record holders shall be confidential, except as otherwise provided for by law; upon written consent from the patient; or pursuant to statute or court order for production of evidence or the discovery of such records.

IV. Any recipient of patient identifiable medical information, including a health care provider or medical record holder, shall maintain the confidentiality of said information, use it only for the purpose for which it was received, and shall not make any further disclosure without the written consent of the patient or as otherwise required by law.

V. Release or use of patient identifiable medical information for the purpose of sales or marketing of services or products shall be prohibited unless all of the following conditions are met:

(a) The patient has provided written authorization, separate from a general consent for treatment or payment, explicitly authorizing the use or disclosure of his or her personally identifiable medical information for marketing purposes.

(b) All marketing materials shall identify the source of the authorization and a process for revocation of authorization, which shall include an address and telephone number to which requests for revocation should be directed.

(c) All authorizations shall be for a specified period not to exceed 12 months from the date of execution.

(d) If an authorization is revoked, the party to whom authorization was given shall notify all third party recipients within 24 hours, and all communications with the patient by third party recipients shall cease upon receipt of notification of revocation or upon expiration of the original authorization, whichever is earlier.

(e) Any entity that releases patient identifiable medical information for marketing purposes shall maintain records of all disclosures to third parties and account for all disclosures to the patient upon request.

(f) The patient shall be informed in writing at the time of authorization and prominently in the body of any marketing materials if the entity using or releasing the information has received or expects to receive remuneration from a third party for the use or disclosure of the information.

(g) Any medical information disclosed for marketing purposes shall be limited to that which is necessary for the intended use and shall not, under any circumstances, include disclosure of a patient's entire medical record.

VI. In addition to other remedies available at law:

(a) Any violation of the provisions of this section shall constitute an unfair or deceptive act or practice within the meaning of RSA 358-A. Any right, remedy or power set forth in RSA 358-A may be used to enforce the provisions of this chapter.

(b) A patient whose medical information has been used or disclosed in violation of this chapter shall be awarded reasonable attorneys' fees and the cost of litigation.

(c) If the court finds that the violations have occurred with a frequency as to constitute a pattern or practice, the court shall assess, in addition to any other penalties provided, a civil penalty not to exceed $250,000.

(d) In addition to the penalties prescribed by this section, an entity shall be excluded from participating in any state-funded health care programs, including the medicaid program, for a period of one year, if it is found that the entity engaged in a pattern or practice of violating this chapter.

VII. Notwithstanding paragraph VI, no penalty shall be assessed against an employee of a covered entity in his or her individual capacity for a first offense where it is found that the violation was due to the covered entity's failure to provide education and training to staff.

2 Effective Date. This act shall take effect January 1, 2004.

LBAO

03-1036

1/22/03

HB 832-FN - FISCAL NOTE

AN ACT relative to the privacy of medical records.

FISCAL IMPACT:

The Judicial Council and Judicial Branch indicated this bill will increase state expenditures by an indeterminable amount in FY 2004 each year thereafter. The Department of Health and Human Services stated this bill will result in an indeterminable fiscal impact on state, county and local expenditures and state and county revenue. There will be no fiscal impact on local revenue.

METHODOLOGY:

The Judicial Branch stated violations of this bill would constitute an unfair or deceptive practice under the Consumer Protection Act and could result in civil penalties up to $250,000 in certain cases. The Branch stated that Consumer Protection Act claims can also result in criminal or private actions. The Branch cannot determine the number of cases that will be brought under the proposed law or the cost per case.

The Judicial Council stated that if the individual charged is determined to be indigent, they will be eligible for representation paid for by the state Indigent Defense Fund. A public defender or contract attorney assigned to the case would receive $250 per case. If assigned counsel is required, the rate charged is $60 per hour with a cap of $1,000. The Council cannot determine the number of cases eligible for indigent defense representation or the type of representation that will be necessary.

The Department of Health and Human Services stated the definition of marketing in this bill would prohibit the Department from informing targeted clients about services or implementing case management based on information from medical records. The Department indicated the Health Insurance Portability and Accountability Act of 1996 (HIPPA) regulations permits the Department to target and inform its clients of programs that benefit their health and result in the use of less costly services. The definition of marketing in this bill would prevent the Department from using medical information for these purposes.

The Board of Medicine and Department of Justice indicated this bill will have no fiscal impact on their respective agencies.