HB2532 HD1.DOC

SECTION 1. The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:

"CHAPTER

PRIVACY OF HEALTH CARE INFORMATION

§ -1 Definitions. As used in this chapter, except as otherwise specifically provided:

"Educational institution" means an institution or place for instruction or education including any public or private elementary school, secondary school, vocational school, correspondence school, business school, junior college, teachers college, college, normal school, professional school, university, or scientific or technical institution, or other institution furnishing education for children or adults.

"Employer" means any individual or type of organization, including any partnership, association, trust, estate, joint stock company, insurance company, or corporation, whether domestic or foreign, a debtor in possession or receiver or trustee in bankruptcy, or a legal representative of a deceased person, that has one or more individuals in its regular employment.

"Health care" means:

(1) Preventive, diagnostic, therapeutic, rehabilitative, palliative, or maintenance services:

(A) With respect to the physical or mental condition of an individual; or

(B) Affecting the structure or function of the human body or any part of the human body, including the banking of blood, sperm, organs, or any other tissue; or

(2) Any sale or dispensing of a drug, device, equipment, or other health care-related item to an individual, or for the use of an individual pursuant to a prescription or order by a health care provider.

"Health care provider" means a person who receives, creates, uses, maintains, or discloses protected health information while acting in whole or in part in the capacity of:

(1) A person who is licensed, certified, registered, or otherwise authorized by federal or state law to provide an item or service that constitutes health care in the ordinary course of business, or practice of a profession;

(2) A federal, state, or employer-sponsored program that directly provides items or services that constitute health care to beneficiaries; or

(3) An officer, employee, or agent of a person described in paragraph (1) or (2).

"Health oversight agency" means a person who receives, creates, uses, maintains, or discloses protected health information while acting in whole or in part in the capacity of:

(1) A person who performs or oversees the performance of an assessment, evaluation, determination, or investigation, relating to the licensing, accreditation, or credentialing of health care providers; or

(2) A person who:

(A) Performs or oversees the performance of an audit, assessment, evaluation, determination, or investigation relating to the effectiveness of, compliance with, or applicability of, legal, fiscal, medical, or scientific standards or aspects of performance related to the delivery of, or payment for, health care; and

(B) Is a public agency, acting on behalf of a public agency, acting pursuant to a requirement of a public agency, or carrying out activities under a federal or state law governing the assessment, evaluation, determination, investigation, or prosecution for violations of paragraph (1).

"Health plan" means any health insurance plan, including any hospital or medical service plan, dental or other health service plan or health maintenance organization plan, provider-sponsored organization, or other program providing or arranging for the provision of health benefits, whether or not funded through the purchase of insurance.

"Insurer" means any person regulated under chapter 432D, article 1 of chapter 432, any group that has purchased a group insurance policy issued by a person regulated under chapter 432D, and any person regulated under article 10A of chapter 431, other than a life insurer, disability income insurer, or long-term care insurer.

"Law enforcement inquiry" means a lawful investigation conducted by an appropriate government agency or official inquiring into a violation of, or failure to comply with, any civil or administrative statute or any regulation, rule, or order issued pursuant to such a statute. It does not include a lawful criminal investigation or prosecution conducted by county prosecutors or the department of the attorney general.

"Nonidentifiable health information" means any information that would otherwise be protected health information except that the information in and of itself does not reveal the identity of the individual whose health or health care is the subject of the information and that will not be used in any way that would identify the subjects of the information or would create protected health information.

"Protected health information" means any information, identifiable to an individual, including demographic information, whether or not recorded in any form or medium, that relates directly or indirectly to the past, present, or future:

(1) Physical or mental health or condition of an individual, including tissue and genetic information;

(2) Provision of health care to an individual; or

(3) Payment for the provision of health care to an individual.

§ -2 Disclosure in civil, judicial, and administrative procedures. (a) Protected health information may be disclosed pursuant to a discovery request or subpoena in a civil action brought in a state court or a request or subpoena related to a state administrative proceeding, only if the disclosure is made pursuant to a court order as provided for in subsection (b).

(b) A court order issued under this section shall:

(1) Provide that the protected health information involved is subject to court protection;

(2) Specify to whom the protected health information may be disclosed;

(3) Specify that the protected health information shall not otherwise be disclosed or used; and

(4) Meet any other requirements that the court determines are needed to protect the confidentiality of the protected health information.

(c) This section shall not apply in a case in which the protected health information sought under the discovery request, subpoena, or request is:

(1) Nonidentifiable health information; or

(2) Related to a party to the proceeding whose medical condition is at issue.

(d) The release of any protected health information under this section shall not violate this chapter.

§ -3 Disclosure for civil or administrative law enforcement purposes. (a) For the purposes of this section only, "entity" means a health care provider, health plan, health oversight agency, employer, insurer, or educational institution.

(b) An entity or person who receives protected health information may disclose the protected health information if the disclosure is pursuant to:

(1) An administrative subpoena or summons or judicial subpoena;

(2) Consent of the individual who is the subject of the protected health information; or

(3) A court order.

(c) A subpoena or summons for a disclosure under subsection (b)(1) shall only be issued if the civil or administrative law enforcement agency involved shows that there is probable cause to believe that the protected health information is relevant to a legitimate law enforcement inquiry.

(d) When the matter or need for which protected health information was disclosed to a civil or administrative law enforcement agency under subsection (b) has concluded, including any derivative matters arising from the matter or need, the civil or administrative law enforcement agency shall either destroy the protected health information, or return all of the protected health information to the person from whom it was obtained.

(e) To the extent practicable, and consistent with the requirements of due process, a civil or administrative law enforcement agency shall redact personally identifying information from protected health information prior to the public disclosure of the protected health information in a judicial or administrative proceeding.

(f) Protected health information obtained by a civil or administrative law enforcement agency pursuant to this section shall only be used for purposes of a legitimate law enforcement activity.

(g) If protected health information is obtained without meeting the requirements of subsection (b), any protected health information that is unlawfully obtained shall be excluded from court or administrative proceedings unless the party whose health information was obtained requests otherwise."

SECTION 2. If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

SECTION 3. This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date.

SECTION 4. This Act shall take effect on July 1, 2050.

HOUSE OF REPRESENTATIVES	H.B. NO.	2532
TWENTY-SEVENTH LEGISLATURE, 2014		H.D. 1
STATE OF HAWAII