Report Title:
Privacy of Health Care Information; General Amendment
Description:
Amends health care privacy law by adding new sections on disclosure for firearm permit and registration, complaint for unauthorized use or disclosure, and proceeding and hearing on complaint; add definitions for "authorization", "collective bargaining", "employee benefit plan:, "employee benefit plan administration", "free-flow zone", "government agency", "labor organization", "legitimate employment operations", and "qualified operations"; amendment law to reflect new language.
|
THE SENATE |
S.B. NO. |
1329 |
|
TWENTY-FIRST LEGISLATURE, 2001 |
||
|
STATE OF HAWAII |
||
|
|
A BILL FOR AN ACT
RELATING TO PRIVACY OF HEALTH CARE.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
SECTION 1. Chapter 323C, Hawaii Revised Statutes, is amended by adding two new sections to part V, to be appropriately designated and to read as follows:
"§323C- Complaint for unauthorized use or disclosure.
(a) An individual aggrieved by an alleged wrongful use or disclosure of protected health information by a health care facility may file with the department of health a complaint, in writing, stating the name and address of the health care facility alleged to have committed the wrongful use or disclosure, and shall set forth the particulars thereof and other information as may be required by the department.
(b) An employee aggrieved by an alleged wrongful use or disclosure of protected health information by an employer or a labor organization may file with the department of labor and industrial relations a complaint, in writing, stating the name and address of the employer or labor organization alleged to have committed the wrongful use or disclosure, and shall set forth the particulars thereof and other information as may be required by the department.
(c) An individual aggrieved by an alleged wrongful use or disclosure of protected health information by a person or entity other than a health care facility, employer, or labor organization may file with the department of commerce and consumer affairs a complaint, in writing, stating the name and address of the person or entity alleged to have committed the wrongful use or disclosure, and shall set forth the particulars thereof and other information as may be required by the department.
(d) No complaint may be commenced after the expiration of thirty days after the alleged wrongful use or disclosure, or after the individual learns of the wrongful use or disclosure.
§323C- Proceeding and hearing on complaint. (a) After the filing of any complaint, the applicable department shall serve a copy of the complaint upon the person or entity charged.
Service may be by delivery or by mail to the person or entity charged. The person or entity charged shall file an answer to the complaint.
(b) A hearing on the complaint shall be held by the department in conformance with chapter 91.
(c) If the applicable department finds, after a hearing, that the person or entity charged has wrongfully used or disclosed protected health information in violation of this chapter, the department may order:
(1) For any violation of this chapter, payment of a civil penalty of not more than $500 for each and every act or violation but not to exceed $5,000 in the aggregate for multiple violations;
(2) For a wilful violation of this chapter, payment of a civil penalty of not more than $25,000 for each and every act or violation but not to exceed $100,000 in the aggregate for multiple violations; and
(3) For wilful violations of this chapter that have occurred with such frequency as to constitute a general business practice, a civil penalty of $100,000.
(d) All civil penalties collected under this section shall be deposited into the general fund."
SECTION 2. Section 323C-1, Hawaii Revised Statutes, is amended as follows:
1. By adding nine new definitions to be appropriately inserted and to read:
""Authorization" means a consent to the disclosure or use of protected health information that complies with the requirements of section 329C-23.
"Collective bargaining obligations" means the rights and obligations of employers, employees, and their certified bargaining representatives under the Labor-Management Relations Act, title 29 United States Code sections 141 et seq., the Railway Labor Act, title 46 United States Code sections 151 et seq., and the Hawaii Employment Relations Act, chapter 377.
"Employee benefit plan" means a pension plan or an employee welfare benefit plan as defined under the Employee Retirement Income Security Act, title 29 United States Code sections 1001 et seq. and the Pension and Retirement Systems, chapter 88.
"Employee benefit plan administration" means the rights and obligations of plan fiduciaries under the Employee Retirement Income Security Act, title 29 United States Code sections 1001 et seq. and the Pension and Retirement Systems, chapter 88.
"Free-flow zone" means an area of interaction within which an entity or person, or an employee or agent of the entity or person, may use or disclose protected health information for a qualified operation without authorization or other consent from the individual whose protected health information is being used or disclosed.
"Government agency" means each federal, state, or county board, commission, department, or officer authorized by law to adopt rules, enforce statutes and rules, or adjudicate contested cases.
"Labor organization" means the organization certified as the collective bargaining representative for a group of employees, in accordance with applicable federal or state laws.
"Legitimate employment operations" means those activities conducted by or on behalf of an employer for the purpose of:
(1) Complying with federal, state, or local statutes, regulations, ordinances, rules, agency procedures and guidelines, or case 1aw;
(2) Administering plans and programs involving equal employment opportunity, affirmative action, employee benefits, or workplace safety and health; and
(3) Carrying out the management functions of an employer in accordance with the employer’s established policies and procedures or contractual obligations or both under an individual employment contract or collective bargaining agreement.
"Qualified operations" means:
(1) Qualified hea1th care operations;
(2) Legitimate employment operations;
(3) Collective bargaining obligations; and
(4) Employee benefit plan administration."
2. By amending the definitions of "entity", "nonidentifiable health information", and "protected health information" to read:
""Entity" means a health care provider, health care data organization, health plan, health oversight agency, public health authority, employer, labor organization, insurer, health researcher, law enforcement official, or educational institution, except as otherwise defined for purposes of a particular section only.
"Nonidentifiable health information" means any information that [meets all of the following criteria:] would otherwise be protected health information except that [the]:
(1) The information in and of itself does not reveal the identity of the individual whose health or health care is the subject of the information; and [will not be used in any way that would]
(2) The format in which the information is used or disclosed is such that it is not reasonably foreseeable that unauthorized persons or entities will be able to identify the subjects of the information [or would create protected health information].
"Protected health information" means any information, identifiable to an individual, including demographic information, whether or not recorded in any form or medium that relates directly or indirectly to the past, present, or future:
(1) Physical or mental health or condition of a person, including tissue and genetic information;
(2) Provision of health care to an individual; or
(3) Payment for the provision of health care to an individual[.] if the information is accompanied by information covered under paragraph (1) or (2)."
3. By repealing the definition of "law enforcement inquiry":
["Law enforcement inquiry" means a lawful investigation conducted by an appropriate government agency or official inquiring into a violation of, or failure to comply with, any civil or administrative statute or any regulation, rule, or order issued pursuant to such a statute. It does not include a lawful criminal investigation or prosecution conducted by the county prosecutors or the department of the attorney general."]
SECTION 3. Section 323C-11, Hawaii Revised Statutes, is amended to read as follows:
[[]§323C-11[]] Inspection and copying of protected health information. (a) For the purposes of this section only, "entity" means a health care provider, health plan, employer, health care data organization, insurer, or educational institution.
(b) At the request in writing of an individual and except as provided in subsection (c), an entity shall permit an individual who is the subject of protected health information or the individual's designee, to inspect and copy protected health information concerning the individual, including records created under section 323C-12, that the entity maintains. The entity shall adopt appropriate procedures to be followed for the inspection or copying and may require an individual to pay reasonable costs associated with the inspection or copying.
(c) Unless ordered by a court of competent jurisdiction, an entity is not required to permit the inspection or copying of protected health information if any of the following conditions are met:
(1) The entity determines that the disclosure of the information could reasonably be expected to endanger the life or physical safety of, or cause substantial mental harm to, the individual who is the subject of the record;
(2) The information identifies, or could reasonably lead to the identification of, a person who provided information under a promise of confidentiality concerning the individual who is the subject of the information unless the confidential source can be protected by redaction or other similar means;
(3) The information is protected from discovery as provided in section 624-25.5; [or]
(4) The information was collected for or during a clinical trial monitored by an institutional review board, the trial is not complete, and the researcher reasonably believes that access would harm the conduct of the trial[.]; or
(5) The information is relevant to a court proceeding, agency proceeding, arbitration, mediation, or contractual grievance procedure involving the individual and the entity from whom the information is sought. In such circumstances, access to the information for purposes of inspection and copying shall be determined by the applicable court, agency, arbitrator, mediator, or parties to the contractual grievance procedure.
(d) If an entity denies a request for inspection or copying pursuant to subsection (c), the entity shall inform the individual in writing of:
(1) The reasons for the denial of the request for inspection or copying;
(2) Any procedures for further review of the denial; and
(3) The individual's right to file with the entity a concise statement setting forth the request for inspection or copying.
(e) If an individual has filed a statement under subsection (d)(3), the entity in any subsequent disclosure of the portion of the information requested under subsection (b) shall include:
(1) A copy of the individual's statement; and
(2) A concise statement of the reasons for denying the request for inspection or copying.
(f) An entity shall permit the inspection and copying under subsection (b) of any reasonably segregable portion of a record after deletion of any portion that is exempt under subsection (c).
(g) An entity shall comply with or deny, in accordance with subsection (d), a request for inspection or copying of protected health information under this section not later than thirty days after the date on which the entity or agent receives the request.
(h) An agent of an entity shall not be required to provide for the inspection and copying of protected health information, except where:
(1) The protected health information is retained by the agent; and
(2) The agent has received in writing a request from [the entity involved] its principal to fulfill the requirements of this section, at which time this information shall be provided to the individual[.] in accordance with the instructions of the principal. The agent shall comply with subsection (g) with respect to any such information.
[(i) The entity shall afford at least one level of appeal by parties not involved in the original decision.
(j)] (i) This section shall not be construed to require that an entity described in subsection (a) conduct a formal, informal, or other hearing or proceeding concerning a request for inspection or copying of protected health information.
[(k)] (j) If an entity denies an individual's request for copying pursuant to subsection (c), or if an individual so requests, the entity shall permit the inspection or copying of the requested protected health information by the individual's designated representative, upon presentation of a proper authorization signed by the individual, unless it is patently clear that doing so would defeat the purpose for which the entity originally denied the individual's request for inspection and copying."
SECTION 4. Section 323C-13, Hawaii Revised Statutes, is amended by amending subsections (a) and (b) to read as follows:
"(a) For the purposes of this section only, "entity" means [[a] health care provider, health care data organization, health plan, health oversight agency, public health authority, employer, insurer, health researcher, or educational institution.] entities within the free-flow zone.
(b) An entity shall prominently post or provide the current notice of the entity's confidentiality practices. The notice shall be printed in clear type and composed in plain language. This notice shall be given pursuant to the requirements of section 323C-22. For the purpose of informing each individual of the importance of the notice and educating the individual about the individual's rights under this chapter, the notice shall contain the following language, placed prominently at the beginning:
IMPORTANT: THIS NOTICE DEALS WITH THE SHARING OF YOUR PROTECTED HEALTH INFORMATION [FROM YOUR MEDICAL RECORDS]. PLEASE READ IT CAREFULLY. This notice describes your confidentiality rights as they relate to your protected health information [from your medical records] and explains the circumstances under which the information [from your medical records] may be shared with others. This information in this notice may also [applies] apply to others [covered under your health plan], such as your spouse or children. If you do not understand the terms of this notice, please ask for further explanation.
In addition, as shall be appropriate to the size and nature of the entity, the notice shall include the following information [about]:
(1) A description of an individual's rights with respect to protected health information which shall contain at a minimum, the following:
(A) An individual's right to inspect and copy their record; and
[(B) An individual's right to request that a health care provider append information to their medical record; and
(C) An] (B) With regard to health plans, an individual's right to receive this notice by each health plan upon enrollment, [annually,] upon request, and when a health plan's confidentiality practices are [substantially amended.] materially modified.
(2) The [uses and disclosures of protected health information authorized under this chapter including information about:
(A) Payment;
(B) Conducting quality assurance activities or outcomes assessments;
(C) Reviewing the competence or qualifications of health care professionals;
(D) Performing accreditation, licensing, or credentialing activities;
(E) Analyzing health plan claims or health care records data;
(F) Evaluating provider clinical performance;
(G) Carrying out utilization management; or
(H) Conducting or arranged for auditing services in accordance with statute, rule or accreditation requirements;] manner in which protected health information is used and disclosed by the qualified operation;
(3) The right of the individual to limit disclosure of protected health information by deciding not to utilize any health [insurance or other third party payment as payment for the service,] care service, benefit, or privilege provided by the qualified operation, as set forth in section 323C-21(c);
(4) The procedures for giving consent to disclosures of protected health information to entities in the free-flow zone and for revoking the consent to disclose;
(5) The description of procedures established by the entity within the free-flow zone for the exercise of the individual's rights required under this chapter; and
(6) The right to obtain a copy of the notice of confidentiality practices required under this chapter."
SECTION 5. Section 323C-21, Hawaii Revised Statutes, is amended as follows:
1. By amending subsections (b), (c), and (d) to read:
"(b) [For the purpose of treatment or qualified health care operations, an] An entity within the free-flow zone may only use or disclose protected health information if the use or disclosure is properly noticed pursuant to sections 323C-13 and 323C-22. [For all other uses and disclosures, an] An entity outside of the free-flow zone may only use or disclose protected health information, if the use or disclosure is properly consented to pursuant to section 323C-23. [Disclosure to agents of an entity shall be considered as a disclosure within an entity.]
(c) If an individual does not want protected health information released pursuant to [[]subsection[]] (b)[,]:
(1) As to qualified health care operations, the individual shall advise the provider prior to the delivery of services that the relevant protected health information shall not be disclosed pursuant to subsection (b), and the individual shall pay the health care provider directly for health care services. A health plan may decline to cover particular health care services if an individual has refused to allow the release of protected health care information pertaining to those particular health care services. Protected health information related to health care services paid for directly by the individual shall not be disclosed without consent[.]; and
(2) As to all other qualified operations, which may provide a benefit or privilege to the individual, the individual shall advise the applicable entity, prior to receipt of any benefit or privilege, that the relevant protected health information shall not be disclosed pursuant to subsection (b). The entity may decline to provide the benefit or privilege if receipt of the relevant protected health information is a requirement for receipt of the benefit or privilege.
(d) Disclosure to an employee or agent of an entity shall be considered a disclosure within that entity. An employee or agent who receives protected health information [from an entity] shall be subject to all rules of disclosure and safeguard requirements [under this part.] applicable to the employee's employer or the agent's principal."
2. By amending subsections (g) and (h) to read:
"(g) An entity may disclose protected health information to [an employee or agent of the entity] a person or other entity who is not otherwise authorized, by statute or written authorization, to receive such information if:
(1) The disclosure is for purposes of creating nonidentifiable information[, if the]; and
(2) The entity prohibits the [employee or agent of the] person or other entity from using or disclosing the protected health information for purposes other than the sole purpose of creating nonidentifiable information, as specified by the entity.
(h) Any individual or entity outside the free-flow zone who manipulates or uses nonidentifiable health information to identify an individual, shall be deemed to have disclosed protected health information. The disclosure or transmission of a unique patient identifier by any individual or entity outside the free-flow zone shall be deemed to be a disclosure of protected health information."
SECTION 6. Section 323C-22, Hawaii Revised Statutes, is amended by amending subsections (a) and (b) to read as follows:
"(a) The notice required by section 323C-13 shall be:
(1) Given by each health plan upon enrollment, [annually,] upon request, and when confidentiality practices are substantially amended, to each individual who is eligible to receive care under the health plan, or to the individual's parent or guardian if the individual is a minor or incompetent; and
(2) Posted in a conspicuous place or provided by an entity other than a health plan.
(b) For each [new] enrollment [or re-enrollment] by an individual in a health plan, on or after July 1, [2000,] 2001, a health plan shall make reasonable efforts to obtain the individual's signature on the notice of confidentiality practices. The notice to be signed shall state that the individual is signing on behalf of the individual and all others covered by the individual's health plan. If the plan is unable to obtain the aforementioned signature, the plan shall note the reason for the failure to obtain [said] the signature. The lack of a signed notice of confidentiality practices shall not justify a denial of coverage of a claim, nor shall it limit a health plan's access to information necessary for treatment and qualified health care operations; provided that the individual may elect to keep the records from being disclosed by paying for the subject health care services, as provided under section 323C-21(c)."
SECTION 7. Section 323C-23, Hawaii Revised Statutes, is amended as follows:
1. By amending subsections (a), (b), and (c) to read:
"(a) An entity outside the free-flow zone may disclose protected health information [for purposes other than those noticed under section 323C-22,] pursuant to a separate written authorization to disclose executed by the individual who is the subject of the information. The authorization must meet the requirements of subsection (b).
(b) To be valid, an authorization shall be separate from any other notice or authorization required by this part, shall be either in writing, dated, and signed by the individual, or in electronic form, dated, and authenticated by the individual using a unique identifier, shall not have been revoked, and shall [do the following:
(1) Identify the person or entity authorized to disclose protected health information;
(2) Identify the individual who is the subject of the protected health information;
(3) Describe the nature of and the time span of the protected health information to be disclosed;
(4) Identify the person to whom the information is to be disclosed;
(5) Describe the purpose of the disclosure;
(6) State that it is subject to revocation by the individual and indicate that the consent to disclose is valid until revocation by the individual; and
(7) Include the date at which the consent to disclose ends.] be on a form issued by the office of information practices.
(c) An individual may revoke in writing an authorization under this section at any time. [An authorization obtained by a health plan under this section is deemed to be revoked at the time of the cancellation or nonrenewal of enrollment in the health plan.] An entity that discloses protected health information pursuant to an authorization that has been revoked under this subsection shall not be subject to any liability or penalty under this part for the disclosure if that entity acted in good faith and had no actual or constructive notice of the revocation."
2. By amending subsection (f) to read:
"(f) Each entity outside the free-flow zone collecting or storing protected health information shall maintain for seven years, as part of an individual's protected health information, a record of each authorization by the individual and any revocation of authorization by the individual."
SECTION 8. Section 323C-34, Hawaii Revised Statutes, is amended to read as follows:
"[[]§323C-34[]] Emergency circumstances. Any person who creates or receives protected health information under this chapter may use or disclose protected health information in emergency circumstances when the use or disclosure is necessary [to]:
(1) To protect the health or safety of the individual who is the subject of the information from serious, imminent harm[.]; or
(2) Because the individual who is the subject of the information poses a direct threat to the health or safety of others.
A disclosure made in the good faith belief that the use or disclosure was necessary to protect the health or safety of an individual from serious, imminent harm, or to protect the health or safety of others from a direct threat, shall not be a violation of this chapter."
SECTION 9. Section 323C-38, Hawaii Revised Statutes, is amended by amending the title and subsection (a) to read as follows:
"[[]323C-38[]] Disclosure in [civil,] judicial [and administrative procedures.] proceedings. (a) Protected health information may be disclosed [pursuant to a discovery request or subpoena] in a civil action brought in a federal or state court [or a request or subpoena related to a state administrative proceeding, only if the] if:
(1) The information is relevant to an issue in the action; and
(2) The disclosure is made pursuant to a court order as provided for in subsection (b) or to a written authorization under section 323C-23."
SECTION 10. Section 323C-39, Hawaii Revised Statutes, is amended to read as follows:
"[[]§323C-39[]] Disclosure [for civil or administrative law enforcement purposes.] to government agencies. (a) [For the purposes of this [section] only, "entity" means a health care provider, health plan, health oversight agency, employer, insurer, and educational institution.
(b) Except as to disclosures to a health oversight agency, which are governed by section 323C-35, an entity or person who receives protected health information pursuant to sections 323C-23 and 323C-31 through 323C-37, may disclose protected health information under this section, if the disclosure is pursuant to:
(1) An administrative subpoena or summons or judicial subpoena;
(2) Consent in accordance with section 323C-23; or
(3) A court order.
(c) A subpoena or summons for a disclosure under subsection (b)(1) shall only be issued if the civil or administrative law enforcement agency involved shows that there is probable cause to believe that the information is relevant to a legitimate law enforcement inquiry.
(d) When the matter or need for which protected health information was disclosed to a civil or administrative law enforcement agency under subsection (b) has concluded, including any derivative matters arising from the matter or need, the civil or administrative law enforcement agency shall either destroy the protected health information, or return all of the protected health information to the person from whom it was obtained.
(e) To the extent practicable, and consistent with the requirements of due process, a civil or administrative law enforcement agency shall redact personally identifying information from protected health information prior to the public disclosure of the protected information in a judicial or administrative proceeding.
(f) Protected health information obtained by a civil or administrative law enforcement agency pursuant to this section may only be used for purposes of a legitimate law enforcement activity.
(g) If protected health information is obtained without meeting the requirements of subsection (b)(1), (2), or (3), any information that is unlawfully obtained shall be excluded from court proceedings unless the defendant requests otherwise.] Any person or entity may disclose protected health information to a government agency if:
(1) The disclosure of the information to the government agency is for the purpose of complying with federal, state, or local statutes, regulations, ordinances, rules, agency procedures and guidelines, or case law: or
(2) The information is requested by the government agency in accordance with its statutory authority and applicable procedures.
(b) No agency shall disclose any protected health information contained in its records to any person, or to another agency, except:
(1) Pursuant to a written authorization by the individual to whom the protected health information pertains;
(2) To those officers, employees, and agents of the agency which maintains the information who have a need of the information in the performance of their duties;
(3) For routine agency functions that are consistent with the purpose for which the protected health information was collected by the agency;
(4) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States or the State of Hawaii for a civil or criminal law enforcement activity if the activity is authorized by law, and if the requesting agency or instrumentality has made a written request to the agency which maintains the information specifying the particular portion desired and the law enforcement activity for which the record is sought;
(5) Pursuant to a lawfully issued subpoena; or
(6) Pursuant to an order of a court of competent jurisdiction.
(c) The disclosure of protected health information pursuant to this section shall not be a violation of this chapter."
SECTION 11. Section 323C-53, Hawaii Revised Statutes, is amended to read as follows:
"[[]§323C-53[] Cease and desist orders; civil penalty.] Judicial review; enforcement of department order. (a) [A] Any person aggrieved by the order of the applicable department shall be entitled to judicial review as provided by section 91-14.
(b) If a person or entity who is found to have wrongfully used or disclosed protected health information fails or neglects to comply with the final order of the applicable department and no appeal has been taken as provided by this section, the applicable department may apply to the circuit court of the judicial circuit in which the person or entity resides or transacts business for a judgment to enforce the final order and for any other appropriate relief. In any proceeding to enforce the final order, the following are sufficient to establish proof of the final order:
(1) Service of the notice of hearing;
(2) A certified copy of the final order; and
(3) Service of the final order.
The judgment shall have the same effect, and all proceedings in relation thereto shall thereafter be the same, as though the judgment had been rendered in an action duly heard and determined by the court.
(c) If judgment is entered against the person or entity who is found to have wrongfully used or disclosed protected health information, the court shall issue and cause to be served upon [a] the person[,] or entity who has violated any provision of this chapter, a copy of the court's findings and an order requiring the person to cease and desist from violating this chapter, or to otherwise comply with the requirements of this chapter. [The court may also order any one or more of the following:
(1) For any violation of this chapter, payment of a civil penalty of not more than $500 for each and every act or violation but not to exceed $5,000 in the aggregate for multiple violations;
(2) For a knowing violation of this chapter, payment of a civil penalty of not more than $25,000 for each and every act or violation but not to exceed $100,000 in the aggregate for multiple violations; and
(3) For violations of this chapter that have occurred with such frequency as to constitute a general business practice, a civil penalty of $100,000.
(b)] (d) Any person who violates a cease and desist order or injunction issued under this section may be subject to a civil penalty of not more than $10,000 for each and every act in violation of the cease and desist order.
[(c) No order or injunction issued under this section shall in any way relieve or absolve any person affected by the order from any other liability, penalty, or forfeiture required by law.
(d)] (e) Any civil penalties collected under this section shall be deposited into the general fund."
SECTION 12. Section 323C-54, Hawaii Revised Statutes, is amended to read as follows:
"[[]§323C-54[]] Prevention and deterrence. To promote the prevention and deterrence of acts or omissions that violate laws designed to safeguard the protected health information in a manner consistent with this chapter, the director of the office of information practices, [with any other appropriate individual, organization, or agency, may provide advice, training, technical assistance, and guidance regarding ways to prevent improper disclosure of protected health information.] the director of the department of health, the director of the department of labor and industrial relations, and the director of the department of commerce and consumer affairs, or their respective designees, shall coordinate the adoption of rules to ensure consistent interpretation, application, and enforcement of this chapter by all departments."
SECTION 13. Section 323-12, Hawaii Revised Statutes, is repealed.
["[§323C-12] Additions to protected health information. A health care provider is the owner of the medical records in the health care provider's possession that were created by the health care provider in treating a patient. An individual or the individual's authorized representative may request in writing that a health care provider that generated certain health care information append additional information to the record in order to improve the accuracy or completeness of the information; provided that appending this information does not erase or obliterate any of the original information. A health care provider shall do one of the following:
(1) Append the information as requested; or
(2) Notify the individual that the request has been denied, the reason for the denial, and that the individual may file a statement of reasonable length explaining the correctness or relevance of existing information or as to the addition of new information. The statement or copies shall be appended to the medical record and at all times accompany that part of the information in contention."]
SECTION 14. Section 323C-51, Hawaii Revised Statutes, is repealed.
["
(b) A person who knowingly or intentionally sells, transfers, or uses protected health information for commercial advantage, personal gain, or malicious harm, in violation of this chapter shall be guilty of a class B felony."]
SECTION 15. Section 323C-52, Hawaii Revised Statutes, is repealed.
["[§323C-52] Civil actions by individuals. (a) Any individual whose rights under this chapter have been violated may bring a civil action against the person or entity responsible for the violation.
(b) In any civil action brought under this section, if the court finds a violation of an individual's rights under this chapter, the court may award:
(1) Injunctive relief, including enjoining a person or entity from engaging in a practice that violates this chapter;
(2) Equitable relief;
(3) Compensatory damages for injuries suffered by the individual. Injuries compensable under this section may include, but are not limited to, personal injury including emotional distress, reputational injury, injury to property, and consequential damages;
(4) Punitive damages, as appropriate;
(5) Costs of the action;
(6) Attorneys' fees, as appropriate; and
(7) Any other relief the court finds appropriate.
(c) No action may be commenced under this section after the time period stated in section 657-7."]
SECTION 16. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.
SECTION 17. This Act shall take effect on July 1, 2001.
|
INTRODUCED BY: |
_____________________________ |