REPORT TITLE:
Health Care Information


DESCRIPTION:
Establishes procedures for disclosure of health care records to
protect the right of privacy while preserving necessary
disclosures for health and safety.

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                        
THE SENATE                              S.B. NO.           1230
TWENTIETH LEGISLATURE, 1999                                
STATE OF HAWAII                                            
                                                             
________________________________________________________________
________________________________________________________________


                   A  BILL  FOR  AN  ACT

RELATING TO PRIVACY OF HEALTH CARE INFORMATION. 


BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 1      SECTION 1.  The legislature finds that an individual's
 
 2 constitutional right to privacy is at risk with respect to
 
 3 personal health information and records relating to medical care
 
 4 and health status.  Erosion of the right to privacy may reduce
 
 5 the willingness of patients to confide in physicians and other
 
 6 practitioners, jeopardizing the provision of quality health care.
 
 7 Misuse of medical information may also be devastating to an
 
 8 individual's well-being. 
 
 9      The legislature further finds that any disclosure of
 
10 protected health information should be limited to only that
 
11 information or portion of the medical record necessary to fulfill
 
12 the purpose of the disclosure.  An individual's right to privacy
 
13 requires an individual's consent to disclose the individual's
 
14 protected health information, except in limited circumstances
 
15 required by the overriding public interest.
 
16      The legislature further finds that use of nonidentifiable
 
17 health information should be encouraged where appropriate, and
 
18 that the continuing availability of timely and accurate personal
 
19 health data for the delivery of health care services throughout
 

 
Page 2                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 the State is needed.  Personal health data may be essential for
 
 2 selected types of medical research, and public health use of
 
 3 personal health information is critical to personal health and
 
 4 public health.  
 
 5      The legislature further finds that the privacy of an
 
 6 individual's health information must be assured without unduly
 
 7 jeopardizing clinical and epidemiological research undertaken to
 
 8 improve health care and health outcomes, and to assure the
 
 9 quality and efficiency of health care.
 
10      The purpose of this Act is to:
 
11      (1)  Provide a right to privacy established under section 6
 
12           of article I of the Constitution of the State of
 
13           Hawaii, that states that the legislature shall take
 
14           affirmative steps to implement the right to privacy;
 
15      (2)  Protect individuals from the adverse effects of the
 
16           improper disclosure of protected health information in
 
17           medical records;
 
18      (3)  Establish strong and effective mechanisms to protect
 
19           against the unauthorized and inappropriate use of
 
20           protected health information that is created or
 
21           maintained as part of health care treatment, diagnosis,
 
22           enrollment, payment, plan administration, testing, or
 
23           research processes;
 

 
Page 3                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (4)  Promote the effective exchange and transfer of health
 
 2           information in a manner that will ensure the
 
 3           confidentiality of protected health information without
 
 4           impeding the delivery of high quality health care;
 
 5      (5)  Create incentives to turn personal health information
 
 6           into nonidentifiable health information for purposes of
 
 7           oversight, health research, public health, law
 
 8           enforcement, judicial, and administrative purposes, as
 
 9           appropriate; and
 
10      (6)  Establish strong and effective remedies for violations.
 
11      SECTION 2.  The Hawaii Revised Statutes is amended by adding
 
12 a new chapter to be appropriately designated and to read as
 
13 follows:
 
14                             "CHAPTER 
 
15                PRIVACY OF HEALTH CARE INFORMATION
 
16                    PART I.  GENERAL PROVISIONS
 
17      §   -1  Definitions.  As used in this chapter:
 
18      "Accrediting body" means a committee, organization, or
 
19 institution that has been authorized by law or is recognized by a
 
20 health care regulating authority as an accrediting entity, or any
 
21 other entity that has been similarly authorized or recognized by
 
22 law to perform specific accreditation, licensing, or
 
23 credentialing activities.
 

 
Page 4                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      "Agent" means a person who represents and acts for another
 
 2 under a contract or relationship of agency, or whose function is
 
 3 to bring about, modify, affect, accept performance of, or
 
 4 terminate contractual obligations between the principal and a
 
 5 third person, including a contractor.
 
 6      "Designated individual's representative" means a person who
 
 7 is authorized by law other than a legal representative of a
 
 8 minor, or by an instrument recognized under law, to act as an
 
 9 agent, attorney, guardian, proxy, or other legal representative
 
10 of a protected individual, including a health care power of
 
11 attorney.
 
12      "Director" means the director of the office of information
 
13 practices.
 
14      "Disclose" means to release, transfer, provide access to,
 
15 share, or otherwise divulge protected health information to any
 
16 person other than the individual who is the subject of the
 
17 information.  The term includes the initial disclosure and any
 
18 subsequent redisclosures of protected health information.
 
19      "Employer" means an individual or organization, including a
 
20 partnership, association, trust, estate, joint stock company,
 
21 insurance company, or corporation, whether domestic or foreign, a
 
22 debtor in possession or receiver or trustee in bankruptcy, or of
 
23 the legal representative of a deceased person, who employs one or
 
24 more persons.
 

 
Page 5                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      "Employment" means services performed for wages under any
 
 2 contract of hire, written or oral, expressed or implied, with an
 
 3 employer.
 
 4      "Entity" means, unless the context otherwise specifically
 
 5 provides, a health care provider, health care data organization,
 
 6 health plan, health oversight agency, health researcher, public
 
 7 health authority or agency as appropriate to the context, law
 
 8 enforcement agency or official as appropriate to the context,
 
 9 employer, insurer, or educational institution.
 
10      "Health care" means:
 
11      (1)  Preventive, diagnostic, therapeutic, rehabilitative,
 
12           palliative, or maintenance services:
 
13           (A)  With respect to the physical or mental condition
 
14                of an individual, or both;
 
15           (B)  Affecting the structure or function of the human
 
16                body or any part of the human body, including, but
 
17                not limited to, the banking of blood, sperm,
 
18                organs, or any other tissue; 
 
19      (2)  Any sale or dispensing of a drug, device, equipment, or
 
20           other health care related item to an individual, or for
 
21           the use of an individual pursuant to a prescription or
 
22           order by a health care provider.
 
23      "Health care data organization" means a for-profit or non-
 
24 profit private corporation that engages primarily in the business
 

 
Page 6                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 of collecting, analyzing, and disseminating identifiable and
 
 2 nonidentifiable patient information.  The term excludes a health
 
 3 care provider, insurer, a health researcher, or a health
 
 4 oversight agency.
 
 5      "Health care provider" means a person or officer, employee,
 
 6 or agent of the person who receives, creates, uses, maintains, or
 
 7 discloses protected health information while acting in whole or
 
 8 in part in the capacity of:
 
 9      (1)  Being licensed, certified, registered, or otherwise
 
10           authorized by federal or state law to provide an item
 
11           or service that constitutes health care in the ordinary
 
12           course of business or practice of a profession;
 
13      (2)  A federal, state, or employer sponsored program that
 
14           directly provides items or services that constitute
 
15           health care to beneficiaries.
 
16      "Health oversight agency" means a person who, with respect
 
17 to any protected health information, receives, creates, uses,
 
18 maintains, or discloses the information while acting in whole or
 
19 in part in the capacity of:
 
20      (1)  Performing or overseeing the performance of an
 
21           assessment, evaluation, determination, or
 
22           investigation, relating to the licensing,
 
23           accreditation, or credentialing of health care
 
24           providers; or
 

 
Page 7                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (2)  Performing or overseeing the performance of an audit,
 
 2           assessment, evaluation, determination, or investigation
 
 3           relating to the effectiveness of, compliance with, or
 
 4           applicability of, legal, fiscal, medical, or scientific
 
 5           standards or aspects of performance related to the
 
 6           delivery of, or payment for, health care; and
 
 7      (3)  A public agency, acting on behalf of a public agency,
 
 8           acting pursuant to a requirement of a public agency, or
 
 9           carrying out activities under a federal or state law
 
10           governing the assessment, evaluation, determination,
 
11           investigation, or prosecution described in paragraph
 
12           (1).
 
13      "Health plan" means any health insurance plan, including any
 
14 hospital or medical service plan, dental plan, health maintenance
 
15 organization plan, provider sponsored organization, or other
 
16 program or health service plan providing or arranging for the
 
17 provision of health benefits, whether or not funded through
 
18 insurance.
 
19      "Health researcher" means a person, including an officer,
 
20 employee, or independent contractor of a person, who receives
 
21 protected health information as part of a systematic
 
22 investigation, testing, or evaluation designed to develop or
 
23 contribute to generalized scientific and clinical knowledge.
 

 
Page 8                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      "Institutional review board" means a research committee
 
 2 established and operating in accord with title 45, Code of
 
 3 Federal Regulations, part 46, sections 107, 108, 109, and 115.
 
 4      "Insurer" means all organizations which have protected
 
 5 health information and are regulated by chapter 431 or 432,
 
 6 except a health plan.
 
 7      "Law enforcement inquiry" means a lawful investigation
 
 8 conducted by an appropriate government agency or an official
 
 9 inquiring into a violation of, or failure to comply with, any
 
10 criminal or civil statute or any regulation, rule, or order
 
11 issued pursuant to a statute.
 
12      "Nonidentifiable health information" means any protected
 
13 health information that does not reveal the identity of an
 
14 individual whose health or health care is the subject of the
 
15 information; provided that there is no reasonable basis to
 
16 believe that the information could be used to reveal the identity
 
17 of the individual, either alone or with other information that
 
18 is, or should reasonably be known, to be available to recipients
 
19 of the information.
 
20      "Office" means the office of information practices under
 
21 chapter 92F.
 
22      "Payment" means the activities of a health plan or provider,
 
23 which are reasonably necessary to determine responsibility for
 
24 coverage, services, and the actual payment for services, if any.
 

 
Page 9                                                     
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      "Person" means a government, governmental subdivision,
 
 2 agency or authority, corporation, limited liability company,
 
 3 association, firm, partnership, insurer, estate, trust, joint
 
 4 venture, individual, individual representative.
 
 5      "Protected health information" means any information,
 
 6 identifiable to an individual, including demographic information,
 
 7 whether or not recorded in any form or medium that relates
 
 8 indirectly or directly to the past, present, or future:
 
 9      (1)  Physical or mental health or condition of a person,
 
10           including tissue and genetic information;
 
11      (2)  Provision of health care to an individual; or
 
12      (3)  Payment for the provision of health care to an
 
13           individual.
 
14      "Public health authority" means an agency of the State or
 
15 its political subdivision that is:
 
16      (1)  Primarily responsible for public health matters; and
 
17      (2)  Primarily engaged in activities such as disease, injury
 
18           reporting, public health surveillance, and public
 
19           health investigation or intervention.
 
20      "Qualified health care operations" means only those services
 
21 provided by or on behalf of a health plan or health care provider
 
22 for the purpose of carrying out the management functions of a
 
23 health care provider or health plan, or implementing the terms of
 
24 a contract for health plan benefits, as follows:
 

 
Page 10                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (1)  Conducting quality assurance activities or outcomes
 
 2           assessments;
 
 3      (2)  Reviewing the competence or qualifications of health
 
 4           care professionals;
 
 5      (3)  Performing accreditation, licensing, or credentialing
 
 6           activities;
 
 7      (4)  Analyzing health plan claims or health care records
 
 8           data;
 
 9      (5)  Evaluating provider clinical performance;
 
10      (6)  Carrying out utilization management; or
 
11      (7)  Conducting or arranging for auditing services in
 
12           accordance with statute, rule, or accreditation
 
13           requirements.
 
14      "Treatment" means the provision of health care by, or the
 
15 coordination of health care among, health care providers, or the
 
16 referral of a patient from one provider to another, or
 
17 coordination of health care or other services among health care
 
18 providers and third parties authorized by the health plan or the
 
19 plan member.
 
20      "Unique patient identifier" means a number or an alpha-
 
21 numeric string assigned to an individual, that can be or is used
 
22 to identify protected health information.
 
23      "Writing" means a writing in a paper-based or computer-based
 
24 form, including electronic signatures.
 

 
Page 11                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      § -2 Qualified health care operations.  A qualified
 
 2 health care operation shall be an operation that cannot be
 
 3 carried on with reasonable effectiveness and efficiency without
 
 4 identifiable patient information.  The operation shall be limited
 
 5 to access only that protected health information collected under
 
 6 the terms of a contract for health plan benefits and without
 
 7 which the operation cannot be carried on with reasonable
 
 8 effectiveness and efficiency.  In regard to protected health
 
 9 information, the operation shall be limited to records and
 
10 documents within each patient's record that are minimally
 
11 necessary to carry on the operation with reasonable effectiveness
 
12 and efficiency.  The operation shall restrict the handling and
 
13 examination of protected health information to those persons who
 
14 are reasonably well qualified, by training, credentials, or
 
15 experience, to conduct the phase of the operation in which they
 
16 are involved.
 
17                    PART II.  INDIVIDUAL RIGHTS
 
18      §   -11  Inspection and copying of protected health
 
19 information.(a)  At the written request of an individual and
 
20 except as provided in subsection (b), an entity shall permit an
 
21 individual who is the subject of protected health information or
 
22 the individual's designee, to inspect and copy protected health
 
23 information concerning the individual, including records under
 

 
Page 12                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 section    -12, that the entity maintains.  The entity may set
 
 2 forth appropriate procedures to be followed for inspection or
 
 3 copying and may require an individual to pay reasonable costs
 
 4 associated with the inspection or copying.
 
 5      (b)  Unless ordered by a court of competent jurisdiction, an
 
 6 entity shall not be required to permit the inspection or copying
 
 7 of protected health information, if:
 
 8      (1)  The entity determines that the disclosure of the
 
 9           information could reasonably be expected to endanger
 
10           the life or physical safety of, or cause substantial
 
11           mental harm to, the individual who is the subject of
 
12           the record;
 
13      (2)  The information identifies, or could reasonably lead to
 
14           the identification of, a person who provided
 
15           information under a promise of confidentiality
 
16           concerning the individual who is the subject of the
 
17           information unless the confidential source can be
 
18           protected by redaction or other similar means;
 
19      (3)  The information is: 
 
20           (A)  Subject to attorney client privilege or attorney
 
21                work product; or
 
22           (B)  Protected from discovery under section 624-25.5;
 
23      (4)  The information was collected for or during a clinical
 

 
Page 13                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           trial monitored by an institutional review board, the
 
 2           trial is not complete, and the researcher reasonably
 
 3           believes that access would harm the conduct of the
 
 4           trial.
 
 5      (c)  If the entity denies a request for inspection or
 
 6 copying pursuant to subsection (b), the entity shall inform the
 
 7 individual in writing of:
 
 8      (1)  The reasons for the denial of the request for
 
 9           inspection or copying;
 
10      (2)  Any procedures for further review of the denial; and
 
11      (3)  The individual's right to file with the entity a
 
12           concise statement setting forth the request for
 
13           inspection or copying.
 
14      (d)  If an individual files a statement under
 
15 subsection (c)(3), the entity, in any disclosure of information
 
16 requested under subsection (a), shall include:
 
17      (1)  A copy of the individual's statement; and
 
18      (2)  A concise statement of the reasons for denying the
 
19           request for inspection or copying.
 
20      (e)  An entity shall permit the inspection and copying of
 
21 any reasonably segregable portion of a record after deletion of
 
22 any portion that is exempt under subsection (b).
 
23      (f)  An entity shall comply with, or deny in accordance with
 
24 subsection (c), a request for inspection or copying of protected
 

 
Page 14                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 health information under this section not later than thirty days
 
 2 after the date on which the entity receives the request.
 
 3      (g)  An agent of an entity shall not be required to provide
 
 4 the inspection and copying of protected health information,
 
 5 except if:
 
 6      (1)  The protected health information is retained by the
 
 7           agent; and
 
 8      (2)  The agent receives a written request from the entity
 
 9           involved to fulfill the requirements of this section;
 
10           whereupon this information shall be provided to the
 
11           requesting entity, which shall comply with subsection
 
12           (f).
 
13      (h)  The entity shall afford at least one level of appeal by
 
14 parties not involved in the original decision.
 
15      (i)  This section shall not be construed to require that an
 
16 entity conduct a formal, informal, or other hearing or proceeding
 
17 concerning a request for inspection or copying of protected
 
18 health information.
 
19      (j)  As used in this section, "entity" excludes a health
 
20 oversight agency, health researcher, public health agency or
 
21 authority, law enforcement agency or official, and educational
 
22 institution.
 
23      §   -12  Additions to protected health information.  A
 
24 health care provider shall be the owner of the medical record in
 

 
Page 15                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 the provider's possession that was created by the health care
 
 2 provider in treating a patient.  An individual or an authorized
 
 3 representative may request in writing that a health care provider
 
 4 generating certain health care information append additional
 
 5 information to the record in order to improve the accuracy or
 
 6 completeness of the information; provided that appending the
 
 7 information does not erase or obliterate any of the original
 
 8 information.  A health care provider shall either:
 
 9      (1)  Append the information as requested; or
 
10      (2)  Notify the individual that the request has been denied,
 
11           the reason for the denial, and that the individual may
 
12           file a statement of reasonable length as to the
 
13           correctness or relevance of existing information or as
 
14           to the addition of new information.  The statement or
 
15           copies shall be appended to the medical record and at
 
16           all times accompany that part of the information in
 
17           contention.
 
18      §   -13  Notice of confidentiality practices; forms of
 
19 notices.(a)  An entity, not including a law enforcement agency
 
20 or official nor a public health authority or agency, shall post
 
21 or provide in writing as required by section    -22, and in a
 
22 clear and conspicuous manner in plain language, the current
 
23 notice of the entity's confidentiality practices.  For the
 

 
Page 16                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 purpose of informing each individual of the individual's rights
 
 2 under this chapter, the notice shall include:
 
 3      (1)  A description of an individual's rights with respect to
 
 4           protected health information;
 
 5      (2)  The uses and disclosures of protected health
 
 6           information authorized under this chapter;
 
 7      (3)  The right of the individual to limit disclosure of
 
 8           protected health information by deciding not to utilize
 
 9           any health insurance or other third party payment as or
 
10           for payment for the service, as set forth in
 
11           section    -21(c);
 
12      (4)  The procedures for giving consent to disclosures of
 
13           protected health information and for revoking consents
 
14           to disclose;
 
15      (5)  The description of procedures established by the entity
 
16           for the exercise of the individual's rights; and
 
17      (6)  The right to obtain a copy of the notice of the
 
18           confidentiality practices required under this chapter.
 
19      (b)  The actual procedures established by the entity for the
 
20 exercise of individual rights under this part shall be available
 
21 in writing upon request.
 
22      §   -14  Establishment of safeguards.  An entity shall
 
23 establish and maintain appropriate administrative, technical, and
 

 
Page 17                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 physical safeguards to protect the confidentiality, security,
 
 2 accuracy, and integrity of protected health information created,
 
 3 received, obtained, maintained, used, transmitted, or disposed of
 
 4 by the entity.
 
 5           PART III.  RESTRICTIONS ON USE AND DISCLOSURE
 
 6      §   -21  General rules regarding use and disclosure.(a)
 
 7 An entity shall not use or disclose protected health information,
 
 8 except as provided under this part and under part IV.  Disclosure
 
 9 of health information in the form of nonidentifiable health
 
10 information shall not be construed as a disclosure of protected
 
11 health information.
 
12      (b)  For the purpose of treatment, payment, or qualified
 
13 health care operations, an entity shall only use or disclose
 
14 protected health information within the entity if the use or
 
15 disclosure is properly noticed pursuant to sections    -13
 
16 and    -22.  For all other uses and disclosures, an entity shall
 
17 only use or disclose protected health information, if the use or
 
18 disclosure is properly consented to pursuant to section    -23,
 
19 and the use or disclosure is consistent with the limitations
 
20 under subsection (d) on the scope of disclosure.  Disclosure to
 
21 agents of an entity described in subsection (a) shall be
 
22 considered as a disclosure within an entity.
 
23      (c)  If an individual does not allow the protected health
 
24 information to be released pursuant to subsection (b), the
 

 
Page 18                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 individual shall advise the health care provider that the
 
 2 relevant protected health information shall not be disclosed and
 
 3 shall pay the health care provider directly for health care
 
 4 services.  Protected health information related to health care
 
 5 services paid for directly by the individual shall not be
 
 6 disclosed without a consent to disclose pursuant to section    -
 
 7 23, by law, or by a court order.
 
 8      (d)  An agent who receives protected health information from
 
 9 an entity shall be subject to all rules of disclosure and
 
10 safeguard requirements under this part.
 
11      (e)  (1)  Every use or disclosure, or both, of protected
 
12           health information by an entity under this part shall
 
13           be limited to the information necessary to accomplish
 
14           the purpose for which the information is disclosed.
 
15      (2)  Every use or disclosure, or both, of protected health
 
16           information shall be limited to the purpose for which
 
17           it was collected.  Any other use without a valid
 
18           consent to disclose shall be an unauthorized
 
19           disclosure.
 
20      (f)  Nothing in this part permitting the disclosure of
 
21 protected health information shall be construed to require
 
22 disclosure.
 
23      (g)  Except as otherwise provided in this part, protected
 
24 health information shall not be disclosed unless the information
 

 
Page 19                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 is clearly identified as protected health information that is
 
 2 subject to this chapter.
 
 3      (h)  An entity may disclose protected health information to
 
 4 an employee or agent of the entity for purposes of creating
 
 5 nonidentifiable information, if the entity prohibits the employee
 
 6 or agent of the entity from using or disclosing the protected
 
 7 health information for purposes other than the sole purpose of
 
 8 creating nonidentifiable information as specified by the entity.
 
 9      (i)  Any individual or entity who manipulates or uses a
 
10 nonidentifiable database in order to identify an individual shall
 
11 be deemed to have disclosed protected health information.  The
 
12 disclosure or transmission of a unique patient identifier shall
 
13 be deemed to be a disclosure of protected health information.
 
14      §   -22  Giving notice regarding disclosure of protected
 
15 health information for treatment, payment, or qualified health
 
16 care operations.(a)  The notice required by section    -13
 
17 shall be:
 
18      (1)  Given upon enrollment, annually, and when
 
19           confidentiality practices are substantially amended by
 
20           each health plan to each individual who is eligible to
 
21           receive care under the health plan, or to the parent or
 
22           guardian of the individual; or
 
23      (2)  Posted in a conspicuous place or provided by those
 

 
Page 20                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           entities other than health plans, identified in
 
 2           section   -21(j).
 
 3      (b)  Except as provided in this chapter, a notice required
 
 4 by this section shall not be construed as a waiver of any rights
 
 5 of the individual under other federal or state laws, the rules of
 
 6 evidence, or common law.
 
 7      (c)  Notice under this section shall not authorize the
 
 8 disclosure of protected health information by a person with the
 
 9 intent to sell, transfer, or use protected health information for
 
10 commercial purpose or advantage, unless there is a consent under
 
11 section    -23(a).  
 
12      §   -23  Consent to disclose protected health information
 
13 other than for treatment, payment, or qualified health care
 
14 operations.(a)  An entity pursuant to a consent to disclose,
 
15 may disclose protected health information, for purposes other
 
16 than those set forth in section    -22.  The consent shall be
 
17 executed by the individual who is the subject of the information.
 
18 The consent to disclose shall meet the requirements of subsection
 
19 (d).
 
20      (b)  An individual may revoke in writing or amend a consent
 
21 to disclose.  An entity that discloses protected health
 
22 information pursuant to a consent to disclose that has been
 
23 revoked under this subsection shall not be subject to any
 

 
Page 21                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 liability or penalty under this part if that entity had no actual
 
 2 or constructive notice of the revocation.
 
 3      (c)  A valid consent to disclose protected health
 
 4 information shall:
 
 5      (1)  Identify the entity authorized to disclose protected
 
 6           health information; 
 
 7      (2)  Identify the individual who is the subject of the
 
 8           protected health information;
 
 9      (3)  Describe the nature of and the time span of the
 
10           protected health information to be disclosed;
 
11      (4)  Identify the person to whom the information is to be
 
12           disclosed;
 
13      (5)  Describe the purpose of the disclosure;
 
14      (6)  State that it is subject to revocation by the
 
15           individual and indicate that the consent to disclose is
 
16           valid until revocation by the individual;
 
17      (7)  Shall include the date at which the consent to disclose
 
18           ends; and 
 
19      (8)  (A)  Be either:
 
20                (i)  In writing, dated, and signed by the
 
21                     individual; or
 
22               (ii)  In electronic form, dated and authenticated
 
23                     by the individual using a unique identifier;
 
24                     or
 

 
Page 22                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           (B)  Not revoked.
 
 2      (e)  An individual may revoke in writing a consent to
 
 3 disclose under this section at any time.  An individual's consent
 
 4 to disclose is deemed to be revoked at the time of the
 
 5 cancellation or nonrenewal of enrollment in the health plan.  An
 
 6 individual shall not maintain an action against an entity for
 
 7 disclosure of protected health information if the disclosure was
 
 8 made in good faith reliance on the individual's consent to
 
 9 disclose at the time disclosure was made.
 
10      (f)  A recipient of protected health information pursuant to
 
11 a consent to disclose under this section shall use the
 
12 information solely to carry out the purpose for which the
 
13 information was authorized for release.
 
14      (g)  A person collecting or storing protected health
 
15 information shall maintain a record for a period of seven years
 
16 for each consent to disclose of an individual or revocation.
 
17      (h)  Except as provided for in this chapter, the receipt of
 
18 the notice required by sections    -13 and    -22 by an
 
19 individual shall not be construed as a waiver of any rights that
 
20 the individual has under other federal or state laws, the rules
 
21 of evidence, or common law.
 
22              PART IV.  EXCEPTED USES AND DISCLOSURES
 
23      §   -31  Coroner or medical examiner.  If a coroner or
 
24 medical examiner, or their duly appointed deputies, seek
 

 
Page 23                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 protected health information for the purpose of inquiry into and
 
 2 determination of, the cause, manner, and circumstances of a
 
 3 death, any person shall provide the requested protected health
 
 4 information to the coroner or medical examiner or to the duly
 
 5 appointed deputies without undue delay.  If a coroner or medical
 
 6 examiner or their duly appointed deputies receives protected
 
 7 health information, this protected health information shall
 
 8 remain protected health information unless it is attached to or
 
 9 otherwise made a part of a coroner's or medical examiner's
 
10 official report.  Health information attached to or otherwise
 
11 made a part of a coroner's or medical examiner's official report,
 
12 shall be exempt from this chapter except as provided for in this
 
13 section.
 
14      §   -32  Designated individual's representative, relative,
 
15 or friend, and directory information.(a)  A health care
 
16 provider, or a person who receives protected health information
 
17 under subsection (b), may disclose any protected health
 
18 information regarding an individual to a designated individual's
 
19 representative, relative, or friend, if:
 
20      (1)  The individual who is the subject of the information:
 
21           (A)  Has been notified of the individual's right to
 
22                object to the disclosure and the individual has
 
23                not objected to the disclosure; or
 

 
Page 24                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           (B)  Is in a physical or mental condition such that the
 
 2                individual is not capable of objecting, and there
 
 3                are no prior indications that the individual would
 
 4                object; or
 
 5      (2)  The information disclosed is for the purpose of
 
 6           providing health care to that individual; or
 
 7      (3)  The disclosure of the protected health information is
 
 8           consistent with good medical or professional practice.
 
 9      (b)  Except as provided in subsection (d), a health care
 
10 provider may disclose the information described in subsection (c)
 
11 to any other person if the individual who is the subject of the
 
12 information:
 
13      (1)  Has been notified of the individual's right to object
 
14           and the individual has not objected to the disclosure,
 
15           or is in a physical or mental condition such that the
 
16           individual is not capable of objecting; or
 
17      (2)  The designated individual's representative, relative or
 
18           friend has not objected, and there are no prior
 
19           indications that the individual would object.
 
20      (c)  Information that may be disclosed under this section
 
21 shall be only that information that consists of any of the
 
22 following:
 
23      (1)  The name of the individual who is the subject of the
 
24           information;
 

 
Page 25                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (2)  The general health status of the individual, described
 
 2           as critical, poor, fair, stable, or satisfactory or in
 
 3           terms denoting similar conditions; or
 
 4      (3)  The location of the individual on premises controlled
 
 5           by a provider; provided that the disclosure shall not
 
 6           be made if the information would reveal specific
 
 7           information about the physical or mental condition of
 
 8           the individual, unless the individual expressly
 
 9           authorizes disclosure.
 
10      (d)  A disclosure shall not be made under this section if
 
11 the health care provider has reason to believe that the
 
12 disclosure could lead to the physical or mental harm of the
 
13 individual, unless the individual expressly authorizes
 
14 disclosure.
 
15      §   -33  Identification of deceased individuals.  A health
 
16 care provider may disclose protected health information if the
 
17 disclosure is necessary to assist in the identification or safe
 
18 handling of a deceased individual.
 
19      § -34  Emergency circumstances.  Any person who creates or
 
20 receives protected health information under this chapter may use
 
21 or disclose protected health information in emergency
 
22 circumstances when the use or disclosure is necessary to protect
 
23 the health or safety of the individual who is the subject of the
 

 
Page 26                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 information, from serious, imminent harm.  No disclosure made in
 
 2 the good faith belief that the use or disclosure was necessary to
 
 3 protect the health or safety or an individual from serious,
 
 4 imminent harm shall be in violation of or punishable under this
 
 5 chapter.
 
 6      §   -35  Disclosures for health oversight.(a)  Any person
 
 7 may disclose protected health information to a health oversight
 
 8 agency for purposes of an oversight function authorized by law.
 
 9      (b)  A public health authority or health researcher may
 
10 disclose protected health information to a health oversight
 
11 agency for purposes of an oversight function of the public health
 
12 authority or health researcher authorized by law.
 
13      (c)  For purposes of this section, the individual with
 
14 authority to authorize the health oversight function shall
 
15 provide a statement that the protected health information is
 
16 being sought for a legally authorized oversight function.
 
17      (d)  Protected health information about an individual that
 
18 is disclosed under this section shall not be used in, or
 
19 disclosed to, any person for use in an administrative, civil, or
 
20 criminal action or investigation directed against the individual
 
21 unless the action or investigation arises out of and is directly
 
22 related to:
 
23      (1)  The receipt of health care or payment for health care;
 

 
Page 27                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (2)  An action involving a fraudulent claim related to
 
 2           health; or
 
 3      (3)  An action involving oversight of a public health
 
 4           authority or a health researcher.
 
 5      §   -36  Public health.(a)  Any person or entity may
 
 6 disclose protected health information to a public health
 
 7 authority or other person authorized by law for use in a legally
 
 8 authorized disease or injury report, public health surveillance,
 
 9 public health investigation or intervention, or health or disease
 
10 registries.
 
11      (b)  No person or entity shall be liable for the disclosure
 
12 of protected health information, that is authorized by this part,
 
13 to a public health authority or other person authorized by law.
 
14      (c)  Limitations or prohibitions on disclosure of health
 
15 information in this chapter shall not limit the requirements for
 
16 disclosure and confidentiality otherwise established by law.
 
17      §   -37  Health research.  An entity, not including a health
 
18 care data organization, health oversight agency, health
 
19 researcher, or law enforcement agency or official, may disclose
 
20 protected health information to a health researcher, if:
 
21      (1)  The research has been approved by an institutional
 
22           review board; provided that in evaluating a research
 
23           proposal, an institutional review board shall require
 

 
Page 28                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           that the proposal demonstrates a clear purpose,
 
 2           scientific integrity, and a realistic plan for
 
 3           maintaining the confidentiality of protected health
 
 4           information;
 
 5      (2)  The research involves analysis of protected health
 
 6           information previously created or collected by the
 
 7           holder of protected health information;
 
 8      (3)  The person who receives protected health information
 
 9           removes or destroys, at the earliest opportunity
 
10           consistent with the purposes of the project involved,
 
11           information that would enable an individual to be
 
12           identified;
 
13      (4)  The protected health information is not disclosed or
 
14           used for any purpose other than the health research
 
15           project for which the information was obtained, except
 
16           that the health researcher may disclose the information
 
17           pursuant to sections    -34 and    -35(b);
 
18      (5)  The holder of protected health information keeps a
 
19           record of all health researchers to whom protected
 
20           health information has been made available; and
 
21      (6)  The disclosure of the information to other persons is
 
22           prohibited.
 
23      §   -38  Disclosure in civil, judicial, and administrative
 
24 procedures.(a)  A person may disclose protected health
 

 
Page 29                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 information pursuant to a discovery request or subpoena in a
 
 2 civil action brought in a state court or a request or subpoena
 
 3 related to a state administrative proceeding; provided that the
 
 4 disclosure is made pursuant to a court order under subsection
 
 5 (b).
 
 6      (b)  Any subpoena or discovery request for protected health
 
 7 information shall be accompanied by a court order from a
 
 8 competent jurisdiction.  In considering a request for a court
 
 9 order regarding the disclosure of protected health information
 
10 under subsection (a), the court shall issue the order if the
 
11 court determines that without the disclosure of the information,
 
12 the person requesting the order would be impaired from
 
13 establishing a claim or defense.  An order issued under this
 
14 subsection shall:
 
15      (1)  Provide that the protected health information involved
 
16           is subject to court protection;
 
17      (2)  Specify to whom the information may be disclosed;
 
18      (3)  Specify that the information may not otherwise be
 
19           disclosed or used; and
 
20      (4)  Meet any other requirements that the court determines
 
21           are needed to protect the confidentiality of the
 
22           information.
 
23      (c)  This section shall not apply in a case in which the
 
24 protected health information sought under the discovery request
 

 
Page 30                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 or subpoena is:
 
 2      (1)  Nonidentifiable health information;
 
 3      (2)  Related to a party to the litigation whose medical
 
 4           condition is at issue; or
 
 5      (3)  Could be disclosed under section    -22,    -23,    -31
 
 6           to     -37,    -39, or    -40.
 
 7      (d)  This section shall not be construed to supersede any
 
 8 grounds that may apply under federal or state law for objecting
 
 9 to turning over the protected health information.
 
10      (e)  Any provider shall be immune to any action, civil or
 
11 criminal, related to the release of any protected health
 
12 information pursuant to this section.
 
13      §   -39  Disclosure for law enforcement purposes.(a)
 
14 Except as to disclosures to a health oversight agency, an entity,
 
15 not including a health care organization, health researcher, law
 
16 enforcement agency or official, or public health agency or
 
17 authority, or person who receives protected health information
 
18 pursuant to sections    -23 and    -31 to    -37, may disclose
 
19 protected health information under this section, if the
 
20 disclosure is pursuant to:
 
21      (1)  A subpoena issued under the authority of a grand jury;
 
22           or
 
23      (2)  An administrative subpoena or summons or judicial
 
24           subpoena or warrant.
 

 
Page 31                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (b)  A subpoena or summons for a disclosure under subsection
 
 2 (a) shall only be issued if the law enforcement agency involved
 
 3 shows that there is probable cause to believe that the
 
 4 information is relevant to a legitimate law enforcement inquiry.
 
 5      (c)  When the proceeding under subsection (a) is concluded,
 
 6 including any derivative matters arising from the matter or need,
 
 7 the law enforcement agency or grand jury shall destroy the
 
 8 protected health information or return all of the protected
 
 9 health information to the person from whom it was obtained.
 
10      (d)  To the extent practicable, and consistent with the
 
11 requirements of due process, a law enforcement agency shall
 
12 redact personally identifying information from protected health
 
13 information prior to the public disclosure of the protected
 
14 information in a judicial or administrative proceeding.
 
15      (e)  Protected health information obtained by a law
 
16 enforcement agency pursuant to this section may only be used for
 
17 purposes of a legitimate law enforcement activity.
 
18      (f)  If protected health information is obtained without
 
19 meeting the requirements of subsection (a), the information that
 
20 is unlawfully obtained shall be excluded from court proceedings
 
21 unless the defendant requests otherwise.
 
22      (g)  A health care provider shall have immunity from any
 
23 action, civil or criminal, related to the disclosure of any
 
24 protected health information pursuant to this section.
 

 
Page 32                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      §   -40  Payment card and electronic payment transaction.
 
 2 (a)  If an individual pays for health care by presenting a debit,
 
 3 credit, or other payment card or account number, or by any other
 
 4 electronic payment means, the person receiving payment may
 
 5 disclose to a person described in subsection (b) only the
 
 6 protected health information about the individual that is
 
 7 necessary for the processing of the payment transaction or the
 
 8 billing or collection of amounts charged to, debited from, or
 
 9 otherwise paid by, the individual using the card, number, or
 
10 other electronic means. 
 
11      (b)  A person who is a debit, credit, or other payment card
 
12 issuer, or is otherwise directly involved in the processing of
 
13 payment transactions involving the cards or other electronic
 
14 payment transactions, or is otherwise directly involved in the
 
15 billing or collection of amounts paid through that means, may use
 
16 or disclose protected health information about an individual that
 
17 has been disclosed in accordance with subsection (a) only when
 
18 necessary for:
 
19      (1)  The settlement, billing, or collection of amounts
 
20           charged to, debited from, or otherwise paid the
 
21           individual using a debit, credit, or other payment card
 
22           or account number, or by other electronic payment
 
23           means;
 

 
Page 33                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (2)  The transfer of receivables, accounts, or interest
 
 2           therein;
 
 3      (3)  The internal audit of the debit, credit, or other
 
 4           payment card account information;
 
 5      (4)  Compliance with federal, state, or county law; or
 
 6      (5)  Compliance with a properly authorized civil, criminal,
 
 7           or regulatory investigation by federal, state, or
 
 8           county authorities as governed by the requirements of
 
 9           this section.
 
10      §   -41  Standards for electronic disclosures.  The office
 
11 shall adopt standards pursuant to chapter 91 for disclosing,
 
12 authorizing, and authenticating, protected health information in
 
13 electronic form consistent with this part.
 
14      § -42  Rights of minors.(a)  In the case of an
 
15 individual who:
 
16      (1)  Is eighteen years of age or older, all rights of the
 
17           individual under this chapter shall be exercised by the
 
18           individual; or
 
19      (2)  Acts alone and can obtain a type of health care without
 
20           violating any applicable federal or state law, and who
 
21           has sought the care, the individual may exercise all
 
22           rights under this chapter with respect to protected
 
23           health information relating to health care.
 

 
Page 34                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (b)  Except as provided in subsection (a)(2), in the case of
 
 2 an individual who is:
 
 3      (1)  Under fourteen years of age, all of the individual's
 
 4           rights under this chapter shall be exercised only
 
 5           through the parent or legal guardian; or
 
 6      (2)  At least fourteen but under eighteen years of age, the
 
 7           rights of inspection and amendment, and the right to
 
 8           authorize use and disclosure of protected health
 
 9           information of the individual shall be exercised by the
 
10           individual, or by the parent or legal guardian of the
 
11           individual.
 
12      §   -43  Deceased individuals.  This chapter shall apply to
 
13 protected health information concerning a deceased individual for
 
14 a period of two years following the death of that individual.  A
 
15 person who is authorized by law or by an instrument recognized
 
16 under law, to act as an executor of the estate of a deceased
 
17 individual, or otherwise to exercise the rights of the deceased
 
18 individual, to the extent authorized, may exercise and discharge
 
19 the rights of the deceased individual under this chapter for a
 
20 period of two years following the death of that individual.
 
21                        PART V.  SANCTIONS
 
22      § -51  Wrongful disclosure of protected health
 
23 information.(a)  It shall be a violation of this chapter for a
 

 
Page 35                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 person to knowingly and intentionally:
 
 2      (1)  Obtain protected health information relating to an
 
 3           individual in violation of this chapter; or
 
 4      (2)  Disclose protected health information to another person
 
 5           in violation of this chapter.
 
 6      (b)  Violation of any provision of this chapter shall be a
 
 7 class C felony; provided that if the offense is committed with
 
 8 the intent to sell, transfer, or use protected health information
 
 9 for commercial advantage, personal gain, or malicious harm, the
 
10 violation shall be a class B felony.
 
11      § -52  Civil actions by individuals.(a)  Any individual
 
12 whose rights under this chapter have been knowingly or
 
13 negligently violated may bring a civil action to recover:
 
14      (1)  Preliminary and equitable relief as the court
 
15           determines to be appropriate; and
 
16      (2)  Compensatory damages or liquidated damages of $5,000,
 
17           whichever is greater, for each violation.
 
18      (b)  In an action brought under this section in which the
 
19 individual has prevailed because of a knowing violation of this
 
20 chapter, the court in addition to any relief awarded under
 
21 subsection (a), may award punitive damages as may be appropriate.
 
22      (c)  For a civil action brought under subsection (a) in
 
23 which the individual has substantially prevailed, the court may
 

 
Page 36                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 assess against the respondent a reasonable attorney's fee and
 
 2 other litigation costs and expenses, including expert fees, that
 
 3 are reasonably incurred.
 
 4      (d)  No action may be commenced under this section more than
 
 5 two years after the date on which the violation was or should
 
 6 reasonably have been discovered.
 
 7      § -53  Prevention and deterrence.  To promote the
 
 8 prevention and deterrence of acts and or omissions which violate
 
 9 laws designed to safeguard the protected health information in a
 
10 manner consistent with this chapter, the director, with any other
 
11 appropriate individual, organization, or agency, may provide
 
12 advice, training, technical assistance, and guidance regarding
 
13 ways to prevent improper disclosure of protected health
 
14 information.
 
15      § -54  Cease and desist orders; civil penalty.(a)  If
 
16 the director has reason to believe that any person has materially
 
17 and substantially violated any provision of this chapter, and
 
18 that a proceeding by the office would be in the interest of the
 
19 public, the director shall open a contested case hearing under
 
20 chapter 91.
 
21      (b)  All remedies, penalties, and proceedings set forth in
 
22 this section shall be invoked solely and exclusively by the
 
23 director.
 

 
Page 37                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (c)  If, after the hearing, the director determines that the
 
 2 person charged has violated any provision of this chapter, the
 
 3 director shall reduce the findings to writing and shall issue and
 
 4 cause to be served upon the person charged with the violation a
 
 5 copy of the findings and an order requiring the person to cease
 
 6 and desist from violating this chapter or otherwise to comply
 
 7 with the requirements of this chapter.  The director may also, at
 
 8 the director's discretion, order any one or more of the
 
 9 following: 
 
10      (1)  In the case of a violation of part II, a civil fine of
 
11           not more than $500 for each act or violation, not to
 
12           exceed $5,000 in the aggregate for multiple violations;
 
13           or
 
14      (2)  In the case of a violation of part III or part IV, a
 
15           civil fine of not more than $10,000 for each act or
 
16           violation, not to exceed $50,000 in the aggregate for
 
17           multiple violations; or
 
18      (3)  If violations have occurred with such frequency as to
 
19           constitute a general business practice, a civil fine of
 
20           not more than $100,000.
 
21      (f)  A person who violates a cease and desist order or a
 
22 compliance order of the director under this section may be
 
23 subject at the discretion of the director, after notice and
 

 
Page 38                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 hearing and upon order of the the director, to a civil fine of
 
 2 not more than $10,000 for each and every act in violation of the
 
 3 cease and desist order.
 
 4      (g)  No order of the director pursuant to this section or
 
 5 order of court to enforce it shall in any way relieve or absolve
 
 6 any person affected by the order from any other liability,
 
 7 penalty, or forfeiture required by law.
 
 8      (h)  No fact found or decision made in a hearing held under
 
 9 this section shall be binding on any party in any subsequent
 
10 civil action to recover damages based upon the same or similar
 
11 facts.
 
12      (i)  Any person aggrieved by an order of the director under
 
13 this section may obtain judicial review of the order in the
 
14 manner provided for by chapter 91.
 
15      (j)  The powers vested in the director by this part shall be
 
16 additional to any other power to enforce penalties or civil
 
17 penalties authorized by law with respect to the methods, acts,
 
18 and practices which violate this chapter.
 
19      §   -55  Injunctive relief.(a)  If the director has reason
 
20 to believe that any person has engaged, is engaging, or is about
 
21 to engage in any activity which makes the person subject to a
 
22 civil monetary penalty under section    -56, the director may
 
23 bring an action in an appropriate circuit court to enjoin the
 

 
Page 39                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 activity, or to enjoin the person from concealing, removing,
 
 2 encumbering, or disposing of assets which may be required in
 
 3 order to pay a civil monetary penalty or seek other appropriate
 
 4 relief.
 
 5      (b)  A principal shall be liable for penalties under section
 
 6    -54 for the actions of the principal's agent acting within the
 
 7 scope of the agency.
 
 8      § -56  Report on use of existing enforcement mechanisms.
 
 9 In addition to the criminal and civil penalties that may be
 
10 applied under this chapter, the director shall prepare and submit
 
11 to the legislature a report regarding the use of existing
 
12 licensure, certification, and regulatory mechanisms for the
 
13 imposition of sanctions or penalties for the wrongful disclosure
 
14 of protected health information.
 
15      § -57  No liability for permissible disclosures.  An
 
16 entity that makes a disclosure of protected health information
 
17 about an individual that is permitted by this chapter shall not
 
18 be liable to the individual for the disclosure under common law.
 
19      §   -58  Relationship to other laws.  (a)  Nothing in this
 
20 chapter shall be construed to preempt or modify any provisions of
 
21 state law concerns a privilege of a witness or person in a court
 
22 of the State.  Receipt of notice pursuant to section    -22 or
 
23 consent to disclose pursuant to section    -23 shall not be
 
24 construed as a waiver of these privileges.
 

 
Page 40                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (b)  Nothing in this chapter shall be construed to preempt,
 
 2 supersede, or modify the operation of any state law that:
 
 3      (1)  Provides for the reporting of vital statistics such as
 
 4           birth or death information;
 
 5      (2)  Requires the reporting of abuse or neglect information
 
 6           about any individual;
 
 7      (3)  Relates to public or mental health and that prevents or
 
 8           otherwise restricts disclosure of information otherwise
 
 9           permissible under this chapter; or
 
10      (4)  Governs a minor's right to access protected health
 
11           information or health care services."
 
12      SECTION 3.  Section 92F-42, Hawaii Revised Statutes, is
 
13 amended to read as follows:
 
14      "§92F-42  Powers and duties of the office of information
 
15 practices.  The director of the office of information practices:
 
16      (1)  Shall, upon request, review and rule on an agency
 
17           denial of access to information or records, or an
 
18           agency's granting of access; provided that any review
 
19           by the office of information practices shall not be a
 
20           contested case under chapter 91 and shall be optional
 
21           and without prejudice to rights of judicial enforcement
 
22           available under this chapter;
 
23      (2)  Upon request by an agency, shall provide and make
 
24           public advisory guidelines, opinions, or other
 

 
Page 41                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           information concerning that agency's functions and
 
 2           responsibilities;
 
 3      (3)  Upon request by any person, may provide advisory
 
 4           opinions or other information regarding that person's
 
 5           rights and the functions and responsibilities of
 
 6           agencies under this chapter;
 
 7      (4)  May conduct inquiries regarding compliance by an agency
 
 8           and investigate possible violations by any agency;
 
 9      (5)  May examine the records of any agency for the purpose
 
10           of paragraph (4) and seek to enforce that power in the
 
11           courts of this State;
 
12      (6)  May recommend disciplinary action to appropriate
 
13           officers of an agency;
 
14      (7)  Shall report annually to the governor and the state
 
15           legislature on the activities and findings of the
 
16           office of information practices, including
 
17           recommendations for legislative changes;
 
18      (8)  Shall receive complaints from and actively solicit the
 
19           comments of the public regarding the implementation of
 
20           this chapter;
 
21      (9)  Shall review the official acts, records, policies, and
 
22           procedures of each agency;
 
23     (10)  Shall assist agencies in complying with the provisions
 
24           of this chapter;
 

 
Page 42                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1     (11)  Shall inform the public of the following rights of an
 
 2           individual and the procedures for exercising them:
 
 3           (A)  The right of access to records pertaining to the
 
 4                individual;
 
 5           (B)  The right to obtain a copy of records pertaining
 
 6                to the individual;
 
 7           (C)  The right to know the purposes for which records
 
 8                pertaining to the individual are kept;
 
 9           (D)  The right to be informed of the uses and
 
10                disclosures of records pertaining to the
 
11                individual;
 
12           (E)  The right to correct or amend records pertaining
 
13                to the individual; and
 
14           (F)  The individual's right to place a statement in a
 
15                record pertaining to that individual;
 
16     (12)  Shall adopt rules that set forth an administrative
 
17           appeals structure which provides for:
 
18           (A)  Agency procedures for processing records requests;
 
19           (B)  A direct appeal from the division maintaining the
 
20                record; and
 
21           (C)  Time limits for action by agencies;
 
22     (13)  Shall adopt rules that set forth the fees and other
 
23           charges that may be imposed for searching, reviewing,
 

 
Page 43                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1           or segregating disclosable records, as well as to
 
 2           provide for a waiver of fees when the public interest
 
 3           would be served;
 
 4     (14)  Shall adopt rules which set forth uniform standards for
 
 5           the records collection practices of agencies;
 
 6     (15)  Shall adopt rules that set forth uniform standards for
 
 7           disclosure of records for research purposes;
 
 8     (16)  Shall have standing to appear in cases where the
 
 9           provisions of this chapter are called into question;
 
10     (17)  Shall adopt, amend, or repeal rules pursuant to chapter
 
11           91 necessary for the purposes of this chapter; [and]
 
12     (18)  Shall take action to oversee compliance with part I of
 
13           chapter 92 by all state and county boards including:
 
14           (A)  Receiving and resolving complaints;
 
15           (B)  Advising all government boards and the public
 
16                about compliance with chapter 92; and
 
17           (C)  Reporting each year to the legislature on all
 
18                complaints received pursuant to section 92-1.5[.];
 
19                and 
 
20     (19)  Shall be responsible for the administration of
 
21           chapter    , including but not limited to complaints
 
22           and appeals."
 
23      SECTION 4.  Section 622-52, Hawaii Revised Statutes, is
 
24 amended to read as follows:
 

 
Page 44                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      "§622-52  Subpoena duces tecum for medical records,
 
 2 compliance.(a)  Whenever a subpoena duces tecum accompanied by
 
 3 a court order obtained as described in subsection (d) is served
 
 4 upon the custodian of medical records or other qualified witness
 
 5 from a health care provider, health plan, public health
 
 6 authority, employer, insurer, law enforcement official,
 
 7 educational, institution or medical facility, in [an] a civil
 
 8 action or other proceeding on a claim for personal injuries in
 
 9 which the custodian or the custodian's employer is neither a
 
10 party to the action or proceeding nor is it alleged that the
 
11 claim arose at the medical facility, and such subpoena requires
 
12 the production in court, or before an officer, board, commission,
 
13 or tribunal, of all or any part of the medical records of a
 
14 patient who is or has been cared for or treated at the medical
 
15 facility, it shall be sufficient compliance therewith if the
 
16 custodian or other qualified witness within five days after
 
17 receipt of such subpoena, delivers by registered or certified
 
18 mail or by messenger a true and correct copy (which may be by any
 
19 method described in rule 1001(4), Hawaii rules of evidence) of
 
20 all the medical records described in such subpoena to the clerk
 
21 of the court or the clerk's deputy authorized to issue it,
 
22 together with the affidavit described in section 622-53.
 
23      (b)  The copy of the medical records shall be separately
 
24 enclosed in an inner envelope or wrapper, sealed, with the title
 

 
Page 45                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 and number of the action, name of the custodian or other
 
 2 qualified witness, and date of the [subpoena] court order clearly
 
 3 inscribed thereon; the sealed envelope or wrapper shall then be
 
 4 enclosed in an outer envelope or wrapper, sealed, and directed as
 
 5 follows:
 
 6      (1)  If the subpoena directs attendance in court, to the
 
 7           clerk of such court or the clerk's deputy authorized to
 
 8           issue it, at the courthouse.
 
 9      (2)  In other cases, to the officer, board, commission, or
 
10           tribunal conducting the hearing, at the place
 
11           designated in the subpoena.
 
12      (c)  The copy of the medical records shall remain sealed and
 
13 shall be opened only at the time of trial, or other hearing, upon
 
14 the direction of the judge, officer, board, commission, or
 
15 tribunal conducting the proceeding, in the presence of all
 
16 parties who have appeared in person or by counsel at such trial,
 
17 or hearing, unless the parties or counsel in the proceeding
 
18 otherwise agree, or unless the sealed envelope or wrapper is
 
19 returned to the custodian or other qualified witness who is to
 
20 appear personally.  Copies of medical records which are not
 
21 introduced in evidence or required as part of the record shall be
 
22 returned by registered or certified mail or by messenger to the
 
23 person or entity from whom received.  If the copies of the
 

 
Page 46                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 medical records are introduced in evidence or are required as
 
 2 part of the record, they shall be returned by registered or
 
 3 certified mail or messenger to the person or entity from whom
 
 4 received as soon as their use is no longer needed, after the
 
 5 trial, or other hearing. 
 
 6      (d)  Any subpoena or discovery request for protected health
 
 7 information under chapter      or other law shall be valid only
 
 8 if accompanied by a court order from a competent jurisdiction.
 
 9      (1)  In considering a request for a court order regarding
 
10           the disclosure of protected health information under
 
11           subsection (a), the court shall issue the order if the
 
12           court determines that without the disclosure of the
 
13           information, the person requesting the order would be
 
14           impaired from establishing a claim or defense.
 
15      (2)  An order issued under paragraph (1) shall:
 
16           (A)  Provide that the protected health information
 
17                involved is subject to court protection;
 
18           (B)  Specify to whom the information may be disclosed;
 
19           (C)  Specify that the information may not otherwise be
 
20                disclosed or used; and 
 
21           (D)  Meet any other requirements that the court
 
22                determines are needed to protected the
 
23                confidentiality of the information.
 

 
Page 47                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1      (e)  This section shall not apply in a case in which the
 
 2 protected health information sought under a discovery request or
 
 3 subpoena:
 
 4      (1)  Is nonidentifiable health information:
 
 5      (2)  Is related to a party to the litigation whose medical
 
 6           condition is at issue; or
 
 7      (3)  Could be disclosed under any of sections    -22,
 
 8              -23,    -31 to    -37,    -39, or    -40.
 
 9      (f)  This section shall not be construed to supersede any
 
10 grounds that may apply under federal or state law for objecting
 
11 to turning over the protected health information.
 
12      (g)  Any provider shall be immune to any action, civil or
 
13 criminal, related to the release of any protected health
 
14 information pursuant to this section."
 
15      SECTION 5.  If any provision of this Act, or the application
 
16 thereof to any person or circumstance is held invalid, the
 
17 invalidity does not affect other provisions or applications of
 
18 this Act which can be given affect without the invalid provision
 
19 or application, and to this end the provisions of this Act are
 
20 severable.
 
21      SECTION 6.  Statutory material to be repealed is bracketed.
 
22 New statutory material is underscored.
 
23      SECTION 7.  This Act shall take effect on July 1, 2000,
 
24 except that all sections in this Act requiring the development
 

 
Page 48                                                    
                                     S.B. NO.           1230
                                                        
                                                        

 
 1 and adoption of rules shall be effective upon its approval.
 
 2 
 
 3                           INTRODUCED BY:  _______________________
 
 4 
 
 5                                           _______________________
 
 6 
 
 7                                           _______________________
 
 8 
 
 9                                           _______________________