SRC-TJG C.S.S.B. 1136 78(R)BILL ANALYSIS Senate Research CenterC.S.S.B. 1136 78R12313 MCK-DBy: Nelson Health & Human Services 4/16/2003 Committee Report (Substituted) REVISED DIGEST AND PURPOSE S.B. 11, passed in the 77th Texas Legislature, implemented medical records privacy in Texas. It contained verbatim the provisions of the Federal Health Insurance Portability and Accountability Act (HIPAA) regulation at the time of its passage. The Bush Administration altered HIPPA regulation on March 27, 2002. C.S.S.B. 1136 updates the references to the Code of Federal Regulation. This bill also describes the duties of the commissioner of health and human services in relation to making a determination for granting access to certain private medical information. RULEMAKING AUTHORITY Rulemaking authority is expressly granted to the commissioner of health and human services in SECTION 4 (Section 181.005, Health and Safety Code) of this bill. SECTION BY SECTION ANALYSIS SECTION 1. Sets forth findings of the Legislature of the State of Texas relating to access to certain private medical information. SECTION 2. Amends Section 181.001(b), Health and Safety Code, to define "commissioner." Deletes existing definitions of "health care operations" and "protected health information." Redefines "Health Insurance Portability and Accountability Act and Privacy Standards," " marketing," and "product." SECTION 3. Amends Section 181.002(a), Health and Safety Code, to make a conforming and a nonsubstantive change. SECTION 4. Amends Subchapter A, Chapter 181, Health and Safety Code, by adding Section 181.005, as follows: Sec. 181.005. DUTIES OF THE COMMISSIONER. (a) Requires the commissioner of health and human services (commissioner) to administer this chapter and authorizes the commissioner to adopt rules consistent with the Health Insurance Portability and Accountability Act and Privacy Standards to administer this chapter. (b) Requires the commissioner to review amendments to the definitions in 45 C.F. R. Parts 160 and 164 that occur after August 14, 2002, and determine whether it is in the best interest of the state to adopt the amended federal regulations. Requires the amended regulations to apply as required by this chapter, if the commissioner determines that it is in the best interest of the state to adopt the amended federal regulations. (c) Requires the commissioner to consider, in addition to other factors affecting the public interest, the beneficial and adverse effects the amendments would have on certain individuals and entities, in making a determination under this section. (d) Requires the commissioner to prepare a report of the commissioner's determination made under this section and to file the report with the presiding officer of each house of the legislature before the 30th day after the date the determination is made. Requires the report to include an explanation of the reasons for the determination. SECTION 5. Amends Section 181.056, Health and Safety Code, to add biomedical services to the list of activities this chapter does not prohibit the American Red Cross from accessing any information necessary to perform its duties to provide. SECTION 6. Amends Section 181.152, Health and Safety Code, as follows: (a) Requires a covered entity to obtain clear and unambiguous permission in written or electronic form to use or disclose protected health information for any marketing communication, except if the communication is in certain forms or for a certain purpose. Deletes existing text relating to prohibiting a covered entity from taking certain actions toward an individual for certain purposes. (b) Requires the communication to be sent in an envelope showing only certain information, if a covered entity uses or discloses protected health information to send a written marketing communication through the mail. Makes a conforming change. (c) Requires a person who receives a request under Subsection (b)(2) to remove a person's name from a mailing list to remove the person's name not later than the 45th, rather than the fifth, day after the date the person receives the request. (d) Authorizes a marketing communication made at the oral request of the individual under Subsection (a)(4) to be made only if clear and unambiguous oral permission for the use or disclosure of the protected health information is obtained. Requires the marketing communication to be limited to the scope of the oral permission and any further marketing communication to comply with the requirements of this section. SECTION 7. Amends Subchapter E, Chapter 181, Health and Safety Code, by adding Section 181.205, as follows: 181.205. MITIGATION. (a) Authorizes a covered entity to introduce, as mitigating evidence, evidence of the entity's good faith efforts to comply with certain laws in an action or proceeding to impose an administrative penalty or assess a civil penalty for actions related to the disclosure of individually identifiable health information. (b) Requires a court or state agency, on receipt of evidence under Subsection (a), to consider the evidence and mitigate imposition of an administrative penalty or assessment of a civil penalty accordingly. SECTION 8. Amends Chapter 181, Health and Safety Code, by adding Subchapter F, as follows: SUBCHAPTER F. PREEMPTION OF STATE LAW Sec. 181.251. STATE LAW PREEMPTION ANALYSIS. Requires the office of the attorney general to perform an analysis of state law to determine which provisions of state law related to the privacy of individually identifiable health information are preempted by the Health Insurance Portability and Accountability Act and Privacy Standards. Sec. 181.252. TASK FORCE. (a) Authorizes the office of the attorney general to establish a task force to assist and advise the attorney general in performing the state law preemption analysis. (b) Requires the attorney general to adopt a plan of operation for the task force. Requires the plan to include qualifications for the members of the task force. (c) Authorizes the attorney general to appoint as many members to the task force as the attorney general determines are necessary. Requires the attorney general to consider any appropriate factor, including a person's expertise, in making appointments to the task force. Requires a task force to include certain individuals as members. (d) Prohibits two or more members of the task force from being employees or officers of the same company or organization. (e) Prohibits a person from being a public member of the task force if the person meets certain conditions. (f) Prohibits members of the task force from receiving compensation from the state for service on the task force. Sec. 181.253. REPORT TO LEGISLATURE. (a) Requires the attorney general, not later than November 1, 2004, to file a report with the presiding officer of each house of the legislature that identifies the laws the attorney general believes are preempted by the Health Insurance Portability and Accountability Act and Privacy Standards. (b) Requires the report to contain the attorney general's recommendations for legislation to make the state laws consistent with the Health Insurance Portability and Accountability Act and Privacy Standards. Sec. 181.254. EXPIRATION. Provides that this subchapter expires September 1, 2005. SECTION 9. Repealer: Sections 181.004 (Rules) and 181.204 (Availability of Other Remedies) and Subchapter C (Access to and Use of Health Care Information), Chapter 181, Health and Safety Code. SECTION 10. (a) Effective date: September 1, 2003, except as provided by Subsection (b). (b) Provides that the changes in law made by this Act to Sections 181.001(b)(4) and 181.152 take effect January 1, 2004.