5587-S AMS WINS SEIB 007

SSB 5587 - S AMD - 132

    By Senators Winsley and Thibaudeau

                                                   ADOPTED 3/11/99

    On page 2, line 1, after "PRIVACY."  Strike all material through "organizations." on line 18, and insert "(1) Each health carrier must develop and implement policies and procedures governing the collection, use, and disclosure of health information. These policies and procedures must include methods for enrollees to access information and amend incorrect information, for enrollees to restrict the disclosure of sensitive information, and for enrollees to obtain information about the carrier's health information policies.  In addition, these policies and procedures must include methods for carrier oversight and enforcement of information policies, for carrier storage and disposal of health information, and for carrier conformance to state and federal laws governing the collection, use, and disclosure of personally identifiable health information.  Each carrier must provide a summary notice of its health information policies to enrollees, including the enrollee's right to restrict the collection, use, and disclosure of health information.

    (2) Except as otherwise required by statute or rule, a health carrier is, and all persons acting at the direction of or on behalf of a carrier or in receipt of an enrollee's personally identifiable health information are, prohibited from collecting, using, or disclosing personally identifiable health information unless authorized in writing by the person who is the subject of the information.  At a minimum, such authorization must be valid for a limited time and purpose; be specific as to purpose and types of information to be collected, used, or disclosed; and identify the persons who will be receiving the information.

    (3) The commissioner shall adopt rules to implement this section and shall take into consideration health information privacy standards recommended by the national association of insurance commissioners and other related professional organizations.

    (4) Nothing in this section shall be construed to prevent the creation, use, or release of anonymized data for which there is no reasonable basis to believe that the information could be used to identify an individual."

                            --- END ---

EFFECT: Rewords section on patient privacy and allows an exception for anonymized data.