HBA-MPM H.B. 3254 76(R) BILL ANALYSIS Office of House Bill AnalysisH.B. 3254 By: Maxey Public Health 3/24/1999 Introduced BACKGROUND AND PURPOSE Protection of a patient's privacy with respect to personal health information is a key issue as Texas makes use of new technology and means of health care delivery, however, the public interest sometimes requires using private information for the public good. The Department of Health and Human Services and the Center for Disease Control have created a committee to review and develop a working plan for all states to address issues that have arisen because of this dilemma. H.B. 3254 addresses privacy and security issues arising from the acquisition, use, disclosure, and storage of identifiable health information by public health agencies at the state and local levels. RULEMAKING AUTHORITY It is the opinion of the Office of House Bill Analysis that this bill does not expressly delegate any additional rulemaking authority to a state officer, department, agency, or institution. SECTION BY SECTION ANALYSIS SECTION 1. Amends Subtitle D, Title 2, Health and Safety Code, by adding Chapter 93, as follows: CHAPTER 93. PUBLIC HEALTH PRIVACY ACT SUBCHAPTER A. GENERAL PROVISIONS Sec. 93.001. SHORT TITLE. Cites this chapter as the Public Health Privacy Act. Sec. 93.002. UNIFORMITY PROVISION. Provides that this chapter is a uniform Act intended to be applied and construed to effectuate its general purpose to make uniform the law among states enacting it with respect to the subject of this chapter. Sec. 93.003. LEGISLATIVE FINDINGS. Sets forth legislative findings. Sec. 93.004. PURPOSES. Sets forth the purposes of this chapter. Sec. 93.005. DEFINITIONS. Defines for the purposes of this chapter the following terms: "amend," "confidentiality statement," "disclose" and "disclosure," "expunge," "health oversight agency," "institutional review board," "nonidentifiable health information," "protected health information," "public health," "public health agency," "public health official," "public health purpose," "public information," "request," "requestor," and "store" and "storage." SUBCHAPTER B. ACQUISITION OF PROTECTED HEALTH INFORMATION Sec. 93.031. ACQUISITION OF INFORMATION. Authorizes a public health agency to acquire protected health information only under certain conditions. Prohibits this information from being secretly acquired by a public health agency. Makes this section applicable to the acquisition of information from a federal, state, or local public health agency, as well as other sources. SUBCHAPTER C. USE OF PROTECTED HEALTH INFORMATION Sec. 93.061. USE CONSISTENT WITH ORIGINAL PURPOSE. Provides that protected health information may only be used by public health agencies for public health purposes that are reasonably related to the purpose for which the information was acquired. Sec. 93.062. SUBSEQUENT USE. Authorizes a public health agency to use protected health information for public health purposes that are not reasonably related to the purpose for which the information was acquired only if the agency could have acquired the information for that purpose under Subchapter B. Sec. 93.063. SCOPE OF USE. Authorizes a public health agency to use only nonidentifiable health information to the extent possible to accomplish a public health purpose. Requires the agency to use this information only in accordance with this chapter and to the minimum extent reasonably believed to be necessary to accomplish a public health purpose. Sec. 93.064. COMMERCIAL USE PROHIBITED. Prohibits a public health agency or public health official from using protected health information for a commercial purpose. Sec. 93.065. EXPUNGING INFORMATION. Requires a public health agency to expunge in a confidential manner protected health information which no longer furthers any public health purpose. SUBCHAPTER D. DISCLOSURE OF PROTECTED HEALTH INFORMATION Sec. 93.101. INFORMATION NOT PUBLIC. Provides that protected health information is not public information, except as provided by this chapter. Prohibits this information from being disclosed without the informed consent of the individual or individual's representative who is the subject of the information. Sec. 93.102. INFORMED CONSENT. (a) Defines "informed consent" for the purposes of this chapter as a written authorization to disclose public health information made on a form substantially similar to that prescribed by the Texas Department of Health (department) that is signed in writing or electronically by the individual who is the subject of the information. Provides that the authorization must be dated and specify to whom the disclosure is authorized, the general purpose of the disclosure, and the period during which the authorization is effective. (b) Authorizes an individual to revoke authorization in writing at any time. Provides that the individual is responsible for informing the person who originally received the authorization of its revocation. (c) Provides that an authorization automatically expires six months after the date it is signed if it does not contain an expiration date or is not previously revoked. (d) Provides that a general authorization for the disclosure of information related to health is not sufficient to authorize disclosure of protected health information for purposes of this chapter unless the authorization complies with this section. (e) Authorizes written authorization under Subsection (a) to be provided by an individual's parent, guardian, or other person authorized under law to make health care decisions for the individual if the individual who is the subject of protected health information is incompetent or otherwise legally unable to give informed consent for the disclosure. Provides that a minor under the age of 14 is not considered competent to give informed consent for purposes of this subsection. Sec. 93.103. SCOPE OF DISCLOSURE. (a) Authorizes protected health information to be disclosed with the informed consent of the individual who is the subject of the information to persons and for purposes that are authorized under the terms of the informed consent. (b) Requires protected health information to be disclosed in a nonidentifiable form to the extent consistent with accomplishing the public health purpose unless the disclosure is made with the individual's informed consent whenever this chapter allows the disclosure of such information without the individual's informed consent. (c) Requires the disclosure of protected health information be limited to the minimum amount that the person making the disclosure reasonably believes necessary to accomplish the purpose of the disclosure unless it is made with the individual's informed consent whenever this chapter allows the disclosure of such information without an individual's informed consent and the information is not disclosed in a nonidentifiable form. (d) Requires a disclosure of protected health information, when made under this chapter, to be accompanied by a statement in writing or followed within three days by a statement in writing if the information was disclosed orally, concerning the public health agency's policy on disclosure. Provides that the statement must include specific language, and sets forth an example. Sec. 93.104. DISCLOSURE WITHOUT INFORMED CONSENT. Authorizes protected health information to be disclosed without an individual's informed consent if the disclosure is made under certain conditions and for certain reasons. Sec. 93.105. DISCLOSURE IN LEGAL PROCEEDING. (a) Prohibits protected health information from being disclosed in a civil, criminal, administrative, or other legal proceeding, including any disclosure in response to a subpeona, as part of discovery, or through the testimony of any person with knowledge about the information because of its acquisition by a public health agency, except in accordance with this section. (b) Authorizes a court to grant an order mandating the disclosure of protected health information on an application by a public health agency or public health official under certain circumstances. (c) Requires the court, on receiving an application for an order authorizing disclosure under this section, to enter an order directing that all materials that are part of the application and decision of the court be sealed. Prohibits these materials from being made available to any person except to the extent necessary to conduct proceedings concerning the application, including any appeal. Requires the order to direct that all proceedings concerning the application be conducted in camera ("in camera" is defined as in a chamber, room, or apartment; a judge's chamber, Black's Law Dictionary, Sixth Edition). (d) Requires an individual who is the subject of the information and any person in possession of the information from whom the information is sought to be notified of an application for its disclosure. (e) Authorizes an individual who is the subject of the information and any person possessing this information to file a written response to the application or to appear in person to provide evidence on the statutory criteria for the issuance of an order under this section. Authorizes the court to grant an order without the required notice or appearance if the application by a public health agency or public health officer requires immediate action to avert or mitigate a clear danger to the public health. (f) Requires the court, in assessing whether clear danger exists, to weigh the need for the disclosure against the privacy interests of the individual and any public health purpose that may be adversely affected by the disclosure. Requires the court to provide written findings of fact regarding its determination. (g) Requires an order authorizing disclosure of protected health information to adhere to certain limitations and inclusions. Sec. 93.106. DISCLOSURE FOR HEALTH OVERSIGHT PURPOSES. Authorizes a public health agency to disclose protected health information to a health oversight agency to enable the agency to perform a health oversight function authorized by law under certain conditions and stipulations. Sec. 93.107. DECEASED INDIVIDUALS. (a) Provides that this chapter does not prohibit the disclosure of protected health information in certain documentation regarding a deceased individual, for the purpose of determining the individual's cause of death, or to provide necessary information about the individual who is a donor or prospective donor of an anatomical gift. (b) Authorizes the rights of a deceased individual under this chapter to be exercised for two years after the date of death by a specified list of individuals. Sets forth the list of individuals in order of priority, subject to any written limitations or restrictions made by the decedent. Sec. 93.108. SECONDARY DISCLOSURE. Prohibits a person to whom protected health information has been disclosed under this chapter from disclosing the information in an identifiable form to another person except as authorized by this chapter. Makes this section inapplicable to certain individuals with respect to the disclosure. Sec. 93.109. RECORD OF DISCLOSURE. (a) Requires a public health agency to establish a written or electronic record of any disclosure of protected health information made under this chapter. Provides that this record is protected health information. (b) Provides that a record of disclosure is required to include certain information. (c) Requires the record of disclosure to be maintained by the public health agency for ten years, even if the protected health information disclosed is no longer in the agency's possession. SUBCHAPTER E. SECURITY SAFEGUARDS AND RECORDS RETENTION Sec. 93.151. DUTY TO HOLD INFORMATION SECURELY. (a) Specifies that public health agencies have a duty to acquire, use, disclose, and store protected health information in a confidential and secure manner. (b) Requires public health agencies and recipients of protected health information disclosed by an agency other than a recipient who is subject of the information or such a recipient's representative, to take appropriate measures to protect the security of the information. Sets forth specific duties these entities and individuals are required to perform with respect to this subsection. (c) Requires there to be a prominently displayed notice concerning the public health agency's disclosure policy whenever protected health information is accessible to public health officials. Sets forth sample wording of the notice. (d) Requires all public health officials or other persons with authority at any time to acquire, use, disclose, or store protected health information to perform certain duties with respect to the preservation of protected health information, including reporting to the public health information officer any known or possible breaches of security. (e) Prohibits the identity of any person making a report under Subsection (d) from being disclosed to anyone, other than investigating public health or law enforcement officers, without the consent of the person making the report. Sec. 93.152. ESTABLISHMENT OF PUBLIC HEALTH INFORMATION OFFICER. (a) Requires each public health agency to appoint or designate a public health official as the agency's public health information officer. (b) Delegates overall responsibility for preserving the security of all public health information to the public health information officer in a manner consistent with this section and chapter. Requires the officer to report directly to the highest ranking public health official at the agency. (c) Requires the public health information officer to perform all duties required by this section and this chapter. Sets forth specific duties with respect to the maintenance of protected health information. Sec. 93.153. ISSUANCE OF PUBLIC REPORTS. (a) Requires each public health agency to prepare an annual report concerning the status of security protections of protected health information required to be sent to the public health information officer for the department upon request. Requires the report to be prepared according to guidelines issued by the public health information officer for the department. (b) Requires the department's public health information officer to prepare a summary report on the status of security protections of protected health information for all public health agencies in this state within 60 days after the reports required under Subsection (a) are requested. Requires this report to be issued to the legislature together with any recommendations for amendments to state law that are relevant to improving the security of protected health information. (c) Prohibits a report prepared under this section from containing any protected health information or other personally identifiable information. (d) Provides that reports prepared under this section are public information. SUBCHAPTER F. FAIR INFORMATION PRACTICES Sec. 93.201. INDIVIDUAL ACCESS TO PUBLIC HEALTH INFORMATION. (a) Makes this section applicable to a request by an individual who is the subject of protected health information, or by the individual's parent or guardian, to inspect or copy the information when it is in the possession of a public health agency. (b) Authorizes the public health agency to place reasonable limitations on the time, place, and frequency of any inspections. Requires the agency to request the opportunity to review the information with the requestor. Prohibits such a review from being a prerequisite to providing the information. (c) Requires any information contained in that information relating to the individual regarding the health status of other persons or other confidential information regarding other persons to be deleted prior to inspection or copying under this section. (d) Authorizes any information contained in that information regarding the individual that is unrelated to the requestor's health status to be deleted prior to inspection or copying under this section. (e) Authorizes a public health agency to deny a request to inspect or copy protected health information under this section under certain circumstances. (f) Requires the public health agency to notify the requestor in writing of the reasons for denying a request under this section, including a denial for the reason the agency does not have in its possession any requested protected health information relating to the requestor. (g) Authorizes a requestor to appeal a denial of access under this section through an administrative review procedure for this purpose by the department. Sec. 93.202. ACCURACY OF INFORMATION. (a) Requires public health agencies to reasonably ensure the accuracy and completeness of protected health information. (b) Authorizes the requestor to request that the public health agency correct, amend, or delete erroneous, incomplete, or false information after inspection or review of protected health information. (c) Requires a brief written statement from the requestor challenging the veracity of the protected health information to be retained by the public health agency while it possesses the information. Requires the agency to note on the disputed portions of the information the original language and the requestor's proposed change and disclose the notation on request to any person authorized to receive the information. (d) Requires the public health agency to correct, amend, or delete erroneous, incomplete, or false information within 14 calendar days after it receives a request to do so if it is determined that the modification is reasonably supported by the facts. Provides that the requestor has the burden of proving that the information needs to be corrected, amended, or deleted. (e) Requires the requestor to be notified in writing of any corrections, amendments, or deletions made, or, alternately, the reasons for denying a request under this section in whole or part. (f) Authorizes the requestor to appeal a decision under this section through an administrative review procedure prescribed for this purpose by the department. (g) Requires a public health agency to take reasonable steps to notify all persons indicated by the requestor, or others for which known disclosures have previously been made, of corrections, amendments, or deletions made to protected information. Sec. 93.203. APPEALS. (a) Authorizes a requestor to appeal the decision of a public health agency to a Travis County district court or to a district court in the county in which the requestor resides if an administrative review procedure has been exhausted. (b) Requires the court to determine whether there exists a reasonable basis for the action or decision of the public health agency by conducting an in camera review of the relevant protected health information, the administrative record, and other admissible evidence. (c) Limits the relief that may be granted to a requestor under this section to a judgment requiring the public health agency to make the requested information available to the requestor for inspection or copying or to correct, amend, or delete erroneous, incomplete, or false information as requested. SUBCHAPTER G. CRIMINAL SANCTIONS; CIVIL REMEDIES Sec. 93.251. CRIMINAL OFFENSES AND PENALTIES. (a) Provides that a public health official who wilfully commits an act violating this chapter and knew or should have known that the act is prohibited commits a misdemeanor punishable by a fine not to exceed $5,000, confinement for a period not to exceed one year, or both the fine and confinement. (b) Provides that a person who is not a public health official who wilfully discloses protected health information in violation of this chapter and who knows or should know that the disclosure is prohibited commits a misdemeanor punishable by a fine not to exceed $5,000, confinement for a period not to exceed one year, or both the fine and the confinement. (c) Provides that any person who by unlawful means, including bribery, fraud, theft, false pretenses, or other misrepresentation of identity, misrepresentation of purpose of use, or misrepresentation of entitlement to information, inspects, copies, examines, or obtains protected health information in violation of this chapter commits a felony and that each such felony is punishable by a fine not to exceed $50,000, imprisonment for a period not to exceed five years, or both the fine and imprisonment. (d) Provides that an offense committed under Subsection (a), (b), or (c) for the purpose of commercial gain or with intent to cause malicious harm is a felony punishable by a fine not to exceed $50,000, imprisonment for a period not to exceed five years, or both the fine and imprisonment. (e) Doubles the maximum penalties described in Subsections (a), (b), (c), and (d) for every subsequent conviction of a person arising out of a violation or violations related to a different set of circumstances from those involved in the previous offense or set of offenses under Subsection (a), (b), (c), or (d). (f) Provides that a prosecution under this section is barred if the indictment or information is not presented within three years after the date of the offense. (g) Provide that each violation of this chapter is a separate offense. Sec. 93.252. CIVIL ENFORCEMENT. Authorizes the attorney general or a district or county attorney to bring a civil action to enforce this chapter and obtain relief that the court is authorized to grant under Section 93.253. Sec. 93.253. CIVIL REMEDIES. (a) Authorizes a person aggrieved by a negligent or intentional violation of this chapter, including a negligent or intentional disclosure of protected health information in violation of this chapter, failure to adequately safeguard the confidentiality or security of information, or failure to supervise persons responsible for the acquisition, use, disclosure, or storage of information, to bring an action for relief under this section. (b) Authorizes the court to order a public health agency, public health official, or other person to comply with this chapter and to order any appropriate civil or equitable relief, including injunctive relief, to prevent noncompliance with this chapter. (c) Entitles the aggrieved person to recover damages for losses sustained as a result of the violation if the court determines that there is a violation of this chapter. Entitles the person to recover the greater of actual damages or liquidated damages of $1,000 for each violation. Prohibits the liquidated damages awarded to a person from exceeding $10,000. (d) Authorizes an aggrieved person to recover punitive damages from the violator in an amount not to exceed $10,000 per violation, it the court determines that the violation results from wilful or grossly negligent conduct. (e) Authorizes the court to assess reasonable attorney's fees and all other expenses reasonably incurred in the litigation against the parties that did not prevail if the aggrieved party prevails. (f) Provides that responsible parties are jointly and severally liable for any compensatory damages, attorney's fees, or other costs awarded. (g) Bars any action under this section unless the action is commenced within one year after the cause of action accrues or was or should reasonably have been discovered by the aggrieved person or the person's representative. (h) Provides that each separate violation of this chapter is an actionable violation. (i) Provides that this section does not limit or expand the right of an aggrieved person or the person's representative to recover damages under other applicable law. Sec. 93.254. IMMUNITIES. (a) Provides that it is not a violation of or an offense under this chapter to disclose protected health information in accordance with an informed consent to disclose the information executed according to this chapter. (b) Provides that if a public health official is a superior or supervisory officer over another public health official and the other official violates a part of this chapter, the superior or supervisory officer is subject to application of a civil remedy under this chapter only on a theory of vicarious liability if the superior or supervisory official had no prior actual or constructive knowledge of the violation or actions leading to it and was not otherwise responsible for ensuring against the occurrence of the violation. (c) Provides that a person who is not a public health official is not subject to the imposition of a criminal sanction or civil liability under this chapter as a result of disclosing protected health information in violation of this chapter if the original disclosure of information by the public health agency was not accompanied by the language required by Section 93.103(d). Provides that this subsection does not affect whether a criminal sanction or civil liability may be imposed on a public health official or other person failing to include the language required under that section in the prior disclosure. (d) Provides that the parent or guardian of a minor or the court-appointed guardian of a mentally incompetent individual is not subject to the imposition of a criminal sanction or civil liability under this chapter as a result of disclosing protected health information relating to a minor or individual if the parent or guardian obtained the information according to this chapter. SECTION 2. Requires the highest ranking public health official at each public health agency affected by this Act to prepare and submit a report to the department concerning the probable effect of the Act on the agency no later than January 3, 2000. Requires the department to issue a comprehensive report to the legislature on behalf of each public health agency concerning the effect of the Act, including any recommendations for legislative amendments no later than November 1, 2000. SECTION 3. Effective date: September 1, 2000. SECTION 4. Emergency clause.