WA State bill & "Uniform Health Care Info. Act"

[Peter Marshall <techdiff@ix.netcom.com>]

>HOUSE BILL 2032 (2/12/99)

>{+ NEW SECTION. +}  Sec. 4.  HEALTH INFORMATION PRIVACY.

     (1) Each
>health carrier shall develop and implement policies and procedures
>governing the collection, use, and disclosure of health information.
>These policies and procedures shall include methods for enrollees to
>access information and amend incorrect information, for enrollees to
>restrict the disclosure of sensitive information, and for enrollees to
>obtain information about the carrier's health information policies.

In
>addition, these policies and procedures shall include methods for
>carrier oversight and enforcement of information policies, for carrier
>storage and disposal of health information, and for carrier conformance
>to state and federal laws governing the collection, use, and disclosure
>of personally identifiable health information.  Each carrier shall
>provide a summary notice of its health information policies to
>enrollees, including the enrollee's right to restrict the collection,
>use, and disclosure of health information.


      (2) Except as otherwise required by statute or rule, a health
>carrier is, and all persons acting at the direction of or on behalf of
>a carrier or in receipt of an enrollee's personally identifiable health
>information are, prohibited from collecting, using, or disclosing
>personally identifiable health information unless authorized in writing
>by the person who is the subject of the information.  At a minimum,
>such authorization shall be valid for a limited time and purpose; shall
>be specific as to purpose and type of information to be collected,
>used, or disclosed; and shall identify the persons who will be
>receiving the information.
>     (3) Any person who is the subject of an unauthorized collection,
>use, or disclosure of personally identifiable health information is
>entitled to the remedies provided under RCW 9.73.060 governing
>violations of the right to privacy.
>     (4) The commissioner shall adopt rules to implement this section
>and shall take into consideration health information privacy standards
>recommended by the national association of insurance commissioners and
>other related professional organizations.

------


CHAPTER  70.02   MEDICAL RECORDS--HEALTH CARE INFORMATION
ACCESS AND DISCLOSURE



 70.02.005       Findings.
 70.02.010       Definitions.
 70.02.020       Disclosure by health care provider.
 70.02.030       Patient authorization of disclosure.
 70.02.040       Patient's revocation of authorization for
                      disclosure.
 70.02.050       Disclosure without patient's authorization.
 70.02.060       Discovery request or compulsory process.
 70.02.070       Certification of record.
 70.02.080       Patient's examination and copying--Requirements.
 70.02.090       Patient's request--Denial of examination and
                      copying.
 70.02.100       Correction or amendment of record.
 70.02.110       Correction or amendment or statement of
                      disagreement--Procedure.
 70.02.120       Notice of information practices--Display
                      conspicuously.
 70.02.130       Consent by others--Health care representatives.
 70.02.140       Representative of deceased patient.
 70.02.150       Security safeguards.
 70.02.160       Retention of record.
 70.02.170       Civil remedies.
 70.02.900       Conflicting laws.
 70.02.901       Application and construction--1991 c 335.

RCW  70.02.005  Findings.


  The legislature finds that:
  (1) Health care information is personal and sensitive
information that if improperly used or released may do
significant harm to a patient's interests in privacy, health
care, or other interests.
  (2) Patients need access to their own health care
information as a matter of fairness to enable them to make
informed decisions about their health care and correct
inaccurate or incomplete information about themselves.
  (3) In order to retain the full trust and confidence of
patients, health care providers have an interest in assuring
that health care information is not improperly disclosed and
in having clear and certain rules for the disclosure of
health care information.
  (4) Persons other than health care providers obtain, use,
and disclose health record information in many different
contexts and for many different purposes.  It is the public
policy of this state that a patient's interest in the proper
use and disclosure of the patient's health care information
survives even when the information is held by persons other
than health care providers.
  (5) The movement of patients and their health care
information across state lines, access to and exchange of
health care information from automated data banks, and the
emergence of multistate health care providers creates a
compelling need for uniform law, rules, and procedures
governing the use and disclosure of health care information.

RCW  70.02.010  Definitions.

  As used in this chapter, unless the context otherwise
requires:
  (1) "Audit" means an assessment, evaluation,
determination, or investigation of a health care provider by
a person not employed by or affiliated with the provider to
determine compliance with:
  (a) Statutory, regulatory, fiscal, medical, or scientific
standards;
  (b) A private or public program of payments to a health
care provider; or
  (c) Requirements for licensing, accreditation, or
certification.
  (2) "Directory information" means information disclosing
the presence, and for the purpose of identification, the
name, residence, sex, and the general health condition of a
particular patient who is a patient in a health care
facility or who is currently receiving emergency health care
in a health care facility.
  (3) "General health condition" means the patient's health
status described in terms of "critical," "poor," "fair,"
"good," "excellent," or terms denoting similar conditions.
  (4) "Health care" means any care, service, or procedure
provided by a health care provider:
  (a) To diagnose, treat, or maintain a patient's physical
or mental condition; or
  (b) That affects the structure or any function of the
human body.
  (5) "Health care facility" means a hospital, clinic,
nursing home, laboratory, office, or similar place where a
health care provider provides health care to patients.
  (6) "Health care information" means any information,
whether oral or recorded in any form or medium, that
identifies or can readily be associated with the identity of
a patient and directly relates to the patient's health care.
The term includes any record of disclosures of health care
information.
  (7) "Health care provider" means a person who is licensed,
certified, registered, or otherwise authorized by the law of
this state to provide health care in the ordinary course of
business or practice of a profession.
  (8) "Institutional review board" means any board,
committee, or other group formally designated by an
institution, or authorized under federal or state law, to
review, approve the initiation of, or conduct periodic
review of research programs to assure the protection of the
rights and welfare of human research subjects.
  (9) "Maintain," as related to health care information,
means to hold, possess, preserve, retain, store, or control
that information.
  (10) "Patient" means an individual who receives or has
received health care.  The term includes a deceased
individual who has received health care.
  (11) "Person" means an individual, corporation, business
trust, estate, trust, partnership, association, joint
venture, government, governmental subdivision or agency, or
any other legal or commercial entity.
  (12) "Reasonable fee" means the charges for duplicating or
searching the record, but shall not exceed sixty-five cents
per page for the first thirty pages and fifty cents per page
for all other pages.  In addition, a clerical fee for
searching and handling may be charged not to exceed fifteen
dollars.  These amounts shall be adjusted biennially in
accordance with changes in the consumer price index, all
consumers, for Seattle-Tacoma metropolitan statistical area
as determined by the secretary of health.  However, where
editing of records by a health care provider is required by
statute and is done by the provider personally, the fee may
be the usual and customary charge for a basic office visit.
  (13) "Third-party payor" means an insurer regulated under
 Title 48  RCW authorized to transact business in this state
or other jurisdiction, including a health care service
contractor, and health maintenance organization; or an
employee welfare benefit plan; or a state or federal health
benefit program.



RCW  70.02.020  Disclosure by health care provider.

  Except as authorized in RCW  70.02.050 , a health care
provider, an individual who assists a health care provider
in the delivery of health care, or an agent and employee of
a health care provider may not disclose health care
information about a patient to any other person without the
patient's written authorization.  A disclosure made under a
patient's written authorization must conform to the
authorization.
  Health care providers or facilities shall chart all
disclosures, except to third-party payors, of health care
information, such chartings to become part of the health
care information.

RCW  70.02.030  Patient authorization of disclosure.

  (1) A patient may authorize a health care provider to
disclose the patient's health care information.  A health
care provider shall honor an authorization and, if
requested, provide a copy of the recorded health care
information unless the health care provider denies the
patient access to health care information under RCW
 70.02.090.
  (2) A health care provider may charge a reasonable fee for
providing the health care information and is not required to
honor an authorization until the fee is paid.
  (3) To be valid, a disclosure authorization to a health
care provider shall:
  (a) Be in writing, dated, and signed by the patient;
  (b) Identify the nature of the information to be
disclosed;
  (c) Identify the name, address, and institutional
affiliation of the person to whom the information is to be
disclosed;
  (d) Except for third-party payors, identify the provider
who is to make the disclosure; and
  (e) Identify the patient.
  (4) Except as provided by this chapter, the signing of an
authorization by a patient is not a waiver of any rights a
patient has under other statutes, the rules of evidence, or
common law.
  (5) A health care provider shall retain each authorization
or revocation in conjunction with any health care
information from which disclosures are made.  This
requirement shall not apply to disclosures to third-party
payors.
  (6) Except for authorizations given pursuant to an
agreement with a treatment or monitoring program or
disciplinary authority under chapter  18.71  or  18.130  RCW or
to provide information to third-party payors, an
authorization may not permit the release of health care
information relating to future health care that the patient
receives more than ninety days after the authorization was
signed.  Patients shall be advised of the period of validity
of their authorization on the disclosure authorization form.
If the authorization does not contain an expiration date, it
expires ninety days after it is signed.

RCW  70.02.040  Patient's revocation of authorization for
disclosure.
  A patient may revoke in writing a disclosure authorization
to a health care provider at any time unless disclosure is
required to effectuate payments for health care that has
been provided or other substantial action has been taken in
reliance on the authorization.  A patient may not maintain
an action against the health care provider for disclosures
made in good-faith reliance on an authorization if the
health care provider had no actual notice of the revocation
of the authorization.

RCW  70.02.050  Disclosure without patient's authorization.

  (1) A health care provider may disclose health care
information about a patient without the patient's
authorization to the extent a recipient needs to know the
information, if the disclosure is:
  (a) To a person who the provider reasonably believes is
providing health care to the patient;
  (b) To any other person who requires health care
information for health care education, or to provide
planning, quality assurance, peer review, or administrative,
legal, financial, or actuarial services to the health care
provider; or for assisting the health care provider in the
delivery of health care and the health care provider
reasonably believes that the person:
  (i) Will not use or disclose the health care information
for any other purpose; and
  (ii) Will take appropriate steps to protect the health
care information;
  (c) To any other health care provider reasonably believed
to have previously provided health care to the patient, to
the extent necessary to provide health care to the patient,
unless the patient has instructed the health care provider
in writing not to make the disclosure;
  (d) To any person if the health care provider reasonably
believes that disclosure will avoid or minimize an imminent
danger to the health or safety of the patient or any other
individual, however there is no obligation under this
chapter on the part of the provider to so disclose;
  (e) Oral, and made to immediate family members of the
patient, or any other individual with whom the patient is
known to have a close personal relationship, if made in
accordance with good medical or other professional practice,
unless the patient has instructed the health care provider
in writing not to make the disclosure;
  (f) To a health care provider who is the successor in
interest to the health care provider maintaining the health
care information;
  (g) For use in a research project that an institutional
review board has determined:
  (i) Is of sufficient importance to outweigh the intrusion
into the privacy of the patient that would result from the
disclosure;
  (ii) Is impracticable without the use or disclosure of the
health care information in individually identifiable form;
  (iii) Contains reasonable safeguards to protect the
information from redisclosure;
  (iv) Contains reasonable safeguards to protect against
identifying, directly or indirectly, any patient in any
report of the research project; and
  (v) Contains procedures to remove or destroy at the
earliest opportunity, consistent with the purposes of the
project, information that would enable the patient to be
identified, unless an institutional review board authorizes
retention of identifying information for purposes of another
research project;
  (h) To a person who obtains information for purposes of an
audit, if that person agrees in writing to:
  (i) Remove or destroy, at the earliest opportunity
consistent with the purpose of the audit, information that
would enable the patient to be identified; and
  (ii) Not to disclose the information further, except to
accomplish the audit or report unlawful or improper conduct
involving fraud in payment for health care by a health care
provider or patient, or other unlawful conduct by the health
care provider;
  (i) To an official of a penal or other custodial
institution in which the patient is detained;
  (j) To provide directory information, unless the patient
has instructed the health care provider not to make the
disclosure;
  (k) In the case of a hospital or health care provider to
provide, in cases reported by fire, police, sheriff, or
other public authority, name, residence, sex, age,
occupation, condition, diagnosis, or extent and location of
injuries as determined by a physician, and whether the
patient was conscious when admitted.
  (2) A health care provider shall disclose health care
information about a patient without the patient's
authorization if the disclosure is:
  (a) To federal, state, or local public health authorities,
to the extent the health care provider is required by law to
report health care information; when needed to determine
compliance with state or federal licensure, certification or
registration rules or laws; or when needed to protect the
public health;
  (b) To federal, state, or local law enforcement
authorities to the extent the health care provider is
required by law;
  (c) To county coroners and medical examiners for the
investigations of deaths;
  (d) Pursuant to compulsory process in accordance with RCW
 70.02.060.
  (3) All state or local agencies obtaining patient health
care information pursuant to this section shall adopt rules
establishing their record acquisition, retention, and
security policies that are consistent with this chapter.

RCW  70.02.060  Discovery request or compulsory process.

  (1) Before service of a discovery request or compulsory
process on a health care provider for health care
information, an attorney shall provide advance notice to the
health care provider and the patient or the patient's
attorney involved through service of process or first class
mail, indicating the health care provider from whom the
information is sought, what health care information is
sought, and the date by which a protective order must be
obtained to prevent the health care provider from complying.
Such date shall give the patient and the health care
provider adequate time to seek a protective order, but in no
event be less than fourteen days since the date of service
or delivery to the patient and the health care provider of
the foregoing.  Thereafter the request for discovery or
compulsory process shall be served on the health care
provider.
  (2) Without the written consent of the patient, the health
care provider may not disclose the health care information
sought under subsection (1) of this section if the requestor
has not complied with the requirements of subsection (1) of
this section.  In the absence of a protective order issued
by a court of competent jurisdiction forbidding compliance,
the health care provider shall disclose the information in
accordance with this chapter.  In the case of compliance,
the request for discovery or compulsory process shall be
made a part of the patient record.
  (3) Production of health care information under this
section, in and of itself, does not constitute a waiver of
any privilege, objection, or defense existing under other
law or rule of evidence or procedure.

RCW  70.02.070  Certification of record.

  Upon the request of the person requesting the record, the
health care provider or facility shall certify the record
furnished and may charge for such certification in
accordance with RCW  36.18.016 (5).  No record need be
certified until the fee is paid.  The certification shall be
affixed to the record and disclose:
  (1) The identity of the patient;
  (2) The kind of health care information involved;
  (3) The identity of the person to whom the information is
being furnished;
  (4) The identity of the health care provider or facility
furnishing the information;
  (5) The number of pages of the health care information;
  (6) The date on which the health care information is
furnished; and
  (7) That the certification is to fulfill and meet the
requirements of this section.

RCW  70.02.080  Patient's examination and copying--
Requirements.

  (1) Upon receipt of a written request from a patient to
examine or copy all or part of the patient's recorded health
care information, a health care provider, as promptly as
required under the circumstances, but no later than fifteen
working days after receiving the request shall:
  (a) Make the information available for examination during
regular business hours and provide a copy, if requested, to
the patient;
  (b) Inform the patient if the information does not exist
or cannot be found;
  (c) If the health care provider does not maintain a record
of the information, inform the patient and provide the name
and address, if known, of the health care provider who
maintains the record;
  (d) If the information is in use or unusual circumstances
have delayed handling the request, inform the patient and
specify in writing the reasons for the delay and the
earliest date, not later than twenty-one working days after
receiving the request, when the information will be
available for examination or copying or when the request
will be otherwise disposed of; or
  (e) Deny the request, in whole or in part, under RCW
      70.02.090  and inform the patient.
  (2) Upon request, the health care provider shall provide
an explanation of any code or abbreviation used in the
health care information.  If a record of the particular
health care information requested is not maintained by the
health care provider in the requested form, the health care
provider is not required to create a new record or
reformulate an existing record to make the health care
information available in the requested form.  The health
care provider may charge a reasonable fee for providing the
health care information and is not required to permit
examination or copying until the fee is paid.

RCW  70.02.090  Patient's request--Denial of examination
and copying.

  (1) Subject to any conflicting requirement in the public
disclosure act, chapter  42.17  RCW, a health care provider
may deny access to health care information by a patient if
the health care provider reasonably concludes that:
  (a) Knowledge of the health care information would be
injurious to the health of the patient;
  (b) Knowledge of the health care information could
reasonably be expected to lead to the patient's
identification of an individual who provided the information
in confidence and under circumstances in which
confidentiality was appropriate;
  (c) Knowledge of the health care information could
reasonably be expected to cause danger to the life or safety
of any individual;
  (d) The health care information was compiled and is used
solely for litigation, quality assurance, peer review, or
administrative purposes; or
  (e) Access to the health care information is otherwise
prohibited by law.
  (2) If a health care provider denies a request for
examination and copying under this section, the provider, to
the extent possible, shall segregate health care information
for which access has been denied under subsection (1) of
this section from information for which access cannot be
denied and permit the patient to examine or copy the
disclosable information.
  (3) If a health care provider denies a patient's request
for examination and copying, in whole or in part, under
subsection (1) (a) or (c) of this section, the provider
shall permit examination and copying of the record by
another health care provider, selected by the patient, who
is licensed, certified, registered, or otherwise authorized
under the laws of this state to treat the patient for the
same condition as the health care provider denying the
request.  The health care provider denying the request shall
inform the patient of the patient's right to select another
health care provider under this subsection.  The patient
shall be responsible for arranging for compensation of the
other health care provider so selected.

RCW  70.02.100  Correction or amendment of record.

  (1) For purposes of accuracy or completeness, a patient
may request in writing that a health care provider correct
or amend its record of the patient's health care information
to which a patient has access under RCW  70.02.080.
  (2) As promptly as required under the circumstances, but
no later than ten days after receiving a request from a
patient to correct or amend its record of the patient's
health care information, the health care provider shall:
  (a) Make the requested correction or amendment and inform
the patient of the action;
  (b) Inform the patient if the record no longer exists or
cannot be found;
  (c) If the health care provider does not maintain the
record, inform the patient and provide the patient with the
name and address, if known, of the person who maintains the
record;
  (d) If the record is in use or unusual circumstances have
delayed the handling of the correction or amendment request,
inform the patient and specify in writing, the earliest
date, not later than twenty-one days after receiving the
request, when the correction or amendment will be made or
when the request will otherwise be disposed of; or
  (e) Inform the patient in writing of the provider's
refusal to correct or amend the record as requested and the
patient's right to add a statement of disagreement.

RCW  70.02.110  Correction or amendment or statement of
disagreement--Procedure.

  (1) In making a correction or amendment, the health care
provider shall:
  (a) Add the amending information as a part of the health
record; and
  (b) Mark the challenged entries as corrected or amended
entries and indicate the place in the record where the
corrected or amended information is located, in a manner
practicable under the circumstances.
  (2) If the health care provider maintaining the record of
the patient's health care information refuses to make the
patient's proposed correction or amendment, the provider
shall:
  (a) Permit the patient to file as a part of the record of
the patient's health care information a concise statement of
the correction or amendment requested and the reasons
therefor; and
  (b) Mark the challenged entry to indicate that the patient
claims the entry is inaccurate or incomplete and indicate
the place in the record where the statement of disagreement
is located, in a manner practicable under the circumstances.

RCW  70.02.120  Notice of information practices--Display
conspicuously.

  (1) A health care provider who provides health care at a
health care facility that the provider operates and who
maintains a record of a patient's health care information
shall create a "notice of information practices" that
contains substantially the following:

                           NOTICE

  "We keep a record of the health care services we provide
  you.  You may ask us to see and copy that record.  You
  may also ask us to correct that record.  We will not
  disclose your record to others unless you direct us to
  do so or unless the law authorizes or compels us to do
  so.  You may see your record or get more information
  about it at . . . . . ."

  (2) The health care provider shall place a copy of the
notice of information practices in a conspicuous place in
the health care facility, on a consent form or with a
billing or other notice provided to the patient.


RCW  70.02.130  Consent by others--Health care
representatives.

  (1) A person authorized to consent to health care for
another may exercise the rights of that person under this
chapter to the extent necessary to effectuate the terms or
purposes of the grant of authority.  If the patient is a
minor and is authorized to consent to health care without
parental consent under federal and state law, only the minor
may exercise the rights of a patient under this chapter as
to information pertaining to health care to which the minor
lawfully consented.  In cases where parental consent is
required, a health care provider may rely, without incurring
any civil or criminal liability for such reliance, on the
representation of a parent that he or she is authorized to
consent to health care for the minor patient regardless of
whether:
  (a) The parents are married, unmarried, or separated at
the time of the representation;
  (b) The consenting parent is, or is not, a custodial
parent of the minor;
  (c) The giving of consent by a parent is, or is not, full
performance of any agreement between the parents, or of any
order or decree in any action entered pursuant to chapter
 26.09  RCW.
  (2) A person authorized to act for a patient shall act in
good faith to represent the best interests of the patient.

RCW  70.02.140  Representative of deceased patient.

  A personal representative of a deceased patient may
exercise all of the deceased patient's rights under this
chapter.  If there is no personal representative, or upon
discharge of the personal representative, a deceased
patient's rights under this chapter may be exercised by
persons who would have been authorized to make health care
decisions for the deceased patient when the patient was
living under RCW  7.70.065.

RCW  70.02.150  Security safeguards.

  A health care provider shall effect reasonable safeguards
for the security of all health care information it
maintains.

RCW  70.02.160  Retention of record.

  A health care provider shall maintain a record of existing
health care information for at least one year following
receipt of an authorization to disclose that health care
information under RCW  70.02.040 , and during the pendency of
a request for examination and copying under RCW  70.02.080  or
a request for correction or amendment under RCW  70.02.100.

RCW  70.02.170  Civil remedies.

  (1) A person who has complied with this chapter may
maintain an action for the relief provided in this section
against a health care provider or facility who has not
complied with this chapter.
  (2) The court may order the health care provider or other
person to comply with this chapter.  Such relief may include
actual damages, but shall not include consequential or
incidental damages.  The court shall award reasonable
attorneys' fees and all other expenses reasonably incurred
to the prevailing party.
  (3) Any action under this chapter is barred unless the
action is commenced within two years after the cause of
action is discovered.
  (4) A violation of this chapter shall not be deemed a
violation of the consumer protection act, chapter  19.86  RCW.

RCW  70.02.900  Conflicting laws.

  (1) This chapter does not restrict a health care provider
from complying with obligations imposed by federal or state
health care payment programs or federal or state law.
  (2) This chapter does not modify the terms and conditions
of disclosure under  Title 51  RCW and chapters  13.50 ,
 26.09 , 70.24 , 70.39,  70.96A ,  71.05 , and  71.34  RCW and rules
adopted under these provisions.


RCW  70.02.901  Application and construction--1991 c 335.

  This act shall be applied and construed to effectuate its
general purpose to make uniform the law with respect to the
subject of this act among states enacting it.

[1991 c 335 § 903.]

  This act may be cited as the uniform health care
information act.