H-2295

AN ACT Relating to the uniform health care information act; adding a new section to chapter 42.17 RCW; adding a new chapter to Title 70 RCW; creating new sections; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

ARTICLE I

FINDINGS AND DEFINITIONS

NEW SECTION. Sec. 101. LEGISLATIVE FINDINGS. The legislature finds that:

(1) Health care information is personal and sensitive information that if improperly used or released may do significant harm to a patient's interests in privacy, health care, or other interests.

(2) Patients need access to their own health care information as a matter of fairness to enable them to make informed decisions about their health care and correct inaccurate or incomplete information about themselves.

(3) In order to retain the full trust and confidence of patients, health care providers have an interest in assuring that health care information is not improperly disclosed and in having clear and certain rules for the disclosure of health care information.

(4) Persons other than health care providers obtain, use, and disclose health record information in many different contexts and for many different purposes. It is the public policy of this state that a patient's interest in the proper use and disclosure of the patient's health care information survives even when the information is held by persons other than health care providers.

(5) The movement of patients and their health care information across state lines, access to and exchange of health care information from automated data banks, and the emergence of multistate health care providers creates a compelling need for uniform law, rules, and procedures governing the use and disclosure of health care information.

NEW SECTION. Sec. 102. DEFINITIONS. As used in this chapter, unless the context otherwise requires:

(1) "Audit" means an assessment, evaluation, determination, or investigation of a health care provider by a person not employed by or affiliated with the provider to determine compliance with:

(a) Statutory, regulatory, fiscal, medical, or scientific standards;

(b) A private or public program of payments to a health care provider; or

(2) "Directory information" means information disclosing the presence and the general health condition of a particular patient who is a patient in a health care facility or who is currently receiving emergency health care in a health care facility.

(3) "General health condition" means the patient's health status described in terms of "critical," "poor," "fair," "good," "excellent," or terms denoting similar conditions.

(4) "Health care" means any care, service, or procedure provided by a health care provider:

(a) To diagnose, treat, or maintain a patient's physical or mental condition; or

(b) That affects the structure or any function of the human body.

(5) "Health care facility" means a hospital, clinic, nursing home, laboratory, office, or similar place where a health care provider provides health care to patients.

(6) "Health care information" means any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient's health care. The term includes any record of disclosures of health care information.

(7) "Health care provider" means a person who is licensed, certified, registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession.

(8) "Institutional review board" means any board, committee, or other group formally designated by an institution, or authorized under federal or state law, to review, approve the initiation of, or conduct periodic review of research programs to assure the protection of the rights and welfare of human research subjects.

(9) "Maintain," as related to health care information, means to hold, possess, preserve, retain, store, or control that information.

(10) "Patient" means an individual who receives or has received health care. The term includes a deceased individual who has received health care.

(11) "Person" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or any other legal or commercial entity.

(12) "Reasonable fee" means the charges for duplicating or searching the record specified in RCW 36.18.020 (8) or (16), respectively. However, where editing of records by a health care provider is required by statute and is done by the provider personally, the fee may be the usual and customary charge for a basic office visit.

ARTICLE II

DISCLOSURE OF HEALTH CARE INFORMATION

NEW SECTION. Sec. 201. DISCLOSURE BY HEALTH CARE PROVIDER. Except as authorized in section 204 of this act, a health care provider, an individual who assists a health care provider in the delivery of health care, or an agent and employee of a health care provider may not disclose health care information about a patient to any other person without the patient's written authorization. A disclosure made under a patient's written authorization must conform to the authorization.

Health care providers or facilities shall chart all disclosures, except to third-party health care payors, of health care information, such chartings to become part of the health care information.

NEW SECTION. Sec. 202. PATIENT AUTHORIZATION TO HEALTH CARE PROVIDER FOR DISCLOSURE. (1) A patient may authorize a health care provider to disclose the patient's health care information. A health care provider shall honor an authorization and, if requested, provide a copy of the recorded health care information unless the health care provider denies the patient access to health care information under section 302 of this act.

(2) A health care provider may charge a reasonable fee, not to exceed the health care provider's actual cost for providing the health care information, and is not required to honor an authorization until the fee is paid.

(3) To be valid, a disclosure authorization to a health care provider shall:

(a) Be in writing, dated, and signed by the patient;

(b) Identify the nature of the information to be disclosed;

(d) Identify the provider who is to make the disclosure; and

(e) Identify the patient.

(4) Except as provided by this chapter, the signing of an authorization by a patient is not a waiver of any rights a patient has under other statutes, the rules of evidence, or common law.

(5) A health care provider shall retain each authorization or revocation in conjunction with any health care information from which disclosures are made. This requirement shall not apply to disclosures to third-party health care payors.

(6) Except for authorizations to provide information to third-party health care payors, an authorization may not permit the release of health care information relating to future health care that the patient receives more than ninety days after the authorization was signed. Patients shall be advised of the period of validity of their authorization on the disclosure authorization form.

(7) Except for authorizations to provide information to third-party health payors, an authorization in effect on the effective date of this section remains valid for six months after the effective date of this section unless an earlier date is specified or it is revoked under section 203 of this act. Health care information disclosed under such an authorization is otherwise subject to this chapter. An authorization written after the effective date of this section becomes invalid after the expiration date contained in the authorization, which may not exceed ninety days. If the authorization does not contain an expiration date, it expires ninety days after it is signed.

NEW SECTION. Sec. 203. PATIENT'S REVOCATION OF AUTHORIZATION FOR DISCLOSURE. A patient may revoke in writing a disclosure authorization to a health care provider at any time unless disclosure is required to effectuate payments for health care that has been provided or other substantial action has been taken in reliance on the authorization. A patient may not maintain an action against the health care provider for disclosures made in good-faith reliance on an authorization if the health care provider had no actual notice of the revocation of the authorization.

NEW SECTION. Sec. 204. DISCLOSURE WITHOUT PATIENT'S AUTHORIZATION. (1) A health care provider may disclose health care information about a patient without the patient's authorization to the extent a recipient needs to know the information, if the disclosure is:

(a) To a person who the provider reasonably believes is providing health care to the patient;

(b) To any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to the health care provider; or for assisting the health care provider in the delivery of health care and the health care provider reasonably believes that the person:

(i) Will not use or disclose the health care information for any other purpose; and

(ii) Will take appropriate steps to protect the health care information;

(c) To any other health care provider reasonably believed to have previously provided health care to the patient, to the extent necessary to provide health care to the patient, unless the patient has instructed the health care provider in writing not to make the disclosure;

(d) To any person if the health care provider reasonably believes that disclosure will avoid or minimize an imminent danger to the health or safety of the patient or any other individual, however there is no obligation under this chapter on the part of the provider to so disclose;

(e) Oral, and made to immediate family members of the patient, or any other individual with whom the patient is known to have a close personal relationship, if made in accordance with good medical or other professional practice, unless the patient has instructed the health care provider in writing not to make the disclosure;

(f) To a health care provider who is the successor in interest to the health care provider maintaining the health care information;

(g) For use in a research project that an institutional review board has determined:

(i) Is of sufficient importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;

(ii) Is impracticable without the use or disclosure of the health care information in individually identifiable form;

(iii) Contains reasonable safeguards to protect the information from redisclosure;

(iv) Contains reasonable safeguards to protect against identifying, directly or indirectly, any patient in any report of the research project; and

(v) Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project;

(h) To a person who obtains information for purposes of an audit, if that person agrees in writing to:

(i) Remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified; and

(ii) Not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the health care provider;

(i) To an official of a penal or other custodial institution in which the patient is detained;

(j) To provide directory information, unless the patient has instructed the health care provider not to make the disclosure.

(2) A health care provider shall disclose health care information about a patient without the patient's authorization if the disclosure is:

(a) To federal, state, or local public health authorities, to the extent the health care provider is required by law to report health care information; when needed to determine compliance with state or federal licensure, certification or registration rules or laws; or when needed to protect the public health;

(b) To federal, state, or local law enforcement authorities to the extent the health care provider is required by law;

(3) All state or local agencies obtaining patient health care information pursuant to this section shall adopt rules establishing their record acquisition, retention, and security policies that are consistent with this chapter.

NEW SECTION. Sec. 205. COMPULSORY PROCESS. (1) Before service of a discovery request or compulsory process on a health care provider for health care information, an attorney shall provide advance notice to the health care provider and the patient or the patient's attorney involved through service of process or first class mail, indicating the health care provider from whom the information is sought, what health care information is sought, and the date by which a protective order must be obtained to prevent the health care provider from complying. Such date shall give the patient and the health care provider adequate time to seek a protective order, but in no event be less than fourteen days since the date of service or delivery to the patient and the health care provider of the foregoing. Thereafter the request for discovery or compulsory process shall be served on the health care provider.

(2) Without the written consent of the patient, the health care provider may not disclose the health care information sought under subsection (1) of this section if the requestor has not complied with the requirements of subsection (1) of this section. In the absence of a protective order issued by a court of competent jurisdiction forbidding compliance, the health care provider shall disclose the information in accordance with this chapter. In the case of compliance, the request for discovery or compulsory process shall be made a part of the patient record.

(3) Production of health care information under this section, in and of itself, does not constitute a waiver of any privilege, objection, or defense existing under other law or rule of evidence or procedure.

NEW SECTION. Sec. 206. CERTIFICATION OF RECORD. Upon the request of the person requesting the record, the health care provider or facility shall certify the record furnished and may charge for such certification in accordance with RCW 36.18.020(9). No record need be certified until the fee is paid. The certification shall be affixed to the record and disclose:

(1) The identity of the patient;

(2) The kind of health care information involved;

(3) The identity of the person to whom the information is being furnished;

(4) The identity of the health care provider or facility furnishing the information;

(5) The number of pages of the health care information;

(6) The date on which the health care information is furnished; and

(7) That the certification is to fulfill and meet the requirements of this section.

ARTICLE III

EXAMINATION AND COPYING OF RECORD

NEW SECTION. Sec. 301. REQUIREMENTS AND PROCEDURES FOR PATIENT'S EXAMINATION AND COPYING. (1) Upon receipt of a written request from a patient to examine or copy all or part of the patient's recorded health care information, a health care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall:

(a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient;

(b) Inform the patient if the information does not exist or cannot be found;

(c) If the health care provider does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health care provider who maintains the record;

(d) If the information is in use or unusual circumstances have delayed handling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, not later than twenty-one working days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise disposed of; or

(e) Deny the request, in whole or in part, under section 302 of this act and inform the patient.

(2) Upon request, the health care provider shall provide an explanation of any code or abbreviation used in the health care information. If a record of the particular health care information requested is not maintained by the health care provider in the requested form, the health care provider is not required to create a new record or reformulate an existing record to make the health care information available in the requested form. The health care provider may charge a reasonable fee, not to exceed the health care provider's actual cost, for providing the health care information and is not required to permit examination or copying until the fee is paid.

NEW SECTION. Sec. 302. DENIAL OF EXAMINATION AND COPYING. (1) Subject to any conflicting requirement in the public disclosure act, chapter 42.17 RCW, a health care provider may deny access to health care information by a patient if the health care provider reasonably concludes that:

(a) Knowledge of the health care information would be injurious to the health of the patient;

(b) Knowledge of the health care information could reasonably be expected to lead to the patient's identification of an individual who provided the information in confidence and under circumstances in which confidentiality was appropriate;

(c) Knowledge of the health care information could reasonably be expected to cause danger to the life or safety of any individual;

(d) The health care information was compiled and is used solely for litigation, quality assurance, peer review, or administrative purposes; or

(e) Access to the health care information is otherwise prohibited by law.

(2) If a health care provider denies a request for examination and copying under this section, the provider, to the extent possible, shall segregate health care information for which access has been denied under subsection (1) of this section from information for which access cannot be denied and permit the patient to examine or copy the disclosable information.

(3) If a health care provider denies a patient's request for examination and copying, in whole or in part, under subsection (1) (a) or (c) of this section, the provider shall permit examination and copying of the record by another health care provider, selected by the patient, who is licensed, certified, registered, or otherwise authorized under the laws of this state to treat the patient for the same condition as the health care provider denying the request. The health care provider denying the request shall inform the patient of the patient's right to select another health care provider under this subsection. The patient shall be responsible for arranging for compensation of the other health care provider so selected.

ARTICLE IV

CORRECTION AND AMENDMENT OF RECORD

NEW SECTION. Sec. 401. REQUEST FOR CORRECTION OR AMENDMENT.(1) For purposes of accuracy or completeness, a patient may request in writing that a health care provider correct or amend its record of the patient's health care information to which a patient has access under section 301 of this act.

(2) As promptly as required under the circumstances, but no later than ten days after receiving a request from a patient to correct or amend its record of the patient's health care information, the health care provider shall:

(a) Make the requested correction or amendment and inform the patient of the action;

(b) Inform the patient if the record no longer exists or cannot be found;

(c) If the health care provider does not maintain the record, inform the patient and provide the patient with the name and address, if known, of the person who maintains the record;

(d) If the record is in use or unusual circumstances have delayed the handling of the correction or amendment request, inform the patient and specify in writing, the earliest date, not later than twenty-one days after receiving the request, when the correction or amendment will be made or when the request will otherwise be disposed of; or

(e) Inform the patient in writing of the provider's refusal to correct or amend the record as requested and the patient's right to add a statement of disagreement.

NEW SECTION. Sec. 402. PROCEDURE FOR ADDING CORRECTION OR AMENDMENT OR STATEMENT OF DISAGREEMENT. (1) In making a correction or amendment, the health care provider shall:

(a) Add the amending information as a part of the health record; and

(b) Mark the challenged entries as corrected or amended entries and indicate the place in the record where the corrected or amended information is located, in a manner practicable under the circumstances.

(2) If the health care provider maintaining the record of the patient's health care information refuses to make the patient's proposed correction or amendment, the provider shall:

(a) Permit the patient to file as a part of the record of the patient's health care information a concise statement of the correction or amendment requested and the reasons therefor; and

(b) Mark the challenged entry to indicate that the patient claims the entry is inaccurate or incomplete and indicate the place in the record where the statement of disagreement is located, in a manner practicable under the circumstances.

ARTICLE V

NOTICE OF INFORMATION PRACTICES

NEW SECTION. Sec. 501. CONTENT AND DISSEMINATION OF NOTICE. (1) A health care provider who provides health care at a health care facility that the provider operates and who maintains a record of a patient's health care information shall create a "notice of information practices" that contains substantially the following:

NOTICE

"We keep a record of the health care services we provide you. You may ask us to see and copy that record. You may also ask us to correct that record. We will not disclose your record to others unless you direct us to do so or unless the law authorizes or compels us to do so. You may see your record or get more information about it at ................"

(2) The health care provider shall place a copy of the notice of information practices in a conspicuous place in the health care facility, on a consent form or with a billing or other notice provided to the patient.

ARTICLE VI

PERSONS AUTHORIZED TO ACT FOR PATIENT

NEW SECTION. Sec. 601. HEALTH CARE REPRESENTATIVES. (1) A person authorized to consent to health care for another may exercise the rights of that person under this chapter to the extent necessary to effectuate the terms or purposes of the grant of authority. If the patient is a minor and is authorized to consent to health care without parental consent under federal and state law, only the minor may exercise the rights of a patient under this chapter as to information pertaining to health care to which the minor lawfully consented. In cases where parental consent is required, a health care provider may rely, without incurring any civil or criminal liability for such reliance, on the representation of a parent that he or she is authorized to consent to health care for the minor patient regardless of whether:

(a) The parents are married, unmarried, or separated at the time of the representation;

(b) The consenting parent is, or is not, a custodial parent of the minor;

(c) The giving of consent by a parent is, or is not, full performance of any agreement between the parents, or of any order or decree in any action entered pursuant to chapter 26.09 RCW.

(2) A person authorized to act for a patient shall act in good faith to represent the best interests of the patient.

NEW SECTION. Sec. 602. REPRESENTATIVE OF DECEASED PATIENT. A personal representative of a deceased patient may exercise all of the deceased patient's rights under this chapter. If there is no personal representative, or upon discharge of the personal representative, a deceased patient's rights under this chapter may be exercised by persons who would have been authorized to make health care decisions for the deceased patient when the patient was living under RCW 7.70.065.

ARTICLE VII

SECURITY SAFEGUARDS AND RECORD RETENTION

NEW SECTION. Sec. 701. DUTY TO ADOPT SECURITY SAFEGUARDS. A health care provider shall effect reasonable safeguards for the security of all health care information it maintains.

NEW SECTION. Sec. 702. RETENTION OF RECORD. A health care provider shall maintain a record of existing health care information for at least one year following receipt of an authorization to disclose that health care information under section 203 of this act, and during the pendency of a request for examination and copying under section 301 of this act or a request for correction or amendment under section 401 of this act.

ARTICLE VIII

CIVIL REMEDIES

NEW SECTION. Sec. 801. CIVIL REMEDIES. (1) A person who has complied with this chapter may maintain an action for the relief provided in this section against a health care provider or facility who has not complied with this chapter.

(2) The court may order the health care provider or other person to comply with this chapter. Such relief may include actual damages, but shall not include consequential or incidental damages. The court shall award reasonable attorneys' fees and all other expenses reasonably incurred to the prevailing party.

(3) Any action under this chapter is barred unless the action is commenced within two years after the cause of action is discovered.

(4) A violation of this act shall not be deemed a violation of the consumer protection act, chapter 19.86 RCW.

ARTICLE IX

MISCELLANEOUS PROVISIONS

NEW SECTION. Sec. 901. CONFLICTING LAWS. (1) This chapter does not restrict a health care provider from complying with obligations imposed by federal or state health care payment programs or federal or state law.

(2) This chapter does not apply to disclosure under chapters 13.50, 26.09, 70.24, 70.39, 70.96A, 71.05, and 71.34 RCW and rules adopted under these provisions.

NEW SECTION. Sec. 902. A new section is added to chapter 42.17 RCW to read as follows:

FREEDOM OF INFORMATION ACT. Chapter 70.‑- RCW (sections 101 through 901 of this act) applies to public inspection and copying of health care information of patients.

NEW SECTION. Sec. 903. UNIFORMITY OF APPLICATION AND CONSTRUCTION. This act shall be applied and construed to effectuate its general purpose to make uniform the law with respect to the subject of this act among states enacting it.

NEW SECTION. Sec. 904. SHORT TITLE. This act may be cited as the uniform health care information act.

NEW SECTION. Sec. 905. SEVERABILITY. If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

NEW SECTION. Sec. 906. CAPTIONS. As used in this act, captions constitute no part of the law.

NEW SECTION. Sec. 907. LEGISLATIVE DIRECTIVE. Sections 101 through 901 of this act shall constitute a new chapter in Title 70 RCW.