79R1075 UM-D

By:  Chavez                                                       H.B. No. 486



A BILL TO BE ENTITLED

AN ACT

relating to the transmission of certain health information to a 
site outside the United States; creating an offense.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:                        
	SECTION 1.  Subtitle I, Title 2, Health and Safety Code, is 
amended by adding Chapter 182 to read as follows:

CHAPTER 182.  MEDICAL RECORDS PROTECTION
	Sec. 182.001.  DEFINITIONS.  In this chapter:                           
		(1)  "Health care business" means a person that 
collects or retains individually identifiable health information 
about an individual in relation to the provision of health care.
		(2)  "Individually identifiable health information" 
has the meaning assigned by Section 1171, Health Insurance 
Portability and Accountability Act of 1996 (42 U.S.C. Section 
1320d).
	Sec. 182.002.  DISCLOSURE REQUIRED.  A person that contracts 
with a health care business to receive individually identifiable 
health information shall disclose to the health care business if 
any of the information will be transmitted to a site outside the 
United States.
	Sec. 182.003.  CONSENT REQUIRED.  (a)  A health care business 
or person that contracts with a health care business may not 
transmit individually identifiable health information to a site 
outside the United States unless, before transmittal, the health 
care business:
		(1)  discloses to the individual that his or her 
individually identifiable health information may be transmitted to 
a site outside the United States;
		(2)  obtains the written consent of the individual 
whose health information is identifiable in accordance with Section 
182.004; and
		(3)  provides notice in accordance with Section 
182.005.             
	(b)  A health care business may not discriminate against an 
individual or deny an individual health care services because the 
individual has not provided consent under this chapter.
	(c)  A health care business that has ownership and control of 
individually identifiable health information is responsible for 
compliance with this chapter and may not delegate that 
responsibility to a physician who, as a contractor or employee, 
provides health care services to individuals.
	(d)  This chapter does not apply if an individual initiates a 
request for health care services, diagnosis, or treatment outside 
the United States.
	Sec. 182.004.  REQUIREMENTS FOR CONSENT.  Written consent to 
transmit individually identifiable health information to a site 
outside the United States must:
		(1)  be dated and signed by the individual whose health 
care information is identifiable; and
		(2)  clearly and conspicuously disclose:                               
			(A)  that by signing, the individual is consenting 
to the transmission of individually identifiable health 
information to a site outside the United States;
			(B)  that the consent of the individual must have 
been made or renewed not more than one year before the date on which 
the information is transmitted;
			(C)  that the individual may revoke the consent at 
any time; and    
			(D)  the procedure by which consent may be 
revoked.                 
	Sec. 182.005.  NOTICE REQUIRED.  (a)  A health care business 
required to provide notice under Section 182.003 shall publish 
notice that individually identifiable health information may be 
transmitted to a site outside the United States at least once each 
week for four consecutive weeks in a newspaper of the largest 
general circulation that is published in the county in which the 
greatest number of individuals served by the health care business 
are located.
	(b)  Notice must include:                                               
		(1)  a description of the type of information that will 
be transmitted to a site outside the United States;
		(2)  a statement that the health care business must 
request the consent of an individual before transmitting 
individually identifiable health information to a site outside the 
United States; and
		(3)  the manner in which the health care business may be 
contacted for further information.
	(c)  If a newspaper is not published in the county described 
by Subsection (a), the notice must be published in a newspaper of 
general circulation in an adjoining county.
	(d)  A health care business is not required to publish notice 
under this section more than once.
	Sec. 182.006.  OFFENSE; CRIMINAL PENALTY.  (a)  A health care 
business, or a person that contracts with a health care business, 
that transmits individually identifiable health information in 
violation of this chapter commits an offense.  Each record 
transmitted in violation of this chapter is a separate offense.
	(b)  An offense under this section is a Class C misdemeanor.            
	SECTION 2.  This Act takes effect September 1, 2006.