BILL ANALYSIS
By: Nelson
BACKGROUND AND PURPOSE
S.B. 1136, 78th Legislature, Regular Session, 2005, directed the Office of the Attorney General to perform a preemption analysis of state law based on the Health Insurance Portability and Accountability Act's (HIPAA) privacy protections. This bill is in response to that analysis.
This bill allows for the removal of provisions that are preempted by the Health Insurance Portability and Accountability Act of 1996 and provides greater consistency therewith on the authorization and destruction of health records.
RULEMAKING AUTHORITY
It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.
ANALYSIS
[While the statutory references in this bill are to the Texas Department of Protective and Regulatory Services (DPRS) and the Texas Department of Health (TDH), the following amendments affect the Department of Family Protective Services and the Department of State Health Services, as the successor agency to TDH and DRPS, respectively.]
The bill amends the Family Code by specifying that the destruction of certain physical files and records does not apply to the destruction of protected health information maintained by a "covered entity," as defined by the bill.
The bill also amends the Family Code by requiring that Texas Department of Protective Services, licensed child-placing agency, person, or entity placing the child for adoption to provide to the adoptive parents, upon request, specific information related to the child that is maintained by the entity, including specific information relating to the biological parents of the adopted child. The bill also specifies that a children's advocacy center (center) may only disclose the files, reports, records, communications, and working papers developed in providing services consistent with the duties and purpose of the center as defined by existing code.
The bill continues to amend the Family Code by requiring any public social agency authorized to care for children, including the Texas Department of Protective and Regulatory Services, that uses or discloses protected health information to comply with all applicable requirements, standards, or implementation specifications of the privacy rule of the Administrative
Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191) contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E (privacy rule).
The bill amends the Government Code to make conforming changes regarding uses and disclosures of protected health information collected as evidence in cases of sexual assault to comply with the privacy rule.
The bill also amends the Government Code to make conforming changes regarding uses and disclosures of protected health information gathered by the Teacher Retirement System and that regarding members, annuitants, or beneficiaries of the Texas Emergency Services Retirement System to comply with the privacy rule.
The bill amends the Health and Safety Code to make conforming changes regarding uses and disclosures of protected health information that is a result of a test for a communicable disease to comply with the privacy rule.
The bill also amends the Health and Safety Code, by defining "council" and specifies that certain information is a use and disclosure for which an authorization or opportunity to agree or object is not required.
The bill continues to amend the Health and Safety Code by requiring the Texas Department of Health to provide certain information to the chief executive officer of the home and community support services agency. The bill also makes a conforming change regarding uses and disclosures of protected health information relating to home and community health services. Similarly, the bill amends the Health and Safety Code to exempt cases of injunctive relief by the attorney general from specified privacy requirements of medical records.
Moreover, the bill amends the Health and Safety Code by requiring the disclosures of protected health information by blood banks to other blood banks to comply with the privacy rule. Furthermore, the bill requires a blood bank to report HIV positive blood results, or blood found to be contaminated with any other infectious disease to certain persons and entities and to maintain a record of its attempts to report blood test results to an infected person if the blood bank is unable to report the results.
Correspondingly, the bill applies specified requirements to a hospital that is a covered entity, as defined by the privacy rule, in regards to the preservation of specified records. Likewise, the bill makes conforming changes regarding uses and disclosures of protected health information by a hospital to comply with the privacy rule, and to ensure that any disclosure complies with all requirements, standards, or implementation specifications of the privacy rule and sets forth specific provisions with which the entity must comply.
The bill amends the Health and Safety Code by specifying how a hospital or agent may charge reasonable fees for providing health care information, as well as specifies exceptions. The bill also requires a covered entity to comply with specific requirements, including the requirement that protected health information may not be denied to an individual or legal representative thereof if the information is obtained for inspection purposes. Additionally, the bill prohibits the use or disclosure of protected health information by a covered entity unless the disclosure complies with all applicable requirements, standards, or implementation specifications of the privacy rule.
The bill amends the Health and Safety Code regarding the use and disclosures of protected health information concerning a person who has mental retardation and ensuring compliance with the privacy rule. The bill also as makes conforming changes regarding uses and disclosures of protected health information concerning mental health records to comply with the privacy rule, as well as the disclosures of such records in judicial or administrative proceedings concerning mental health. Likewise the bill specifies exceptions and makes conforming changes regarding uses and disclosures of protected health information by metal health professionals.
The bill furthermore amends the Health and Safety Code by specifying that the content of a confidential record shall be made available on the request of the person about whom the record was made unless the person is a client and the qualified professional responsible for supervising the client's habilitation states in a signed written statement that having access to the record is not in the client's best interest. By the same token, the covered entity may not deny a request for protected health information, as those terms are defined by the privacy rule, unless the qualified professional responsible for supervising the client's habilitation, determines that making the record available to the client is reasonably likely to endanger the life or physical safety of the client or another person and complies with other requirements relating to denial of access to an individual's protected health information under 45 C.F.R. Section 164.524.
The bill amends the Health and Safety Code by making conforming changes regarding uses and disclosures of protected health information relating to the consent to release confidential information by a patient, as well as the uses and disclosures of protected health information relating to the disclosure of genetic information of an individual to comply with the privacy rule.
The bill amends the Insurance Code, by making conforming changes regarding uses and disclosures of protected health information by a utilization review agent to comply with the privacy rule.
The bill amends the Labor Code and Occupation Code by making conforming changes regarding uses and disclosures of protected health information relating to the genetic information of an individual to comply with the privacy rule.
Likewise, the bill amends the Local Government Code by stating that public access to local government records is limited by a local government that is a covered entity disclosing protected health information, as defined by the privacy rule.
The bill amends the Occupation Code to make conforming changes regarding uses and disclosures of protected health information relating to a consent for release of confidential information to comply with the privacy rule. Likewise, the bill makes conforming changes regarding uses and disclosures of protected health information by a physician, including that relating to physician's fees for information, to comply with the privacy rule.
The bill continues to amend the Occupations Code by prohibiting a chiropractor who is a covered entity from denying access to requested information unless the chiropractor determines that the release thereof would endanger the life of the patient or another person and complies with other requirements relating to the denial of access to protected health information. The bill also makes conforming changes regarding uses and disclosures of protected health information by a chiropractor to comply with the privacy rule.
Similarly, the bill amends the Occupations Code by making conforming changes regarding uses and disclosures of protected health information by a podiatrist and that of a dentist, to comply with the privacy rule.
The bill amends the Texas Local Fire Fighters Retirement Act (Article 6243e, V.T.C.S.), by adding Subsection (d), to make conforming changes regarding uses and disclosures of protected health information to comply with the privacy rule.
In the same manner, the bill amends Section 3.01, Chapter 824, Acts of the 73rd Legislature, Regular Session, 1993 (Article 6243o, V.T.C.S.), by amending Subsection (k), to make conforming changes regarding uses and disclosures of protected health information to comply with the privacy rule.
The bill requires each state agency to report to the state auditor the agency's progress in determining compliance with the federal Health Insurance Portability and Accountability Act of 1996, including determining whether the agency has designated itself to be a covered entity for the purposes of that Act and whether the agency is designated as a hybrid of a covered entity. The bill also requires each state agency to submit compliance information in the form and within the period prescribed by the state auditor. Provides that information submitted to the state auditor is subject to audit based on risk assessment and is subject to the legislative audit committee's approval of including the work in the audit plan under Subsection (c), Section 321.013 (relating to the state auditor's recommended audit plan to state agencies), Government Code. The bill requires the state auditor to report the aforementioned compliance information reported by each state agency to the office of the attorney general and the appropriate legislative committees.
Lastly, the bill makes conforming changes and non-substantive changes throughout the Family Code, the Government Code, the Insurance Code, the Health and Safety Code, the Labor Code, the Local Government Code and the Occupations Code.
EFFECTIVE DATE
September 1, 2007.