Background:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by the HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. The HIPAA allows a state to establish standards that are more stringent than its provisions.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

Washington has heightened protections for information related to mental health, human immunodeficiency virus (HIV), and sexually transmitted disease (STD). For mental health information, the fact of admission and all information and records compiled in the course of providing services to patients at public or private mental health agencies is confidential. With respect to HIV and STD information, it is prohibited to disclose the identity of a person who has considered or requested a test for a STD; the identity of the subject of a HIV antibody test or test for any other STD; the results of those tests, and information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD. Both the protections related to mental health, HIV, and STD information have several exceptions to allow the disclosure of the information without the patient's authorization or consent.

–––––––––––––––––––––––––––––––––

Summary of Substitute Bill:

The term "information and records related to mental health services" (mental health information) is codified under the UHCIA with predominantly the same meaning as related terms in the mental health statutes. The term "information and records related to sexually transmitted diseases" (STD information) is defined, similar to the standard in the STD statute, as health care information related to the identity of a person who has had a HIV or other STD test performed upon them, any results of such tests, and any information regarding the diagnosis or treatment of a STD. Both definitions expressly state that they are a type of "health care information."

Statutory provisions related to the disclosure of mental health information, including children's mental health information, and STD information are consolidated into the UHCIA. The heightened standards of privacy for those types of information are maintained.

General Mental Health Information.

Patient mental health information disclosure standards are maintained as they have been in the mental health chapters, except in some cases in which there is either a change in the disclosure without authorization standard or a new type of disclosure without authorization is established. These include:

Mental health information may be disclosed to a person who is providing health care to the patient as provided under the UHCIA.
The permitted disclosure of mental health records for management or financial audits is changed to the UHCIA standard that allows disclosure to a person for health care education; planning; quality assurance; peer review; administrative, legal, financial, or actuarial purposes; or for assisting a health care provider or facility in the delivery of health care.
The permitted disclosure of (1) mental health information for evaluation or research subject to the Department of Social and Health Services (DSHS) adopting related rules and the researcher signing an oath of confidentiality, and (2) mental health records for purposes of research, are changed to the UHCIA standard allowing disclosures for use in a research project approved by an institutional review board.
Mental health information may be disclosed to an official of a penal or other custodial institution in which the patient is detained.
The permitted disclosure of (1) mental health information for a recipient of the information to make a claim for aid, insurance, or Medicaid, and (2) mental health treatment records to the DSHS, regional support network directors, or qualified staff when needed for billing and collection purposes, are changed to allow disclosures for payment, including making a claim for aid, insurance, or medical assistance.
The permitted disclosure of mental health information to the Department of Health for determining compliance with licensing standards is expanded to the UHCIA standard that requires that the information be provided to federal, state, or local public health authorities as required by law to determine compliance with credentialing laws or to protect public health.
Mental health information must be disclosed to county coroners and medical examiners for death investigations.

In cases in which there is not a specific exception to the privacy standard, the subject of the mental health information may allow disclosure pursuant to the written authorization requirements of the UHCIA, as opposed to the undefined "release" and "written informed consent" requirements of the mental health chapters.

Prohibitions against the willful release of confidential information and records related to mental health services are eliminated.

General STD Information.

Patient STD information disclosure standards are maintained as they have been in the STD chapter, except that information and records related to STDs must be disclosed to a coroner or medical examiner without the patient's authorization. Sexually transmitted disease information must also be disclosed to federal, state, or local public health authorities as required by law to determine compliance with credentialing laws or to protect public health as provided in the UHCIA.

In cases in which there is not a specific exception to the privacy standard, the subject of the STD information may allow disclosure pursuant to the written authorization requirements of the UHCIA, as opposed to the undefined "release" requirement of the STD chapters.

Substitute Bill Compared to Original Bill:

The substitute bill removes exceptions to the disclosure authorization requirements for information and records related to STDs, including releases for health care to the patient; for education, planning, health care operations, and delivery of health care; and research.

The definition of "information and records related to mental health services" includes all types of test results for STDs, rather than only positive test results. Language regarding the ability of a minor to receive information and records related to STDs is aligned with language related to informed consent for minors regarding STD services.

The separate exceptions to the disclosure authorization requirement for situations involving imminent danger are restored so that (1) health care information may be disclosed to any person to avoid or minimize an imminent threat to the patient or another person, and (2) information and records related to mental health services may be disclosed to corrections or law enforcement agencies in the event of a crisis that poses a significant and imminent risk to the public.

An exception to the disclosure authorization requirement for information and records related to mental health services to next of kin is restored.

Penalties for the willful release of information and records related to mental health services are eliminated.

The effective date of the bill is delayed from January 1, 2013, until August 1, 2013.

Terminology is changed and technical and statutory references are corrected.

Staff Summary of Public Testimony:

(In support) This bill puts all of the confidentiality protections into a single chapter and makes minimal policy changes. Because all of the various health information protections were passed at different times, it creates confusion for providers.

(Opposed) This bill creates more confusion than clarity. The definitions of "information and records related to mental health services" and "mental health treatment records" create confusion. The bill inadvertently jeopardizes the ability of mental health treatment providers to notify law enforcement when there is a threat to health and safety. The bill does not allow for the release of mental health information for an audit. The bill impacts the ability of a family to disclose the death of a patient to the next of kin. The new section against willful disclosures of mental health information is redundant with current penalties under the Uniform Health Care Information Act and the Health Insurance Portability and Accountability Act.

An HIV-positive diagnosis carries great stigma and needs additional protections. Without the extraordinary protections of the AIDS Omnibus Act, there is no protection for an individual considering or accessing testing related to HIV status. This bill will keep people from learning their HIV status. Because many tests are conducted by caseworkers in nonmedical situations and facilities, the bill would not allow for the traditional confidentiality protections. The bill will affect the ability of a person to choose which caregiver he or she would like to have know about his or her STD information.