REPORT TITLE:
Health Care Information


DESCRIPTION:
Clarifies the general rules regarding use and disclosure of
protected health care information.  Effectuates this bill on June
30, 2000.  Effectuates Act 87, Session Laws of Hawaii 1999 on
July 1, 2000, with the exception of criminal and civil penalties
of sections 323C-51, 323C-52, and 323C-53, which shall take
effect on January 1, 2001. (SB2254 HD2)

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                        2254
THE SENATE                              S.B. NO.           S.D. 1
TWENTIETH LEGISLATURE, 2000                                H.D. 2
STATE OF HAWAII                                            
                                                             
________________________________________________________________
________________________________________________________________


                   A  BILL  FOR  AN  ACT
RELATING TO PRIVACY OF HEALTH CARE INFORMATION.



BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 1      SECTION 1.  Section 323C-1, Hawaii Revised Statutes, is
 
 2 amended to read as follows:
 
 3      "[[]§323C-1[]]  Definitions.  As used in this chapter,
 
 4 except as otherwise specifically provided:
 
 5      "Accrediting body" means a committee, organization, or
 
 6 institution that has been authorized by law or is recognized by a
 
 7 health care regulating authority as an accrediting entity or any
 
 8 other entity that has been similarly authorized or recognized by
 
 9 law to perform specific accreditation, licensing, or
 
10 credentialing activities.
 
11      "Agent" means a person who represents and acts for another
 
12 under a contract or relationship of agency, or whose function is
 
13 to bring about, modify, affect, accept performance of, or
 
14 terminate contractual obligations between the principal and a
 
15 third person, including a contractor.
 
16      "Commissioner" means the insurance commissioner.
 
17      "Disclose" means to release, transfer, provide access to,
 
18 share, or otherwise divulge protected health information to any
 
19 person other than the individual who is the subject of the
 
20 information.  The term includes the initial disclosure and any 
 

 
Page 2                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1 subsequent redisclosures of protected health information.
 
 2      "Educational institution" means an institution or place for
 
 3 instruction or education including any public or private
 
 4 elementary school, secondary school, vocational school,
 
 5 correspondence school, business school, junior college, teachers
 
 6 college, college, normal school, professional school, university,
 
 7 or scientific or technical institution, or other institution
 
 8 furnishing education for children and adults.
 
 9      "Employer" means any individual or type of organization,
 
10 including any partnership, association, trust, estate, joint
 
11 stock company, insurance company, or corporation, whether
 
12 domestic or foreign, a debtor in possession or receiver or
 
13 trustee in bankruptcy, or a legal representative of a deceased
 
14 person, who has one or more regular individuals in his or her
 
15 employment.
 
16      "Employment" means services performed for wages under any
 
17 contract of hire, written or oral, expressed or implied, with an
 
18 employer.
 
19      "Entity" means a health care provider, health care data
 
20 organization, health plan, health oversight agency, public health
 
21 authority, employer, insurer, health researcher, law enforcement
 
22 official, or educational institution, except as otherwise defined
 
23 for purposes of a particular section only.
 

 
Page 3                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1      "Health care" means:
 
 2      (1)  Preventive, diagnostic, therapeutic, rehabilitative,
 
 3           palliative, or maintenance services:
 
 4           (A)  With respect to the physical or mental condition
 
 5                of an individual; or
 
 6           (B)  Affecting the structure or function of the human
 
 7                body or any part of the human body, including the
 
 8                banking of blood, sperm, organs, or any other
 
 9                tissue; or
 
10      (2)  Any sale or dispensing of a drug, device, equipment, or
 
11           other health care-related item to an individual, or for
 
12           the use of an individual pursuant to a prescription or
 
13           order by a health care provider.
 
14      "Health care data organization" means an entity that engages
 
15 primarily in the business of collecting, analyzing, and
 
16 disseminating identifiable and nonidentifiable patient
 
17 information.  A health care data organization is not a health
 
18 care provider, an insurer, a health researcher, or a health
 
19 oversight agency.
 
20      "Health care provider" means a person who, with respect to
 
21 any protected health information, receives, creates, uses,
 
22 maintains, or discloses the protected health information while
 
23 acting in whole or in part in the capacity of:
 

 
Page 4                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1      (1)  A person who is licensed, certified, registered, or
 
 2           otherwise authorized by federal or state law to provide
 
 3           an item or service that constitutes health care in the
 
 4           ordinary course of business, or practice of a
 
 5           profession;
 
 6      (2)  A federal, state, or employer-sponsored program that
 
 7           directly provides items or services that constitute
 
 8           health care to beneficiaries; or
 
 9      (3)  An officer, employee, or agent of a person described in
 
10           paragraph (1) or (2).
 
11      "Health oversight agency" means a person who, with respect
 
12 to any protected health information, receives, creates, uses,
 
13 maintains, or discloses the information while acting in whole or
 
14 in part in the capacity of:
 
15      (1)  A person who performs or oversees the performance of an
 
16           assessment, evaluation, determination, or
 
17           investigation, relating to the licensing,
 
18           accreditation, or credentialing of health care
 
19           providers; or
 
20      (2)  A person who:
 
21           (A)  Performs or oversees the performance of an audit,
 
22                assessment, evaluation, determination, or
 
23                investigation relating to the effectiveness of,
 

 
Page 5                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1                compliance with, or applicability of, legal,
 
 2                fiscal, medical, or scientific standards or
 
 3                aspects of performance related to the delivery of,
 
 4                or payment for, health care; and
 
 5           (B)  Is a public agency, acting on behalf of a public
 
 6                agency, acting pursuant to a requirement of a
 
 7                public agency, or carrying out activities under a
 
 8                federal or state law governing the assessment,
 
 9                evaluation, determination, investigation, or
 
10                prosecution for violations of paragraph (1).
 
11      "Health plan" means any health insurance plan, including any
 
12 hospital or medical service plan, dental or other health service
 
13 plan or health maintenance organization plan, provider-sponsored
 
14 organization, or other program providing or arranging for the
 
15 provision of health benefits, whether or not funded through the
 
16 purchase of insurance.
 
17      "Health researcher" means a person, or an officer, employee
 
18 or independent contractor of a person, who receives protected
 
19 health information as part of a systematic investigation,
 
20 testing, or evaluation designed to develop or contribute to
 
21 generalized scientific and clinical knowledge.
 
22      "Individual's designated representative" means a person who
 
23 is authorized by law (based on grounds other than the minority of
 

 
Page 6                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1 an individual), or by an instrument recognized under law, to act
 
 2 as an agent, attorney, guardian, proxy, or other legal
 
 3 representative of a protected individual.  The term includes a
 
 4 health care power of attorney.
 
 5      "Institutional review board" means a research committee
 
 6 established and operating in accord with Title 45 Code of Federal
 
 7 Regulations 46 sections 107, 108, 109, and 115.
 
 8      "Insurer" means any person regulated under chapter 432D,
 
 9 article 1 of chapter 432, any group that has purchased a group
 
10 insurance policy issued by a person regulated under chapter 432D,
 
11 and any person regulated under article 10A of chapter 431, other
 
12 than a life insurer, disability income insurer, or long-term care
 
13 insurer.
 
14      "Law enforcement inquiry" means a lawful investigation
 
15 conducted by an appropriate government agency or official
 
16 inquiring into a violation of, or failure to comply with, any
 
17 civil or administrative statute or any regulation, rule, or order
 
18 issued pursuant to such a statute.  It does not include a lawful
 
19 criminal investigation or prosecution conducted by the county
 
20 prosecutors or the department of the attorney general.
 
21      "Nonidentifiable health information" means any information
 
22 that would otherwise be protected health information except that
 
23 the information does not reveal the identity of the individual
 

 
Page 7                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1 whose health or health care is the subject of the information and
 
 2 [there is no reasonable basis to believe that the information
 
 3 could be used, either alone or with other information that is, or
 
 4 should reasonably be, known to be available to recipients of the
 
 5 information,] with respect to which individual identifiers have
 
 6 been encrypted or encoded such that the identity of the
 
 7 individual cannot readily be determined [to reveal the identity
 
 8 of that individual].
 
 9      "Office of information practices" shall be as defined by
 
10 chapter 92F.
 
11      "Person" means a government, governmental subdivision,
 
12 agency or authority, corporation, company, association, firm,
 
13 partnership, insurer, estate, trust, joint venture, individual,
 
14 individual representative, and any other legal entity.
 
15      "Protected health information" means any information created
 
16 or received by a health care provider, health plan, or health
 
17 care data organization, identifiable to an individual, including
 
18 demographic information, whether or not recorded in any form or
 
19 medium that relates directly or indirectly to the past, present,
 
20 or future:
 
21      (1)  Physical or mental health or condition of a person,
 
22           including tissue and genetic information;
 
23      (2)  Provision of health care to an individual; or
 

 
Page 8                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1      (3)  Payment for the provision of health care to an
 
 2           individual.
 
 3      "Public health authority" means the department of health.
 
 4      "Qualified health care operations" means:
 
 5      (1)  Only those activities conducted by or on behalf of a
 
 6           health plan or health care provider for the purpose of
 
 7           carrying out the management functions of a health care
 
 8           provider or health plan, or implementing the terms of a
 
 9           contract for health plan benefits as follows:
 
10           (A)  Payment, which means the activities undertaken by
 
11                a health plan or provider which are reasonably
 
12                necessary to determine responsibility for
 
13                coverage, services, and the actual payment for
 
14                services, if any;
 
15           (B)  Conducting quality assurance activities or
 
16                outcomes assessments;
 
17           (C)  Reviewing the competence or qualifications of
 
18                health care professionals;
 
19           (D)  Performing accreditation, licensing, or
 
20                credentialing activities;
 
21           (E)  Analyzing health plan claims or health care
 
22                records data;
 
23           (F)  Evaluating provider clinical performance;
 

 
Page 9                                                     2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1           (G)  Carrying out utilization management; or
 
 2           (H)  Conducting or arranging for auditing services in
 
 3                accordance with statute, rule, or accreditation
 
 4                requirements;
 
 5      (2)  A qualified health care operation shall:
 
 6           (A)  Be an operation which cannot be carried on with
 
 7                reasonable effectiveness and efficiency without
 
 8                identifiable patient information;
 
 9           (B)  Be limited to only that protected health
 
10                information collected under the terms of the
 
11                contract for health plan benefits and without
 
12                which the operation cannot be carried on with
 
13                reasonable effectiveness and efficiency;
 
14           (C)  Be limited to the minimum amount of protected
 
15                health information, including the minimum number
 
16                of records and the minimum number of documents
 
17                within each patient's record, necessary to carry
 
18                on the operation with reasonable effectiveness and
 
19                efficiency; and
 
20           (D)  Limit the handling and examination of protected
 
21                health information to those persons who are
 
22                reasonably well qualified, by training,
 
23                credentials, or experience, to conduct the phase
 

 
Page 10                                                    2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1                of the operation in which they are involved.
 
 2      "Surrogate" means a person, other than an individual's
 
 3 designated representative or relative, who is authorized to make
 
 4 a health-care decision for the individual.
 
 5      "Treatment" means the provision of health care by, or the
 
 6 coordination of health care among, health care providers, or the
 
 7 referral of a patient from one provider to another, or
 
 8 coordination of health care or other services among health care
 
 9 providers and third parties authorized by the health plan or the
 
10 plan member.
 
11      "Unique patient identifier" means a number or alpha-numeric
 
12 string assigned to an individual, which can be or is used to
 
13 identify an individual's protected health information.
 
14      "Writing" means a written form that is either paper- or
 
15 computer-based, and includes electronic signatures. [L 1999, c
 
16 87, pt of §2]
 
17      SECTION 2.  Section 323C-21, Hawaii Revised Statutes, is
 
18 amended as follows:
 
19      1.   By amending subsections (a) and (b) to read:
 
20      "(a)  An entity shall not use or disclose protected health
 
21 information except as authorized under this part and under part
 
22 IV.  Use or d[D]isclosure of health information in the form of
 
23 non-identifiable health information shall not be construed as a
 

 
Page 11                                                    2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1 use or disclosure of protected health information.
 
 2      (b)  For the purpose of treatment or qualified health care
 
 3 operations, an entity may only use or disclose protected health
 
 4 information [within the entity] if the use or disclosure is
 
 5 properly noticed pursuant to sections 323C-13 and 323C-22.  For
 
 6 all other uses and disclosures, an entity may only use or
 
 7 disclose protected health information, if the use or disclosure
 
 8 is properly consented to pursuant to section 323C-23.
 
 9 [Disclosure to agents of an entity described in subsection (a)
 
10 shall be considered as a disclosure within an entity.]"
 
11      2.   By amending subsection (h) to read:
 
12      "(h)  Any individual or entity who manipulates or uses
 
13 nonidentifiable health information to identify an individual,
 
14 shall be deemed to have disclosed protected health information.
 
15 The disclosure or transmission of a unique patient identifier,
 
16 together with the decoding key, shall be deemed to be a
 
17 disclosure of protected health information."
 
18      SECTION 3.  Section 323C-37, Hawaii Revised Statutes, is
 
19 amended by amending subsection (c) to read as follows:
 
20      "(c)  A health researcher who receives protected health
 
21 information shall not disclose or use the protected health
 
22 information for any purposes other than the health research
 

 
 
 
Page 12                                                    2254
                                     S.B. NO.           S.D. 1
                                                        H.D. 2
                                                        

 
 1 project for which the information was obtained, except that the
 
 2 health research may disclose the information pursuant to section
 
 3 323C-35(a)."
 
 4      SECTION 4.  Act 87, Session Laws of Hawaii 1999, is amended
 
 5 by amending section 10 to read as follows: 
 
 6      "SECTION 10.  This Act shall take effect on July 1, 2000;
 
 7 provided that there shall be no liability, either criminal or
 
 8 civil, under sections   -51,   -52,  and   -53 of section 2 for
 
 9 any actions taken or not taken in violation of this chapter prior
 
10 to January 1, 2001, and provided that sections 5, 6, and 7 shall
 
11 take effect upon its approval."
 
12      SECTION 5.  Statutory material to be repealed is bracketed.
 
13 New statutory material is underscored.
 
14      SECTION 6.  This Act shall take effect on June 30, 2000.