BILL REQ. #:  H-2275.1 

READ FIRST TIME 02/23/09.   

     AN ACT Relating to prohibiting the use of patient health care information for prescription drug marketing; amending RCW 70.02.010, 70.02.050, 70.02.170, and 19.86.090; adding a new section to chapter 70.02 RCW; creating a new section; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   (1) The legislature finds that:
     (a) The state of Washington has clear and long-standing interests in maximizing the health and well-being of its residents, safeguarding the confidentiality and integrity of the doctor-patient relationship, and containing health care costs;
     (b) To further its substantial interest in the health and well-being of its residents and in containing health care costs, the state of Washington has shown a strong commitment to evidence-based care and cost-effective health purchasing;
     (c) Health care providers in Washington who write prescriptions for their patients have a strong interest in the integrity of the patient-provider relationship; and
     (d) The use of patient identifiable prescription data to market prescription drugs to patients runs counter to Washington's strong commitment to both evidence-based care and cost-effective health purchasing.
     (2) It is the intent of the legislature to preserve patient privacy and contain health care costs by providing greater protection for patient specific health information than is currently provided by federal law.

Sec. 2   RCW 70.02.010 and 2006 c 235 s 2 are each amended to read as follows:
     The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
     (1) "Audit" means an assessment, evaluation, determination, or investigation of a health care provider by a person not employed by or affiliated with the provider to determine compliance with:
     (a) Statutory, regulatory, fiscal, medical, or scientific standards;
     (b) A private or public program of payments to a health care provider; or
     (c) Requirements for licensing, accreditation, or certification.
     (2) "Directory information" means information disclosing the presence, and for the purpose of identification, the name, location within a health care facility, and the general health condition of a particular patient who is a patient in a health care facility or who is currently receiving emergency health care in a health care facility.
     (3) "Federal, state, or local law enforcement authorities" means an officer of any agency or authority in the United States, a state, a tribe, a territory, or a political subdivision of a state, a tribe, or a territory who is empowered by law to: (a) Investigate or conduct an official inquiry into a potential criminal violation of law; or (b) prosecute or otherwise conduct a criminal proceeding arising from an alleged violation of law.
     (4) "General health condition" means the patient's health status described in terms of "critical," "poor," "fair," "good," "excellent," or terms denoting similar conditions.
     (5) "Health care" means any care, service, or procedure provided by a health care provider:
     (a) To diagnose, treat, or maintain a patient's physical or mental condition; or
     (b) That affects the structure or any function of the human body.
     (6) "Health care facility" means a hospital, clinic, nursing home, laboratory, office, or similar place where a health care provider provides health care to patients.
     (7) "Health care information" means any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient's health care, including a patient's deoxyribonucleic acid and identified sequence of chemical base pairs. The term includes any required accounting of disclosures of health care information.
     (8) "Health care operations" means any of the following activities of a health care provider, health care facility, or third-party payor to the extent that the activities are related to functions that make an entity a health care provider, a health care facility, or a third-party payor:
     (a) Conducting: Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, if the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;
     (b) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance and third-party payor performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of nonhealth care professionals, accreditation, certification, licensing, or credentialing activities;
     (c) Underwriting, premium rating, and other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care, including stop-loss insurance and excess of loss insurance, if any applicable legal requirements are met;
     (d) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;
     (e) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the health care facility or third-party payor, including formulary development and administration, development, or improvement of methods of payment or coverage policies; and
     (f) Business management and general administrative activities of the health care facility, health care provider, or third-party payor including, but not limited to:
     (i) Management activities relating to implementation of and compliance with the requirements of this chapter;
     (ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that health care information is not disclosed to such policy holder, plan sponsor, or customer;
     (iii) Resolution of internal grievances;
     (iv) The sale, transfer, merger, or consolidation of all or part of a health care provider, health care facility, or third-party payor with another health care provider, health care facility, or third-party payor or an entity that following such activity will become a health care provider, health care facility, or third-party payor, and due diligence related to such activity; and
     (v) Consistent with applicable legal requirements, creating deidentified health care information or a limited dataset and fund-raising for the benefit of the health care provider, health care facility, or third-party payor.
     (9) "Health care provider" means a person who is licensed, certified, registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession.
     (10) "Health carrier" has the same meaning as defined in RCW 48.43.005.
     (11) "Health plan" or "health benefit plan" has the same meaning as defined in RCW 48.43.005.
     (12) "Institutional review board" means any board, committee, or other group formally designated by an institution, or authorized under federal or state law, to review, approve the initiation of, or conduct periodic review of research programs to assure the protection of the rights and welfare of human research subjects.
     (((11))) (13) "Maintain," as related to health care information, means to hold, possess, preserve, retain, store, or control that information.
     (((12))) (14) "Marketing" means making a communication that encourages recipients of the communication to purchase or use a product or service. "Marketing" does not include any of the following:
     (a) Communications, including those made under (b) of this subsection, made orally or in writing by an entity with access to the recipient's health information if the entity making the communication does not receive direct or indirect remuneration including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication. Remuneration does not include payments received by a pharmacist or pharmacy from carriers, state purchased health care programs or other entities purchasing services under a health benefit plan, from health plan enrollees, or from a patient for the following activities:
     (i) Prescription drug ingredient costs;
     (ii) Dispensing fees;
     (iii) Formulary compliance; or
     (iv) Case management related to the diagnosis, treatment, or management of illness of a specific patient when conducted by, or under the supervision of, a pharmacist, including but not limited to care management educational materials provided to a patient about the patient's health condition, adherence to a prescribed course of therapy, such as refill reminders, or other information about the product being dispensed;
     (b) Communications made to current enrollees by the carrier, or to a patient by that patient's primary provider solely for the purpose of describing a provider's participation in an existing health care provider network or health plan network to which the enrollees or the patient already subscribes;
     (c) Communications made to current enrollees by the carrier, or to a current patient by that patient's primary provider solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or is included in a health benefit plan to which the enrollees or the patient already subscribes;
     (d) Communications made to a current patient by the patient's physician or primary health care provider for purposes of the patient's health care treatment; and
     (e) Communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals, medical devices, or treatment options.
     (15) "Patient" means an individual who receives or has received health care. The term includes a deceased individual who has received health care.
     (((13))) (16) "Payment" means:
     (a) The activities undertaken by:
     (i) A third-party payor to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits by the third-party payor; or
     (ii) A health care provider, health care facility, or third-party payor, to obtain or provide reimbursement for the provision of health care; and
     (b) The activities in (a) of this subsection that relate to the patient to whom health care is provided and that include, but are not limited to:
     (i) Determinations of eligibility or coverage, including coordination of benefits or the determination of cost-sharing amounts, and adjudication or subrogation of health benefit claims;
     (ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics;
     (iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, including stop-loss insurance and excess of loss insurance, and related health care data processing;
     (iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;
     (v) Utilization review activities, including precertification and preauthorization of services, and concurrent and retrospective review of services; and
     (vi) Disclosure to consumer reporting agencies of any of the following health care information relating to collection of premiums or reimbursement:
     (A) Name and address;
     (B) Date of birth;
     (C) Social security number;
     (D) Payment history;
     (E) Account number; and
     (F) Name and address of the health care provider, health care facility, and/or third-party payor.
     (((14))) (17) "Person" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or any other legal or commercial entity.
     (((15))) (18) "Reasonable fee" means the charges for duplicating or searching the record, but shall not exceed sixty-five cents per page for the first thirty pages and fifty cents per page for all other pages. In addition, a clerical fee for searching and handling may be charged not to exceed fifteen dollars. These amounts shall be adjusted biennially in accordance with changes in the consumer price index, all consumers, for Seattle-Tacoma metropolitan statistical area as determined by the secretary of health. However, where editing of records by a health care provider is required by statute and is done by the provider personally, the fee may be the usual and customary charge for a basic office visit.
     (((16))) (19) "Third-party payor" means an insurer regulated under Title 48 RCW authorized to transact business in this state or other jurisdiction, including a health care service contractor, and health maintenance organization; or an employee welfare benefit plan; or a state or federal health benefit program.
     (((17))) (20) "Treatment" means the provision, coordination, or management of health care and related services by one or more health care providers or health care facilities, including the coordination or management of health care by a health care provider or health care facility with a third party; consultation between health care providers or health care facilities relating to a patient; or the referral of a patient for health care from one health care provider or health care facility to another.

Sec. 3   RCW 70.02.050 and 2007 c 156 s 12 are each amended to read as follows:
     (1) Except to the extent that use or disclosure of health care information is limited under section 4 of this act, a health care provider or health care facility may disclose health care information about a patient without the patient's authorization to the extent a recipient needs to know the information, if the disclosure is:
     (a) To a person who the provider or facility reasonably believes is providing health care to the patient;
     (b) To any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, actuarial services to, or other health care operations for or on behalf of the health care provider or health care facility; or for assisting the health care provider or health care facility in the delivery of health care and the health care provider or health care facility reasonably believes that the person:
     (i) Will not use or disclose the health care information for any other purpose; and
     (ii) Will take appropriate steps to protect the health care information;
     (c) To any other health care provider or health care facility reasonably believed to have previously provided health care to the patient, to the extent necessary to provide health care to the patient, unless the patient has instructed the health care provider or health care facility in writing not to make the disclosure;
     (d) To any person if the health care provider or health care facility reasonably believes that disclosure will avoid or minimize an imminent danger to the health or safety of the patient or any other individual, however there is no obligation under this chapter on the part of the provider or facility to so disclose;
     (e) To immediate family members of the patient, including a patient's state registered domestic partner, or any other individual with whom the patient is known to have a close personal relationship, if made in accordance with good medical or other professional practice, unless the patient has instructed the health care provider or health care facility in writing not to make the disclosure;
     (f) To a health care provider or health care facility who is the successor in interest to the health care provider or health care facility maintaining the health care information;
     (g) For use in a research project that an institutional review board has determined:
     (i) Is of sufficient importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;
     (ii) Is impracticable without the use or disclosure of the health care information in individually identifiable form;
     (iii) Contains reasonable safeguards to protect the information from redisclosure;
     (iv) Contains reasonable safeguards to protect against identifying, directly or indirectly, any patient in any report of the research project; and
     (v) Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project;
     (h) To a person who obtains information for purposes of an audit, if that person agrees in writing to:
     (i) Remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified; and
     (ii) Not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the health care provider;
     (i) To an official of a penal or other custodial institution in which the patient is detained;
     (j) To provide directory information, unless the patient has instructed the health care provider or health care facility not to make the disclosure;
     (k) To fire, police, sheriff, or another public authority, that brought, or caused to be brought, the patient to the health care facility or health care provider if the disclosure is limited to the patient's name, residence, sex, age, occupation, condition, diagnosis, estimated or actual discharge date, or extent and location of injuries as determined by a physician, and whether the patient was conscious when admitted;
     (l) To federal, state, or local law enforcement authorities and the health care provider, health care facility, or third-party payor believes in good faith that the health care information disclosed constitutes evidence of criminal conduct that occurred on the premises of the health care provider, health care facility, or third-party payor;
     (m) To another health care provider, health care facility, or third-party payor for the health care operations of the health care provider, health care facility, or third-party payor that receives the information, if each entity has or had a relationship with the patient who is the subject of the health care information being requested, the health care information pertains to such relationship, and the disclosure is for the purposes described in RCW 70.02.010(8) (a) and (b); or
     (n) For payment.
     (2) A health care provider shall disclose health care information about a patient without the patient's authorization if the disclosure is:
     (a) To federal, state, or local public health authorities, to the extent the health care provider is required by law to report health care information; when needed to determine compliance with state or federal licensure, certification or registration rules or laws; or when needed to protect the public health;
     (b) To federal, state, or local law enforcement authorities to the extent the health care provider is required by law;
     (c) To federal, state, or local law enforcement authorities, upon receipt of a written or oral request made to a nursing supervisor, administrator, or designated privacy official, in a case in which the patient is being treated or has been treated for a bullet wound, gunshot wound, powder burn, or other injury arising from or caused by the discharge of a firearm, or an injury caused by a knife, an ice pick, or any other sharp or pointed instrument which federal, state, or local law enforcement authorities reasonably believe to have been intentionally inflicted upon a person, or a blunt force injury that federal, state, or local law enforcement authorities reasonably believe resulted from a criminal act, the following information, if known:
     (i) The name of the patient;
     (ii) The patient's residence;
     (iii) The patient's sex;
     (iv) The patient's age;
     (v) The patient's condition;
     (vi) The patient's diagnosis, or extent and location of injuries as determined by a health care provider;
     (vii) Whether the patient was conscious when admitted;
     (viii) The name of the health care provider making the determination in (c)(v), (vi), and (vii) of this subsection;
     (ix) Whether the patient has been transferred to another facility; and
     (x) The patient's discharge time and date;
     (d) To county coroners and medical examiners for the investigations of deaths;
     (e) Pursuant to compulsory process in accordance with RCW 70.02.060.
     (3) All state or local agencies obtaining patient health care information pursuant to this section shall adopt rules establishing their record acquisition, retention, and security policies that are consistent with this chapter.

NEW SECTION.  Sec. 4   A new section is added to chapter 70.02 RCW to read as follows:
     Notwithstanding allowable disclosures under RCW 70.02.050, and unless expressly authorized by the patient as provided in RCW 70.02.030, (1) health care providers, including pharmacies and entities licensed under chapter 18.64 RCW, (2) health carriers, (3) pharmacy benefit managers, or (4) the business associates, subsidiaries, or affiliates of the entities set out in subsections (1) through (3) of this section, shall not intentionally share, sell, or otherwise use any health care information for the purpose of marketing prescription drugs to patients.

Sec. 5   RCW 70.02.170 and 1991 c 335 s 801 are each amended to read as follows:
     (1) A person who has complied with this chapter may maintain an action for the relief provided in this section against a health care provider or facility who has not complied with this chapter.
     (2) The court may order the health care provider or other person to comply with this chapter. Such relief may include actual damages, but shall not include consequential or incidental damages. The court shall award reasonable attorneys' fees and all other expenses reasonably incurred to the prevailing party.
     (3) Any action under this chapter is barred unless the action is commenced within two years after the cause of action is discovered.
     (4) Except to the extent provided otherwise in subsection (5) of this section, a violation of this chapter shall not be deemed a violation of the consumer protection act, chapter 19.86 RCW.
     (5) In addition to any other remedy provided by law, the legislature finds that the practices covered by section 4 of this act are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of section 4 of this act is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

Sec. 6   RCW 19.86.090 and 2007 c 66 s 2 are each amended to read as follows:
     (1) Except to the extent provided in subsection (2) of this section, any person who is injured in his or her business or property by a violation of RCW 19.86.020, 19.86.030, 19.86.040, 19.86.050, or 19.86.060, or any person so injured because he or she refuses to accede to a proposal for an arrangement which, if consummated, would be in violation of RCW 19.86.030, 19.86.040, 19.86.050, or 19.86.060, may bring a civil action in the superior court to enjoin further violations, to recover the actual damages sustained by him or her, or both, together with the costs of the suit, including a reasonable attorney's fee, and the court may in its discretion, increase the award of damages to an amount not to exceed three times the actual damages sustained: PROVIDED, That such increased damage award for violation of RCW 19.86.020 may not exceed ten thousand dollars: PROVIDED FURTHER, That such person may bring a civil action in the district court to recover his or her actual damages, except for damages which exceed the amount specified in RCW 3.66.020, and the costs of the suit, including reasonable attorney's fees. The district court may, in its discretion, increase the award of damages to an amount not more than three times the actual damages sustained, but such increased damage award shall not exceed the amount specified in RCW 3.66.020. For the purpose of this section, "person" shall include the counties, municipalities, and all political subdivisions of this state.
     (2)(a) Any person who is injured by a violation of section 4 of this act may bring a civil action in the superior court to enjoin further violations, to recover the greater of one thousand dollars or actual damages sustained by him or her, or both, together with the costs of the suit, including reasonable attorneys' fees. The court may, in its discretion, increase the award of damages to an amount not to exceed the greater of three thousand dollars or three times the actual damages sustained.
     (b) Each prescription drug marketing communication sent or conveyed to a patient shall constitute a separate violation of section 4 of this act.
     (3) Whenever the state of Washington is injured, directly or indirectly, by reason of a violation of RCW 19.86.030, 19.86.040, 19.86.050, or 19.86.060, it may sue therefor in the superior court to recover the actual damages sustained by it, whether direct or indirect, and to recover the costs of the suit including a reasonable attorney's fee.