Brief Description: Regarding patient authorization of disclosure of health care information.

Sponsors: Senators Johnson, Kline and Rockefeller.

Hearing Date:

Staff: Chris Blake (786-7392).

Background:

The Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. A health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. A person who is authorized to consent for the health care of another may exercise those rights on the patient's behalf.

Health care providers must honor authorizations to disclose health care information. Valid disclosure authorizations must: (1) be in writing, dated, and signed by the patient; (2) identify the nature of the information to be disclosed; (3) identify the name, address, and institutional affiliation of the person to receive the information; (4) identify the provider to make the disclosure; and (5) identify the patient. A disclosure authorization is valid until the expiration date. If the authorization does not have a specified expiration date, it is only valid for ninety days after it is signed.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. HIPAA allows a state to establish standards that are more stringent than its provisions. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. A disclosure authorization under HIPAA must have the following core elements: (1) the patient's signature and date of signing; (2) a description of the information to be used or disclosed; (3) an identification of the individuals that may use or disclose the information; (4) an identification of the individuals that may receive the information; (5) a description of the purpose of the use or disclosure; and (6) an expiration date or expiration event.

Summary of Bill:

The 90 day limitation on the duration of disclosure authorizations that do not have a specified expiration date is removed. The 90 day limitation on the release of information regarding future health care services is also removed. An additional element of a valid authorization is added to specify that it must contain an expiration date or an expiration event.

Health care facilities are required to perform the same functions as health care providers with respect to disclosure authorizations, including disclosing information and providing copies. The exception for health care providers maintaining authorizations and revocations related to third party payors is removed.

Appropriation: None.

Fiscal Note: Not requested.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.