Report Title:

Privacy of Medical Records

 

Description:

Relating to medical and health information privacy.

 

HOUSE OF REPRESENTATIVES

H.B. NO.

1604

TWENTY-FIRST LEGISLATURE, 2001

  

STATE OF HAWAII

  

 

A BILL FOR AN ACT

 

relating to medical and health information privacy.

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

SECTION 1. The purpose of Act 87, Session Laws of Hawaii (SLH) 1999, was to implement the affirmative duty of the legislature in article I, section 6, of the Hawaii State Constitution. If Act 87, SLH 1999, is repealed, the federal Health Insurance Portability and Accountability Act (HIPAA) regulations will cover certain protected health information only when obtained, used, or disclosed by a health plan, a health care clearinghouse, and a health care provider who transmits any health information in electronic form in connection with a transaction covered by the regulations. However, because of limitations imposed by Congress on HIPAA, the regulations will not cover many other transactions that the department of health and human services believe should be covered.

This Act will fulfill the legislative mandate in Act 87, SLH 1999, by providing reasonable protection for the privacy of identifiable health information that are not protected by HIPAA regulations. If the HIPAA regulations are severely curtailed or repealed, this Act will become the principal vehicle for insuring health information privacy as required by Act 87, SLH 1999.

This Act provides a statutory cause of action for damages for individuals whose identifiable health information is obtained, used, or disclosed in violation of the Act. However, there are significant and important defenses, that will protect medical records against unauthorized use, acquisition, and disclosure in virtually all cases where such protection is warranted. Protection is afforded to use, acquisitions, and disclosures of medical records that:

(1) Are not negligently, recklessly, or intentionally made;

(2) Are made with the express or implied consent of the individual;

(3) Are required or specifically permitted by law;

(4) Are made by a health care provider in the good faith belief based upon the provider's professional judgment that the use or disclosure is in the best interest of the individual;

(5) Would not cause foreseeable harm or detriment to an average person;

(6) Has caused no harm or detriment to the individual; and

(7) Benefits the public interest.

This last exception is capable of being sensibly interpreted by the courts to protect disclosures of protected health information when the public interest or the benefit to the person whose information is disclosed outweighs the risk of harm or detriment to the individual.

Finally, both consent and implied consent are defined in a manner to give protection to disclosures that are made after information reasonably calculated to inform the individual is provided and consented to, or where consent is reasonably to be implied from the circumstances.

SECTION 2. The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:

"Chapter

privacy of medical and health records

§ -1 General rules regarding use and disclosure. (a) No person or other legal entity shall negligently, recklessly, or intentionally acquire, use, or disclose any individual's personal medical and health information, identifiable to the individual, without the individual's express or implied consent.

(b) An individual shall be deemed to have implied consent to the use or disclosure of the person's personal medical and health information when:

(1) Reasonably necessary to process or determine a service, benefit, right, or privilege applied for by the individual or by a person acting lawfully on one's behalf; and

(2) The individual has voluntarily disclosed personal medical and health information to another and the information has thereafter been obtained, used, or disclosed in such manner and to such persons as a reasonably prudent person, viewing the individual's disclosure, would believe the individual would have permitted.

(c) An individual shall be deemed to have expressly consented to the use or disclosure of identifiable personal medical and health information upon submission of a voluntarily signed statement containing:

(1) Information reasonably calculated to inform the individual of the purpose for which such information will or may be used; and

(2) The persons or classes of persons who may obtain, use, or disclose such information.

(d) Subsection (a) shall not apply where the acquisition, use, or disclosure of personal medical and health information is:

(1) Required or specifically permitted by law;

(2) Made by a health care provider in the good faith belief based upon the providers' professional judgment that the use or disclosure is in the best interest of the individual;

(3) Not foreseeably harmful or detrimental to an average person;

(4) Not harmful or detrimental to the individual once the information has been disclosed; and

(5) Beneficial to the public interest.

(e) Violation of this section shall give rise to a cause of action for damages for serious harm or detriment. Punitive damages may also be awarded in an appropriate case.

§ -2 Applicability. This chapter shall only apply to the obtaining, use, or disclosure of identifiable medical and health information not covered by regulations pursuant to the federal Health Insurance Portability and Accountability Act, 45 CFR subtitle A, subchapter C, parts 160-164."

SECTION 3. This Act shall take effect on July 1, 2001.

INTRODUCED BY:

_____________________________