BILL ANALYSIS
By: Chavez
Border and International Affairs
Committee Report (Substituted)
BACKGROUND AND PURPOSE
Increasingly, U.S. health care businesses are contracting and outsourcing personally identifiable medical records in electronic format for analysis by individuals in other countries to take advantage of cost savings. The research firm IDC has published data showing that U.S. spending on medical transcription outsourcing totaled about $2.3 billion in 2004. IDC forecasts that the market will increase to $4.2 billion in 2008.
The committee substitute to House Bill 486 protects the privacy of Texans' medical records by preventing health care businesses from sending medical records offshore without providing notice to an individual and obtaining written authorization from the individual; provides for injunctive relief, civil penalties, and disciplinary action for violators.
RULEMAKING AUTHORITY
It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.
ANALYSIS
SECTION 1 Amends Section 181.001(b)(2), Health and Safety Code, to expand the definition of a covered entity to include certain persons who engage in the practice of creating or transcribing protected health information.
SECTION 2 Adds Subchapter G, Chapter 181, Health and Safety Code, regarding the transmission of certain information.
The subchapter prohibits a covered entity from disclosing protected health information to a person or site outside the United States unless the covered entity meets certain conditions. A covered entity that provides an individual with a notice of privacy practices and obtains written authorization from that individual that the disclosure is allowed may disclose protected health information to a person or site outside the United States.
A covered entity may provide a notice of privacy practices that informs an individual that the covered entity may disclose the individual’s protected health information to a person or site outside the United States. The notice may be provided separately or may be added to a notice required by 45 C.F.R. Section 164.520 in bold print and in a conspicuous location. The notice must include the following:
· a statement that the covered entity may disclose protected health information to a person or site outside the United States;
· the specific purpose or purposes for the disclosure;
· a statement informing the individual of the right to refuse the authorization;
· a statement that the covered entity may not discriminate against the individual for refusing to provide the authorization; and
· the signature of the individual or personal representative of the individual.
The written authorization must include the following information:
· a specific and meaningful description of the information that may be disclosed;
· the name, location, and other identifying information of the person or class of persons to whom disclosure may be made;
· a specific and meaningful description of each purpose or reason a disclosure is authorized;
· the date that the authorization will expire, which must be not later than one year from the date the authorization is signed unless the purpose of the disclosure is for research or another defined event that will exceed one year, in which case the authorization may expire on the end date of the research or defined event;
· a dated signature of the individual or personal representative of the individual and, if a personal representative signs for an individual, the authorization must state the authority of the personal representative to act on behalf of the individual;
· a statement that the individual has the right to revoke the authorization and that treatment cannot be conditioned on providing the authorization; and,
· a statement that the covered entity is subject to the penalties and disciplinary actions authorized by Subchapter E for unauthorized disclosures that are not consistent with the authorization; and a statement that the covered entity may be liable for unauthorized disclosures by a person that receives information directly from the covered entity under a business associate agreement or contract but may not be liable for subsequent unauthorized disclosures.
The provisions of this Act do not apply to a transmittal of individually identifiable health information:
· if it is permitted by 45 C.F.R. Section 164.512;
· that occurs because an individual initiates a request for health care services, diagnosis, or treatment outside of the United States;
· to the extent required by law or regulation;
· for public health purposes; or
· for the purpose of collecting or reporting information about an adverse event or product defect for a product or activity regulated by the U.S. Food and Drug Administration (FDA); tracking a product regulated by the FDA; enabling a recall or post-marketing surveillance activity or study of a product regulated by the FDA; and conducting, gathering, or reporting data and results of research studies.
SECTION 3 This Act takes effect September 1, 2005.
EFFECTIVE DATE
September 1, 2005
COMPARISON OF ORIGINAL TO SUBSTITUTE
The original version of the bill created a new Chapter 182, Health and Safety Code and placed restrictions on the use of individually identifiable health information by a health care business or a person who contracts with a health care business without the consent of the individual.
The committee substitute expands the definition of covered entity in Section 181.001, Health & Safety Code, and states that a covered entity may provide notice to an individual that the entity may disclose protected health information to a person or site outside the United States. Prior to such a disclosure, the covered entity must obtain written authorization from the individual. The committee substitute stipulates the manner and contents of the notice and the authorization.
The original required a health care business to publish in a newspaper notice of the possibility that individually identifiable health information may be transmitted outside the United States. The committee substitute provides that notice may be given to the individual.
The original version of the bill excluded individuals who initiate a request for health care services, diagnosis, or treatment outside the United States. The committee substitute includes that class and any transmission of individually identifiable health information 1) as permitted by 45 C.F.R 164.512, 2) to the extent required by law or regulation, 3) for public health purposes, 4) for certain activities related to products regulated by the U.S. Food and Drug Administration, and 5) conducting, gathering, or reporting data and results of research studies.
The committee substitute removes the provision that a violation of the Act is a Class C misdemeanor. Under the committee substitute, a violation would be subject to a civil penalty of no more than $3,000 that may be sought by the attorney general. If a court finds that violations have occurred with a frequency to constitute a pattern or practice, the court may assess a civil penalty of no more than $250,000. The substitute also grants the attorney general authority to file an injunction to restrain any violations of the Act
A covered entity is subject to investigation and disciplinary action and shall be excluded from participating in any state-funded health programs if the entity violates the Act.
The original bill had an effective date of September 1, 2006. The committee substitute has an effective date of September 1, 2005.