FINAL BILL REPORT

ESSB 6265

PARTIAL VETO

C 220 L 14

Synopsis as Enacted

Brief Description: Concerning state and local agencies that obtain patient health care information.

Sponsors: Senate Committee on Health Care (originally sponsored by Senators Frockt, Rivers, Conway, Becker, Kohl-Welles, Bailey, Cleveland, Ranker, Keiser and Tom).

Senate Committee on Health Care

House Committee on Health Care & Wellness

Background: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information unless there is a specific exemption. Some exemptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. HIPAA allows a state to establish standards that are more stringent than its provisions. Covered entities include health plans, health care providers, and health care clearinghouses.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

The Comprehensive Hospital Abstract Reporting System (CHARS) provides hospital patient discharge information to public health personnel, consumers, purchasers, payers, providers, and researchers to help make informed decisions on health care. CHARS contains coded hospital inpatient discharge information, derived from billing systems, available from 1987 to 2012. Coded hospital-based observation stay data is available from 2008 forward. For example, the Department of Health (DOH) uses CHARS data to identify and analyze health trends related to hospitalizations and to identify and quantify issues related to health care access, quality, and cost containment.

The nonconfidential CHARS data file does not contain direct patient identifiers, defined as information that identifies a patient or, in other words, information that is readily associated with a person's identity and exempt from disclosure under the Public Records Act. The nonconfidential CHARS data file does include indirect identifiers, defined as information that may identify a patient when combined with other information, such as the patient's age, sex, zip code, billed charges, and diagnostic or procedure codes.

The Affordable Care Act requires marketplaces such as the Washington Health Benefit Exchange (Exchange) to establish a navigator program to help consumers understand new coverage options and find the most affordable coverage that meets their health care needs. Navigators must be certified by the Exchange after successfully passing a certification exam and must sign confidentiality and nondisclosure agreements and agree to comply with a code of ethics that requires them to maintain their duty to the consumer.

Summary: State and local agencies that inadvertently obtain health care information must not use or disclose this information. Agencies that receive such information must destroy it in accordance with agency policy. If the health care information has been disclosed to a third party, the state or local agency must notify the person whose information has been disclosed of the disclosure.

DOH must maintain confidentiality of CHARS data and this data is excluded from public inspection. DOH may release CHARS data as follows:

1. data with both direct and indirect patient identifiers may be released to:

   1. federal, state, and local government agencies upon receipt of a signed data use agreement; and

   2. researchers approved by the Washington State Institutional Review Board upon receipt of a signed confidentiality agreement;

2. data without direct patient identifiers but with possible indirect patient identifiers may be released to agencies, researchers, and other persons upon receipt of a signed data use agreement; and

3. data without direct or indirect patient identifiers may be released on request.

Recipients of CHARS data with either direct or indirect identifiers must agree in a written data use agreement to take steps to protect direct and indirect patient-identifying information as described in the agreement, and not re-disclose the data except as authorized in their agreement. Recipients of CHARS data without direct identifiers are prohibited from attempting to identify persons whose information is included in the data set or using the data in any manner that identifies individuals or their families. DOH must consider national standards when adopting rules necessary to implement the new confidentiality standards.

Navigators who are certified by the Exchange may only request health care information that is relevant to the specific assessment and recommendation of health plan options. Information received by navigators may not be disclosed to third parties. If a disclosure occurs, the navigator must notify the person of the breach. The Exchange must develop a policy to establish a reasonable notification period and include this policy on its website.

A series of changes to UHCIA are made, including the following: clarifying the term information and records related to mental health services to include mental health information contained in a medical bill, registration records, and all records about the person that are maintained by the Department of Social and Health Services, regional support networks, and treatment facilities; and making the exceptions to the right of a patient to receive an accounting of disclosure of health care information relating to mental health treatment information the same as the exceptions for general health care information.

Votes on Final Passage:

Partial Veto Summary: The provision permitting third-party payors to release health care information disclosed under the UHCIA if permitted by that Act was vetoed. Consequently, current law limiting those disclosures to those made by health care providers under the UHCIA is reinstated.