Washington State

House of Representatives

Office of Program Research

BILL

ANALYSIS

Health Care & Wellness Committee

HB 2339

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

Background:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. HIPAA allows a state to establish standards that are more stringent than its provisions.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

Washington has heightened protections for information related to mental health, human immunodeficiency virus (HIV), and sexually transmitted disease (STD). For mental health information, the fact of admission and all information and records compiled in the course of providing services to patients at public or private mental health agencies is confidential. With respect to HIV and STD information, it is prohibited to disclose the identity of a person who has considered or requested a test for a STD; the identity of the subject of a HIV antibody test or test for any other STD; the results of those tests, and information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD. Both the protections related to mental health, HIV, and STD information have several exceptions to allow the disclosure of the information without the patient's authorization or consent.

In 2013, legislation was enacted to combine health care information, mental health information, and STD information into a single statutory scheme, while continuing to recognize many of the different standards for information.

Summary of Bill:

The term "information and records related to mental health services" is clarified to include mental health information contained in a medical bill, registration records, and all records about the person that are maintained by the Department of Social and Health Services, regional support networks, and treatment facilities. The term "mental health treatment records" is eliminated and references to it are changed to "information and records related to mental health services."

Exceptions to the right of a patient to receive an accounting of disclosures of health care information are applied to mental health treatment information. The exceptions relate to uses or disclosures that pertain to treatment, payment, and health care operations; the patient's own health care information; uses or disclosures that are permitted or required by law; authorizations by the patient; directory information; persons involved in the patient's care; national security; correctional institutions or law enforcement officials; and limited data sets without identifying information.

Duplicative standards related to permissible disclosures of information and records related to mental health are eliminated so that a single standard applies to situations in which the communication is between mental health professionals and a state or local correctional facility where the patient is confined or supervised.

The requirement that a person who receives health care information to perform services on behalf of a health care provider may not use the information in a manner inconsistent with the duties of the health care provider is changed so that the information may not be used in a manner that would violate confidentiality provisions if performed by the provider. The requirement that third party payors only disclose health care information to the extent that a health care provider may disclose information without authorization is changed so that the third party payor may only release health care information as provided under the Uniform Health Care Information Act.

The requirement that a health care provider or facility terminate a contractual relationship with any entity that violates its responsibility to keep information confidential is made permissive.

The duration of an authorization to disclose health care information to a financial institution or an employer of the patient is extended from 90 days to one year.

It is clarified that disclosures for research purposes related to chemical dependency are not limited, except as permitted under state or federal law.

A reference to disclosures permitted in a "treatment facility" where a patient is receiving treatment, is changed to clarify that the provision applies to "mental health service agencies."