Background:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. The HIPAA allows a state to establish standards that are more stringent than its provisions.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include: disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.

Both state and federal law allow for the disclosure of health care information without an authorization in cases in which the disclosure is to an immediate family member or a person with a close relationship with the patient. Under state law, the disclosure does not apply to information related to mental health or sexually transmitted diseases. State law allows the disclosure as long as the patient has not instructed the health care provider in writing not to make the disclosure. Federal law allows for a similar disclosure, however, it does not exclude information related to mental health and sexually transmitted diseases. Under federal law, the recipient of the information must be involved in the patient's health care or payment related to the health care. The determination will vary based upon whether the patient is present and has the capacity to make health care decisions.

Both state and federal law allow for the disclosure of health care information when the health care provider believes that it is necessary to avoid or minimize an imminent danger to a patient or another person. The standards are similar, except that state law allow for the disclosure to be made to any person when there is an "imminent danger," while federal law restricts the disclosure to a person reasonably able to prevent or lessen a "serious and imminent threat."

Summary of Substitute Bill:

A health care provider or health care facility may disclose health care information without a patient's consent if the disclosure is:

to a family member of the patient, a close friend of the patient, or another person identified by the patient if the disclosure is directly related to the recipient's involvement with the patient's health care or payment related to the patient's health care; or
is for the purpose of notifying a family member, a personal representative, or another person responsible for the care of the patient of the patient's location, general condition, or death.

If the patient is not present or if obtaining an authorization is impracticable due to incapacity or an emergency situation, the disclosure is permissible without an authorization if the health care provider or health care facility determines that, in its professional judgment, the disclosure is in the best interests of the patient. In such circumstances, the health care provider or health care facility may only disclose information directly relevant to the person's involvement with the patient's health care. The health care provider or health care facility may decide if it is in the best interest of the patient to allow the person to pick up filled prescriptions, medical supplies, X-rays, or similar forms of health care information on behalf of the patient.

If the patient is present, the disclosure is permissible if the health care provider or health care facility: (1) obtains the patient's agreement; (2) provides the patient an opportunity to object and the patient does not expressly object; or (3) infers from the circumstances that the patient does not object.

If a person is being treated for a mental disorder, the disclosure may include the patient's diagnosis and treatment recommendations; safety concerns related to the patient; information about available resources, such as case management and support; and the process to ensure safe transitions to different levels of care.

Health care providers and health care facilities must document disclosures of health care information to a family member or close relation in the patient's medical record, including the date of the disclosure and the information disclosed.

Immunity from civil liability is provided for health care providers and health care facilities when making or not making a disclosure.

The authority of a health care provider or health care facility to disclose certain health care information that is believed will "avoid or minimize an imminent danger" to the patient or another person is changed to allow the information to be disclosed if it is believed in good faith that it will "prevent or lessen a serious and imminent threat" to any person or the public. The information may only be disclosed to persons who are reasonably able to prevent or lessen the threat. The restriction on sharing the fact of admission for mental health services and information and records related to receiving mental health services is removed.

EFFECT OF SENATE AMENDMENT(S):

The Senate amendment removes references related to allowing a health care provider or facility to use professional judgment to infer that it is the patient's best interest to allow a person to pick up prescriptions, medical supplies, x-rays, or similar forms of health care information in situations in which the patient is not present or does not have the opportunity to agree or object to a disclosure. Health care information may be used to identify or locate a family member, personal representative, or other person responsible for the care of the patient. The requirement that the health care provider or facility record the fact, date, recipient, and content of a disclosure in the patient's medical record is removed.

Staff Summary of Public Testimony:

(In support) This bill will bring Washington confidentiality laws into closer alignment with federal patient confidentiality laws. Oftentimes confidentiality laws put family members on the sidelines when it comes to helping loved ones recover from mental health conditions. Family members should be a part of the treatment team because studies show that this will lead to better outcomes. Sometimes when persons are incapacitated they disappear, and it can be very frustrating when a person is looking for a loved one, but cannot receive answers about their location or safety. This bill will ease the minds of family members of people with a mental condition. People have had a difficult time getting information about family members who are in custody and have a mental illness. Many times families are the only ones who can help a person with a mental health condition. In cases where a person is suicidal and has stopped taking medications, it may be helpful for the health care provider to notify family members.

This bill provides discretionary authority to health care providers to disclose health care information in limited circumstances. This bill provides civil immunity to health care providers. This bill looks to the professional judgment of health care providers and requires that disclosures be limited to the minimum amount of information to accomplish the purpose of the disclosure. The reduction of the standard to an urgent threat will keep the public safe. This bill is a thoughtful approach to patient privacy while also giving families an opportunity to be involved in the recovery of a loved one. The protections for the civil liberties of persons with mental illness were well designed; however, the pendulum has swung too far. Existing state laws are overly restrictive and not in alignment with federal laws; and they make it difficult, if not impossible, to get information about a person's children. Mental health facilities refuse to give even the most limited information without signed consent; however, individuals with mental illness cannot always obtain consent. Providers should be allowed to disclose the minimum amount of information; it will minimize the threat of harm to others.

(Opposed) State patient confidentiality standards say that health care information is personal and can harm patients if improperly released. There are concerns about the ways that disclosure may happen in this bill. These are dramatic changes to current practice, such as allowing disclosure when a patient is not present. The treatment provider is allowed to make inferences when deciding to disclose health care information. There is vagueness in some of the wording and nobody will understand what it means. The reason for the disclosure should be documented in the medical record.

(Other) There are concerns about the structure of the bill and how it fits with current state and federal laws. The term "health care facility" should be included. The language tracks some federal patient confidentiality language, but there are some omissions. The "serious and urgent" language should be changed to the federal standard of "serious and imminent." An amendment would provide consistency and clarity around what state law allows.