Background: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. HIPAA allows a state to establish standards that are more stringent than its provisions.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

Washington has heightened protections for information related to mental health, the human immunodeficiency virus (HIV), and sexually transmitted diseases (STDs). For mental health information, the fact of admission and all information and records compiled in the course of providing services to patients at public or private mental health agencies is confidential. With respect to HIV and STD information, it is prohibited to disclose the identity of a person who considers or requests a test for an STD; the identity of the subject of an HIV antibody test or test for any other STD; the results of those tests; and information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD. Both the protections related to mental health, HIV, and STD information have several exceptions to allow the disclosure of the information without the patient's authorization or consent.

Summary of Bill (Recommended Amendments): The term information and records related to mental health services (mental health information) is codified under UHCIA with predominantly the same meaning as related terms in the mental health statutes. The term information and records related to sexually transmitted diseases (STD information) is defined, similar to the standard in the STD statute, as health care information related to the identity of a person who has had an HIV or other STD test performed upon them, any results of such tests, and any information regarding the diagnosis or treatment of an STD. Both definitions expressly state that they are a type of health care information.

Statutory provisions related to the disclosure of mental health information, including children's mental health information and STD information, are consolidated into UHCIA. The heightened standards of privacy for those types of information are maintained. The requirement that an attorney seeking health care information from a health care provider or patient be given 14 days' notice so that either may object to the request, is limited to only apply to hospitals. For all other health care facilities and providers, upon receipt of a discovery request or compulsory process, the health care facility or provider must send a copy of the request to the last known address of the patient and then the health care provider may produce the health care information if the patient does not raise an objection. Health care providers and their employees and contractors are prohibited from using or disclosing health care information for marketing or fundraising purposes, unless it is permitted by federal law. Health care providers and facilities are not permitted to sell health care information to a third party except for purposes of treatment or payment, sale of a business, remuneration to a third party for services, disclosures required by law, providing access to or accounting of disclosures to an individual, public health purposes, or research, or with an individual's authorization or where a reasonable cost-based fee is paid to prepare and transmit health care information.

Entities that receive health care information for health care education or to provide services to a health care provider, such as planning, quality assurance, legal, or financial activities, are subject to the same disclosure requirements as the health care provider for which the entity is working. If a health care provider learns that an entity violated this responsibility, the health care provider must terminate the contract with the entity unless reasonable steps to correct the situation were taken or the violating activity is discontinued.

General Mental Health Information. Patient mental health information disclosure standards are maintained as they have been in the mental health chapters, except in some cases in which there is either a change in the standard for disclosure without authorization or a new type of disclosure without authorization is established. These include the following:

mental health information may be disclosed to a person who is providing health care to the patient, as provided under UHCIA;
the permitted disclosure of mental health records for management or financial audits is changed to the UHCIA standard that allows disclosure to a person for health care education; planning; quality assurance; peer review; administrative, legal, financial, or actuarial purposes; or for assisting a health care provider or facility in the delivery of health care;
the permitted disclosure of: (1) adult mental health information for evaluation or research subject to the Department of Social and Health Services (DSHS) adopting related rules and the researcher signing an oath of confidentiality; and (2) mental health records for purposes of research, are changed to the UHCIA standard allowing disclosures for use in a research project approved by an institutional review board;

mental health information may be disclosed to an official of a penal or other custodial institution in which the patient is detained;
the permitted disclosure of: (1) mental health information for a recipient of the information to make a claim for aid, insurance, or Medicaid; and (2) mental health treatment records to DSHS, regional support network directors, or qualified staff when needed for billing and collection purposes, is changed to allow disclosures for payment, including making a claim for aid, insurance, or medical assistance;
the permitted disclosure of mental health information to the Department of Health for determining compliance with licensing standards is expanded to the UHCIA standard that requires that the information be provided to federal, state, or local public health authorities as required by law to determine compliance with credentialing laws or to protect public health;
mental health information must be disclosed to county coroners and medical examiners for death investigations; and
mental health information may be disclosed to an organ procurement organization for the purpose of determining the medical suitability of a body part.

In cases in which there is not a specific exception to the privacy standard, the subject of the mental health information may allow disclosure pursuant to the written authorization requirements of UHCIA, as opposed to the undefined release and written informed consent requirements of the mental health chapters. Prohibitions against the willful release of confidential information and records related to mental health services are eliminated.

General STD Information. Patient STD information disclosure standards are maintained as they are in the STD chapter, except that information and records related to STDs may be disclosed for use in a research project approved by an institutional review board. Information and records related to STDs must be disclosed to a coroner or medical examiner or an organ procurement organization regardless of the patient's authorization. In addition, it is clarified that the information and records related to STDs must be disclosed to federal, state, and local public health authorities as required by law, to determine compliance with regulatory laws, or to protect the public health. In cases in which there is not a specific exception to the privacy standard, the subject of the STD information may allow disclosure pursuant to the written authorization requirements of UHCIA, as opposed to the undefined release requirement of the STD chapters.

Staff Summary of Public Testimony on Engrossed Substitute House Bill: PRO: Currently, it is not entirely clear among providers what information can and cannot be released. This bill should make it easier for providers. This bill consolidates the various statutes on health information disclosure and we can reconcile remaining differences in the future. There are no policy changes in the bill unless the stakeholder group agreed to them. This will make it clearer for mental health records; the mental health community does not want it to be harder to get their information. The research disclosure provisions are important to the University of Washington (UW), which does extensive public health research. If STD and mental health data cannot be released for research purposes, UW will be unable to apply for grants and this will result in a loss of research activities. In the bill, this information may be released, but only under a review board. The emergency clause relates to this provision and is necessary to continue UW's current research activities. Our goal is to make sure that current protections on mental health treatment records are maintained. Our concerns are likely to be addressed in a proposed amendment to address releasing information when there is imminent danger to the patient or to another person and that the changes to the discovery language be stricken from the bill. We are hopeful that this bill will move forward.

CON: We believe the bill does change current law. In cases of conflicting sections, the stakeholder group picked the lower standard allowing for more disclosure. The fact of disclosure of mental health records may be hidden from patients and will not be documented in the patient record. Current law provides for liquidated damages for disclosure of mental health records and this remedy is not available in the bill which will negatively affect enforcement.

OTHER: We would like to see an amendment addressing the sale of medical records to a third party and recommend that those circumstances in which such a sale can occur be listed in the bill as provided in federal law.