79R16727 JTS-D
By: Nelson S.B. No. 1328
Substitute the following for S.B. No. 1328:
By: Truitt C.S.S.B. No. 1328
A BILL TO BE ENTITLED
AN ACT
relating to the privacy of protected health information.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Section 58.0071(f), Family Code, is amended to
read as follows:
(f) This section does not affect the destruction of:
(1) physical records and files authorized by the Texas
State Library Records Retention Schedule; or
(2) protected health information maintained by a
covered entity, as that term is defined by privacy rule of the
Administrative Simplification subtitle of the Health Insurance
Portability and Accountability Act of 1996 (Pub. L. No. 104-191)
contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A
and E.
SECTION 2. Subsections (b) and (c), Section 82.010, Family
Code, are amended to read as follows:
(b) Except as otherwise provided by law, an application for
a protective order is confidential and[,] is excepted from required
public disclosure under Chapter 552, Government Code. A court[,
and] may not release an application [be released] to a person who is
not a respondent to the application until after the date of service
of notice of the application or the date of the hearing on the
application, whichever date is sooner.
(c) Except as otherwise provided by law, an application
requesting the issuance of a temporary ex parte order under Chapter
83 is confidential and[,] is excepted from required public
disclosure under Chapter 552, Government Code. A court[, and] may
not release an application [be released] to a person who is not a
respondent to the application until after the date that the court or
law enforcement informs the respondent of the court's order.
SECTION 3. Subsection (a), Section 107.006, Family Code, is
amended to read as follows:
(a) In [Except as provided by Subsection (c), in]
conjunction with an appointment under this chapter, other than an
appointment of an attorney ad litem for an adult or a parent, the
court shall issue an order authorizing the attorney ad litem,
guardian ad litem for the child, or amicus attorney to have
immediate access to:
(1) the child; and
(2) any otherwise privileged or confidential
information relating to the child.
SECTION 4. Subsections (a) and (b), Section 162.018, Family
Code, are amended to read as follows:
(a) The department, licensed child-placing agency, person,
or entity placing a child for adoption shall provide to the [The]
adoptive parents, upon request, [are entitled to receive] copies of
the records and other information relating to the history of the
child maintained by the department, licensed child-placing agency,
person, or entity placing the child for adoption.
(b) The department, licensed child-placing agency, person,
or entity placing the child for adoption shall, upon request,
provide to the [The] adoptive parents and the adopted child, after
the child is an adult, [are entitled to receive] copies of the
records maintained by the entity that have been edited to protect
the identity of the biological parents and any other person whose
identity is confidential and other information relating to the
history of the child [maintained by the department, licensed
child-placing agency, person, or entity placing the child for
adoption].
SECTION 5. Section 162.414, Family Code, is amended by
adding Subsection (f) to read as follows:
(f) To the extent that Subsection (d) authorizes the use or
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the use or disclosure complies
with all applicable requirements, standards, or implementation
specifications of the privacy rule.
SECTION 6. Subsection (a), Section 264.408, Family Code, is
amended to read as follows:
(a) The files, reports, records, communications, and
working papers used or developed in providing services under this
chapter are confidential and not subject to public release under
Chapter 552, Government Code. A center[, and] may only disclose the
files, reports, records, communications, and working papers
developed in providing services under this chapter [be disclosed]
for purposes consistent with this chapter. Disclosure may be to:
(1) the department, department employees, law
enforcement agencies, prosecuting attorneys, medical
professionals, and other state agencies that provide services to
children and families; and
(2) the attorney for the child who is the subject of
the records and a court-appointed volunteer advocate appointed for
the child under Section 107.031.
SECTION 7. Subsection (e), Section 420.031, Government
Code, is amended to read as follows:
(e) Evidence collected under this section may not be
released unless the survivor of the offense or a legal
representative of the survivor signs a written consent to release
the evidence. If a disclosure under this subsection is a disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent to the disclosure
complies with all of the privacy rule's applicable requirements,
standards, and implementation specifications relating to
authorizations for uses and disclosures of protected health
information.
SECTION 8. Section 825.507, Government Code, is amended by
adding Subsection (h) to read as follows:
(h) If a disclosure under Subsection (b)(6) is a disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization for the
disclosure complies with all of the privacy rule's applicable
requirements, standards, and implementation specifications
relating to authorizations for uses and disclosures of protected
health information.
SECTION 9. Section 81.103, Health and Safety Code, is
amended by adding Subsection (k) to read as follows:
(k) If a disclosure under Subsection (d) is a disclosure of
protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization for the
disclosure complies with all of the privacy rule's applicable
requirements, standards, and implementation specifications
relating to authorizations for uses and disclosures of protected
health information.
SECTION 10. Section 108.009, Health and Safety Code, is
amended by adding Subsection (c-1) to read as follows:
(c-1) For purposes of this section, the council or other
entity as determined by the council under Subsection (a) is a public
health authority, as that term is defined by the privacy rule of the
Administrative Simplification subtitle of the Health Insurance
Portability and Accountability Act of 1996 (Pub. L. No. 104-191)
contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A
and E. Data voluntarily submitted by a rural provider to the
council under Subsection (c) is a use and disclosure for which an
authorization or an opportunity to agree or object is not required.
SECTION 11. Section 142.009, Health and Safety Code, is
amended by amending Subsection (g) and adding Subsection (m) to
read as follows:
(g) After a survey of a home and community support services
agency by the department, the department shall provide to the chief
executive officer of the home and community support services
agency:
(1) specific and timely written notice of the
preliminary findings of the survey, including:
(A) the specific nature of the survey;
(B) any alleged violations of a specific statute
or rule;
(C) the specific nature of any finding regarding
an alleged violation or deficiency; and
(D) if a deficiency is alleged, the severity of
the deficiency;
(2) information on the identity, including the
signature, of each department representative conducting,
reviewing, or approving the results of the survey and the date on
which the department representative acted on the matter; and
(3) if requested by the home and community support
services agency, copies of all documents relating to the survey
maintained by the department or provided by the department to any
other state or federal agency that are not confidential under state
law.
(m) If a disclosure under Subsection (d)(3) is a disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent to the disclosure
complies with all of the privacy rule's applicable requirements,
standards, and implementation specifications relating to
authorizations for uses and disclosures of protected health
information.
SECTION 12. Section 162.006, Health and Safety Code, is
amended by adding Subsection (d) to read as follows:
(d) If a disclosure under this section is a disclosure of
protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the disclosure complies with all
of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 13. Section 162.007, Health and Safety Code, is
amended by amending Subsection (a) and adding Subsection (d) to
read as follows:
(a) Except as provided by Subsection (d), a [A] blood bank
shall report blood test results for blood confirmed as HIV positive
by the normal procedures blood banks presently use or found to be
contaminated by any other infectious disease to:
(1) the hospital or other facility in which the blood
was transfused or provided;
(2) the physician who transfused the infected blood;
and [or]
(3) the recipient of the blood.
(d) If a blood bank is unable to report blood test results to
a person listed in Subsection (a), the blood bank shall maintain a
record of the blood bank's attempt to report to that person along
with the blood test results.
SECTION 14. Section 181.051, Health and Safety Code, is
amended to read as follows:
Sec. 181.051. PARTIAL EXEMPTION. Except for Subchapters
[Subchapter] D and E, this chapter does not apply to:
(1) a covered entity as defined by Section 602.001,
Insurance Code;
(2) an entity established under Article 5.76-3,
Insurance Code; or
(3) an employer.
SECTION 15. Section 241.103, Health and Safety Code, is
amended by adding Subsection (d) to read as follows:
(d) This section applies to a hospital that is a covered
entity, as that term is defined by the privacy rule of the
Administrative Simplification subtitle of the Health Insurance
Portability and Accountability Act of 1996 (Pub. L. No. 104-191)
contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A
and E.
SECTION 16. Section 241.152, Health and Safety Code, is
amended by adding Subsection (g) to read as follows:
(g) If an authorization under this section authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 17. Section 241.153, Health and Safety Code, is
amended to read as follows:
Sec. 241.153. DISCLOSURE WITHOUT WRITTEN AUTHORIZATION.
(a) Subject to Subsection (b), a [A] patient's health care
information may be disclosed without the patient's authorization if
the disclosure is:
(1) directory information, unless the patient has
instructed the hospital not to make the disclosure or the directory
information is otherwise protected by state or federal law;
(2) to a health care provider who is rendering health
care to the patient when the request for the disclosure is made;
(3) to a transporting emergency medical services
provider for the sole purpose of determining the patient's
diagnosis and the outcome of the patient's hospital admission;
(4) to a clergy member [of the clergy] specifically
designated by the patient;
(5) to a qualified organ or tissue procurement
organization as defined in Section 692.002 for the purpose of
making inquiries relating to donations according to the protocol
referred to in Section 692.013(d);
(6) to a prospective health care provider for the
purpose of securing the services of that health care provider as
part of the patient's continuum of care, as determined by the
patient's attending physician;
(7) to a person authorized to consent to medical
treatment under Chapter 313 or to a person in a circumstance
exempted from Chapter 313 to facilitate the adequate provision of
treatment;
(8) to an employee or agent of the hospital who
requires health care information for health care education, quality
assurance, or peer review or for assisting the hospital in the
delivery of health care or in complying with statutory, licensing,
accreditation, or certification requirements and if the hospital
takes appropriate action to ensure that the employee or agent:
(A) will not use or disclose the health care
information for any other purpose; and
(B) will take appropriate steps to protect the
health care information;
(9) to a federal, state, or local government agency or
authority to the extent authorized or required by law;
(10) to a hospital that is the successor in interest to
the hospital maintaining the health care information;
(11) to the American Red Cross for the specific
purpose of fulfilling the duties specified under its charter
granted as an instrumentality of the United States government;
(12) to a regional poison control center, as the term
is used in Chapter 777, to the extent necessary to enable the center
to provide information and education to health professionals
involved in the management of poison and overdose victims,
including information regarding appropriate therapeutic use of
medications, their compatibility and stability, and adverse drug
reactions and interactions;
(13) to a health care utilization review agent who
requires the health care information for utilization review of
health care under Article 21.58A, Insurance Code;
(14) for use in a research project authorized by an
institutional review board under federal law;
(15) to health care personnel of a penal or other
custodial institution in which the patient is detained if the
disclosure is for the sole purpose of providing health care to the
patient;
(16) to facilitate reimbursement to a hospital, other
health care provider, or the patient for medical services or
supplies;
(17) to a health maintenance organization for purposes
of maintaining a statistical reporting system as required by a rule
adopted by a state agency or regulations adopted under the federal
Health Maintenance Organization Act of 1973, as amended (42 U.S.C.
Section 300 et seq.);
(18) to satisfy a request for medical records of a
deceased or incompetent person pursuant to Section 74.051(e), Civil
Practice and Remedies Code [4.01(e), Medical Liability and
Insurance Improvement Act of Texas (Article 4590i, Vernon's Texas
Civil Statutes)];
(19) to comply with a court order except as provided by
Subdivision (20); or
(20) related to a judicial proceeding in which the
patient is a party and the disclosure is requested under a subpoena
issued under:
(A) the Texas Rules of Civil Procedure or Code of
Criminal Procedure; or
(B) Chapter 121, Civil Practice and Remedies
Code.
(b) A hospital that is a covered entity disclosing protected
health information under this section, as those terms are defined
by the privacy rule of the Administrative Simplification subtitle
of the Health Insurance Portability and Accountability Act of 1996
(Pub. L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R.
Part 164, Subparts A and E, shall ensure that the disclosure
complies with all applicable requirements, standards, or
implementation specifications of the privacy rule, including
provisions relating to disclosures for:
(1) facility directories under 45 C.F.R. Section
164.510(a);
(2) treatment, payment, or health care operations
under 45 C.F.R. Section 164.506;
(3) cadaveric organ, eye, or tissue donation purposes
under 45 C.F.R. Section 164.512(h);
(4) law enforcement purposes under 45 C.F.R. Section
164.512(f);
(5) health oversight activities under 45 C.F.R.
Section 164.512(d);
(6) research purposes under 45 C.F.R. Section
164.512(i); and
(7) a judicial or administrative proceeding under 45
C.F.R. Section 164.512(e).
SECTION 18. Section 241.154, Health and Safety Code, is
amended by amending Subsection (b) and adding Subsection (f) to
read as follows:
(b) Except as provided by Subsections [Subsection] (d) and
(f), the hospital or its agent may charge a reasonable fee for
providing the health care information and is not required to permit
the examination, copying, or release of the information requested
until the fee is paid unless there is a medical emergency. The fee
may not exceed the sum of:
(1) a basic retrieval or processing fee, which must
include the fee for providing the first 10 pages of the copies and
which may not exceed $30; and
(A) a charge for each page of:
(i) $1 for the 11th through the 60th page of
the provided copies;
(ii) 50 cents for the 61st through the 400th
page of the provided copies; and
(iii) 25 cents for any remaining pages of
the provided copies; and
(B) the actual cost of mailing, shipping, or
otherwise delivering the provided copies; or
(2) if the requested records are stored on any
microform or other electronic medium, a retrieval or processing
fee, which must include the fee for providing the first 10 pages of
the copies and which may not exceed $45; and
(A) $1 per page thereafter; and
(B) the actual cost of mailing, shipping, or
otherwise delivering the provided copies.
(f) A covered entity shall comply with the requirements of
45 C.F.R. Section 164.524, including the requirement that access to
protected health information, as those terms are defined by the
privacy rule of the Administrative Simplification subtitle of the
Health Insurance Portability and Accountability Act of 1996 (Pub.
L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R. Part
164, Subparts A and E, for inspection purposes may not be denied to
an individual or legally authorized representative for nonpayment
of a fee.
SECTION 19. Section 247.065, Health and Safety Code, is
amended by adding Subsection (c) to read as follows:
(c) Subsection (b)(7) does not authorize the disclosure or
use of protected health information by a covered entity, as those
terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, unless the
disclosure or use complies with all applicable requirements,
standards, or implementation specifications of the privacy rule.
SECTION 20. Section 595.003, Health and Safety Code, is
amended by adding Subsection (c) to read as follows:
(c) If consent under this section authorizes the disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 21. Section 595.004, Health and Safety Code, is
amended by amending Subsection (a) and adding Subsection (c) to
read as follows:
(a) The content of a confidential record shall be made
available on the request of the person about whom the record was
made unless:
(1) the person is a client; and
(2) subject to Subsection (c), the qualified
professional responsible for supervising the client's habilitation
states in a signed written statement that having access to the
record is not in the client's best interest.
(c) A covered entity may not deny a request under this
section for protected health information, as those terms are
defined by the privacy rule of the Administrative Simplification
subtitle of the Health Insurance Portability and Accountability Act
of 1996 (Pub. L. No. 104-191) contained in 45 C.F.R. Part 160 and 45
C.F.R. Part 164, Subparts A and E, unless the qualified
professional responsible for supervising the client's
habilitation:
(1) determines that making the record available to the
client is reasonably likely to endanger the life or physical safety
of the client or another person; and
(2) complies with other requirements relating to
denial of access to an individual's protected health information
under 45 C.F.R. Section 164.524.
SECTION 22. Section 611.004, Health and Safety Code, is
amended by adding Subsection (e) to read as follows:
(e) If a disclosure under Subsection (a)(4) is a disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent to the disclosure
complies with all of the privacy rule's applicable requirements,
standards, and implementation specifications relating to
authorizations for uses and disclosures of protected health
information.
SECTION 23. Subsection (b), Section 611.0045, Health and
Safety Code, is amended to read as follows:
(b) The professional may deny access to any portion of a
record if the professional determines that release of that portion
would be harmful to the patient's physical, mental, or emotional
health. A covered entity may not deny a request under this
subsection for protected health information, as those terms are
defined by the privacy rule of the Administrative Simplification
subtitle of the Health Insurance Portability and Accountability Act
of 1996 (Pub. L. No. 104-191) contained in 45 C.F.R. Part 160 and 45
C.F.R. Part 164, Subparts A and E, unless the professional:
(1) determines that making the record available to the
patient is reasonably likely to endanger the life or physical
safety of the patient or another person; and
(2) complies with other requirements relating to
denial of access to an individual's protected health information
under 45 C.F.R. Section 164.524.
SECTION 24. Subsection (b), Section 611.008, Health and
Safety Code, is amended to read as follows:
(b) Except as provided by this subsection, unless [Unless]
provided for by other state law, the professional may charge a
reasonable fee for retrieving or copying mental health care
information and is not required to permit examination or copying
until the fee is paid unless there is a medical emergency. A
covered entity shall comply with the requirements of 45 C.F.R.
Section 164.524, including the requirement that access to protected
health information, as those terms are defined by the privacy rule
of the Administrative Simplification subtitle of the Health
Insurance Portability and Accountability Act of 1996 (Pub. L. No.
104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164,
Subparts A and E, for inspection purposes may not be denied to an
individual or legally authorized representative for nonpayment of a
fee.
SECTION 25. Section 773.093, Health and Safety Code, is
amended by adding Subsection (d) to read as follows:
(d) If consent under this section authorizes the disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent complies with all of
the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 26. Section 8, Article 21.58A, Insurance Code, is
amended by adding Subsection (j) to read as follows:
(j) If an authorization under Subsection (b) authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 27. Section 546.104, Insurance Code, as effective
April 1, 2005, is amended to read as follows:
Sec. 546.104. AUTHORIZED DISCLOSURE. (a) An individual or
an individual's legal representative may authorize disclosure of
genetic information relating to the individual by an authorization
that:
(1) is written in plain language;
(2) is dated;
(3) contains a specific description of the information
to be disclosed;
(4) identifies or describes each person authorized to
disclose the genetic information to a group health benefit plan
issuer;
(5) identifies or describes the individuals or
entities to whom the disclosure or subsequent redisclosure of the
genetic information may be made;
(6) describes the specific purpose of the disclosure;
(7) is signed by the individual or legal
representative and, if the disclosure is made to claim proceeds of
an affected life insurance policy, the claimant; and
(8) advises the individual or legal representative
that the individual's authorized representative is entitled to
receive a copy of the authorization.
(b) If an authorization under this section authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 28. Section 21.4032, Labor Code, is amended to read
as follows:
Sec. 21.4032. AUTHORIZED DISCLOSURE. (a) An individual or
the legal representative of an individual may authorize disclosure
of genetic information relating to the individual by a written
authorization that includes:
(1) a description of the information to be disclosed;
(2) the name of the person to whom the disclosure is
made; and
(3) the purpose for the disclosure.
(b) If an authorization under this section authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 29. Subsection (c), Section 201.009, Local
Government Code, is amended to read as follows:
(c) Subsection (b) does not apply to:
(1) a local government record whose public disclosure
is prohibited by an order of a court or by another state law; or
(2) a local government that is a covered entity
disclosing protected health information, as those terms are defined
by the privacy rule of the Administrative Simplification subtitle
of the Health Insurance Portability and Accountability Act of 1996
(Pub. L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R.
Part 164, Subparts A and E.
SECTION 30. Section 58.104, Occupations Code, is amended to
read as follows:
Sec. 58.104. AUTHORIZED DISCLOSURE. (a) An individual or
the legal representative of an individual may authorize disclosure
of genetic information relating to the individual by a written
authorization that includes:
(1) a description of the information to be disclosed;
(2) the name of the person to whom the disclosure is
made; and
(3) the purpose for the disclosure.
(b) If an authorization under this section authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the authorization complies with
all of the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 31. Section 159.005, Occupations Code, is amended
by adding Subsection (f) to read as follows:
(f) If consent under this section authorizes the disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent complies with all of
the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 32. Section 159.006, Occupations Code, is amended
by amending Subsection (a) and adding Subsection (f) to read as
follows:
(a) Subject to Subsection (f), unless [Unless] the
physician determines that access to the information would be
harmful to the physical, mental, or emotional health of the
patient, a physician who receives a written consent for release of
information as provided by Section 159.005 shall furnish copies of
the requested billing or medical records, or a summary or narrative
of the records, including records received from a physician or
other health care provider involved in the care or treatment of the
patient.
(f) A physician who is a covered entity may not deny a
request under this section for protected health information, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, unless the
physician:
(1) determines that making the information available
to the patient is reasonably likely to endanger the life or physical
safety of the patient or another person; and
(2) complies with other requirements relating to
denial of access to an individual's protected health information
under 45 C.F.R. Section 164.524.
SECTION 33. Section 159.008, Occupations Code, is amended
by amending Subsection (a) and adding Subsection (c) to read as
follows:
(a) Except as provided by Subsections [Subsection] (b) and
(c), a physician:
(1) may charge a reasonable fee, as prescribed by
board rule, for copying billing or medical records; and
(2) is not required to permit examination or copying
of the records until the fee is paid unless there is a medical
emergency.
(c) A covered entity shall comply with the requirements of
45 C.F.R. Section 164.524, including the requirement that access to
protected health information, as those terms are defined by the
privacy rule of the Administrative Simplification subtitle of the
Health Insurance Portability and Accountability Act of 1996 (Pub.
L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R. Part
164, Subparts A and E, for inspection purposes may not be denied to
an individual or legally authorized representative for nonpayment
of a fee.
SECTION 34. Section 201.405, Occupations Code, is amended
by amending Subsection (g) and adding Subsection (h) to read as
follows:
(g) A chiropractor who determines that access to
information requested under Subsection (f) would be harmful to the
physical, mental, or emotional health of the patient may refuse to
release the information requested under this section. A
chiropractor who is a covered entity may not deny a request under
this subsection for protected health information, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, unless the
chiropractor:
(1) determines that making the record available to the
patient is reasonably likely to endanger the life or physical
safety of the patient or another person; and
(2) complies with other requirements relating to
denial of access to an individual's protected health information
under 45 C.F.R. Section 164.524.
(h) If a consent under this section authorizes the
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent complies with all of
the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 35. Section 202.406, Occupations Code, is amended
by amending Subsection (d) and adding Subsection (f) to read as
follows:
(d) A podiatrist shall furnish copies of podiatric records
requested or a summary or narrative of the records under a written
consent for release of the information as provided by this section
unless the podiatrist determines that access to the information
would be harmful to the physical, mental, or emotional health of the
patient. The podiatrist may delete confidential information about
another person who has not consented to the release. A podiatrist
who is a covered entity may not deny a request under this subsection
for protected health information, as those terms are defined by the
privacy rule of the Administrative Simplification subtitle of the
Health Insurance Portability and Accountability Act of 1996 (Pub.
L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R. Part
164, Subparts A and E, unless the podiatrist:
(1) determines that making the record available to the
patient is reasonably likely to endanger the life or physical
safety of the patient or another person; and
(2) complies with other requirements relating to
denial of access to an individual's protected health information
under 45 C.F.R. Section 164.524.
(f) If consent under this section authorizes the disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent complies with all of
the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 36. Section 258.104, Occupations Code, is amended
by adding Subsection (e) to read as follows:
(e) If consent under this section authorizes the disclosure
of protected health information by a covered entity, as those terms
are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent complies with all of
the privacy rule's applicable requirements, standards, and
implementation specifications.
SECTION 37. Section 32, Texas Local Fire Fighters
Retirement Act (Article 6243e, Vernon's Texas Civil Statutes), is
amended by adding Subsection (d) to read as follows:
(d) If a disclosure under Subsection (a)(1)(D) is a
disclosure of protected health information by a covered entity, as
those terms are defined by the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45
C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, the
covered entity shall ensure that the consent to the disclosure
complies with all of the privacy rule's applicable requirements,
standards, and implementation specifications relating to
authorizations for uses and disclosures of protected health
information.
SECTION 38. The state auditor shall conduct an audit of
state agencies to determine which agencies have designated
themselves covered entities for the purposes of the federal Health
Insurance Portability and Accountability Act and whether the agency
should be designated as a hybrid of a covered entity. The auditor
shall report the results of the audit to the office of the attorney
general and the appropriate legislative committees not later than
March 1, 2006. The report must include any recommendations for
changes in agency designation.
SECTION 39. Subsection (c), Section 107.006, Family Code,
is repealed.
SECTION 40. This Act takes effect September 1, 2005.