AN ACT Relating to the uniform health-care information act; adding a new section to chapter 42.17 RCW; adding a new chapter to Title 70 RCW; creating new sections; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

ARTICLE I

FINDINGS AND DEFINITIONS

NEW SECTION. Sec. 101. LEGISLATIVE FINDINGS. The legislature finds that:

(1) Health-care information is personal and sensitive information that if improperly used or released may do significant harm to a patient's interests in privacy, health care, or other interests.

(2) Patients need access to their own health-care information as a matter of fairness to enable them to make informed decisions about their health care and correct inaccurate or incomplete information about themselves.

(3) In order to retain the full trust and confidence of patients, health-care providers have an interest in assuring that health-care information is not improperly disclosed and in having clear and certain rules for the disclosure of health-care information.

(4) Persons other than health-care providers obtain, use, and disclose health-record information in many different contexts and for many different purposes. It is the public policy of this state that a patient's interest in the proper use and disclosure of the patient's health-care information survives even when the information is held by persons other than health-care providers.

(5) The movement of patients and their health-care information across state lines, access to and exchange of health-care information from automated data banks, and the emergence of multi-state health-care providers creates a compelling need for uniform law, rules, and procedures governing the use and disclosure of health-care information.

NEW SECTION. Sec. 102. DEFINITIONS. As used in this chapter, unless the context otherwise requires:

(1) "Audit" means an assessment, evaluation, determination, or investigation of a health-care provider by a person not employed by or affiliated with the provider to determine compliance with:

(a) Statutory, regulatory, fiscal, medical, or scientific standards;

(b) A private or public program of payments to a health-care provider; or

(2) "Directory information" means information disclosing the presence and the general health condition of a particular patient who is a patient in a health-care facility or who is currently receiving emergency health care in a health-care facility.

(3) "General health condition" means the patient's health status described in terms of "critical," "poor," "fair," "good," "excellent," or terms denoting similar conditions.

(4) "Health care" means any care, service, or procedure provided by a health-care provider:

(a) To diagnose, treat, or maintain a patient's physical or mental condition; or

(b) That affects the structure or any function of the human body.

(5) "Health-care facility" means a hospital, clinic, nursing home, laboratory, office, or similar place where a health-care provider provides health care to patients.

(6) "Health-care information" means any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient's health care. The term includes any record of disclosures of health-care information.

(7) "Health-care provider" means a person who is licensed, certified, registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession. The term does not include a person who provides health care solely through the sale or dispensing of drugs or medical devices.

(8) "Institutional review board" means any board, committee, or other group formally designated by an institution, or authorized under federal or state law, to review, approve the initiation of, or conduct periodic review of research programs to assure the protection of the rights and welfare of human research subjects.

(9) "Maintain," as related to health-care information, means to hold, possess, preserve, retain, store, or control that information.

(10) "Patient" means an individual who receives or has received health care. The term includes a deceased individual who has received health care.

(11) "Person" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or any other legal or commercial entity.

ARTICLE II

DISCLOSURE OF HEALTH-CARE INFORMATION

NEW SECTION. Sec. 201. DISCLOSURE BY HEALTH-CARE PROVIDER. Except as authorized in section 204 of this act, a health-care provider, an individual who assists a health-care provider in the delivery of health care, or an agent and employee of a health-care provider may but need not disclose health-care information about a patient to any other person with the patient's written authorization. A disclosure made under a patient's written authorization must conform to the authorization.

NEW SECTION. Sec. 202. PATIENT AUTHORIZATION TO HEALTH-CARE PROVIDER FOR DISCLOSURE. (1) A patient may authorize a health-care provider to disclose the patient's health-care information. A health-care provider may honor an authorization and, if requested, provide a copy of the recorded health-care information unless the health-care provider denies the patient access to health-care information under section 302 of this act.

(2) A health-care provider may charge a reasonable fee, not to exceed the health-care provider's actual cost for providing the health-care information, and is not required to honor an authorization until the fee is paid.

(3) To be valid, a disclosure authorization to a health-care provider must:

(a) Be in writing, dated, and signed by the patient;

(b) Identify the nature of the information to be disclosed;

(4) Except as provided by this chapter, the signing of an authorization by a patient is not a waiver of any rights a patient has under other statutes, the rules of evidence, or common law.

(5) A health-care provider shall retain each authorization or revocation in conjunction with any health-care information from which disclosures are made.

(6) Except for authorizations to provide information to third-party health-care payors, an authorization may not permit the release of health-care information relating to future health care that the patient receives more than ninety days after the authorization was signed.

(7) An authorization in effect on the effective date of this section remains valid for six months after the effective date of this section unless an earlier date is specified or it is revoked under section 203 of this act. Health-care information disclosed under such an authorization is otherwise subject to this chapter. An authorization written after the effective date of this section becomes invalid after the expiration date contained in the authorization, which may not exceed ninety days. If the authorization does not contain an expiration date, it expires ninety days after it is signed.

NEW SECTION. Sec. 203. PATIENT'S REVOCATION OF AUTHORIZATION FOR DISCLOSURE. A patient may revoke in writing a disclosure authorization to a health-care provider at any time unless disclosure is required to effectuate payments for health care that has been provided or other substantial action has been taken in reliance on the authorization. A patient may not maintain an action against the health-care provider for disclosures made in good-faith reliance on an authorization if the health-care provider had no actual notice of the revocation of the authorization.

NEW SECTION. Sec. 204. DISCLOSURE WITHOUT PATIENT'S AUTHORIZATION. (1) A health-care provider may disclose health-care information about a patient without the patient's authorization to the extent a recipient needs to know the information, if the disclosure is:

(a) To a person who the provider reasonably believes is providing health-care to the patient;

(b) To any other person who requires health-care information for health-care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to the health-care provider; or for assisting the health-care provider in the delivery of health care and the health-care provider reasonably believes that the person:

(i) Will not use or disclose the health-care information for any other purpose; and

(ii) Will take appropriate steps to protect the health-care information;

(c) To any other health-care provider reasonably believed to have previously provided health care to the patient, to the extent necessary to provide health care to the patient, unless the patient has instructed the health-care provider in writing not to make the disclosure;

(d) To any person if the health-care provider reasonably believes that disclosure will avoid or minimize an imminent danger to the health or safety of the patient or any other individual;

(e) To immediate family members of the patient, or any other individual with whom the patient is known to have a close personal relationship, if made in accordance with good medical or other professional practice, unless the patient has instructed the health-care provider in writing not to make the disclosure;

(f) To a health-care provider who is the successor in interest to the health-care provider maintaining the health-care information;

(g) For use in a research project that an institutional review board has determined:

(i) Is of sufficient importance to outweigh the intrusion into the privacy of the patient that would result from the disclosure;

(ii) Is impracticable without the use or disclosure of the health-care information in individually identifiable form;

(iii) Contains reasonable safeguards to protect the information from redisclosure;

(iv) Contains reasonable safeguards to protect against identifying, directly or indirectly, any patient in any report of the research project; and

(v) Contains procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention of identifying information for purposes of another research project;

(h) To a person who obtains information for purposes of an audit, if that person agrees in writing to:

(i) Remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified; and

(ii) Not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health-care provider or patient, or other unlawful conduct by the health-care provider;

(i) To an official of a penal or other custodial institution in which the patient is detained.

(2) A health-care provider may disclose health-care information about a patient without the patient's authorization if the disclosure is:

(a) Directory information, unless the patient has instructed the health-care provider not to make the disclosure;

(b) To federal, state, or local public-health authorities, to the extent the health-care provider is required by law to report health-care information or when needed to protect the public health;

(d) Pursuant to compulsory process in accordance with section 205 of this act.

NEW SECTION. Sec. 205. COMPULSORY PROCESS. (1) Health-care information may not be disclosed by a health-care provider pursuant to compulsory legal process or discovery in any judicial, legislative, or administrative proceeding unless:

(a) The patient has consented in writing to the release of the health-care information; or

(b) The health-care provider notified in writing the patient, the patient's attorney of record, or the patient's personal representative of the compulsory process or discovery request at least ten days before complying with that request. If the patient, the patient's attorney, or personal representative desires to contest the compulsory process or discovery request, such person may inform the health-care provider of such contest, and the health-care provider may then delay compliance until a decision from a court is obtained as to the disposition of the compulsory process or discovery request.

(2) A court shall review compulsory legal process or discovery requests which involve health-care information in terms of whether the party seeking information has demonstrated that the interest in access outweighs the patient's privacy interests.

(3) Production of health-care information under this section, in and of itself, does not constitute a waiver of any privilege, objection, or defense existing under other law or rule of evidence or procedure.

ARTICLE III

EXAMINATION AND COPYING OF RECORD

NEW SECTION. Sec. 301. REQUIREMENTS AND PROCEDURES FOR PATIENT'S EXAMINATION AND COPYING. (1) Upon receipt of a written request from a patient to examine or copy all or part of the patient's recorded health-care information, a health-care provider, as promptly as required under the circumstances, but no later than fifteen working days after receiving the request shall:

(a) Make the information available for examination during regular business hours and provide a copy, if requested, to the patient;

(b) Inform the patient if the information does not exist or cannot be found;

(c) If the health-care provider does not maintain a record of the information, inform the patient and provide the name and address, if known, of the health-care provider who maintains the record;

(d) If the information is in use or unusual circumstances have delayed handling the request, inform the patient and specify in writing the reasons for the delay and the earliest date, not later than twenty-one working days after receiving the request, when the information will be available for examination or copying or when the request will be otherwise disposed of; or

(e) Deny the request, in whole or in part, under section 302 of this act and inform the patient.

(2) Upon request, the health-care provider shall provide an explanation of any code or abbreviation used in the health-care information. If a record of the particular health-care information requested is not maintained by the health-care provider in the requested form, the health-care provider is not required to create a new record or reformulate an existing record to make the health-care information available in the requested form. The health-care provider may charge a reasonable fee, not to exceed the health-care provider's actual cost, for providing the health-care information and is not required to permit examination or copying until the fee is paid.

NEW SECTION. Sec. 302. DENIAL OF EXAMINATION AND COPYING. (1) A health-care provider may deny access to health-care information by a patient if the health-care provider reasonably concludes that:

(a) Knowledge of the health-care information would be injurious to the health of the patient;

(b) Knowledge of the health-care information could reasonably be expected to lead to the patient's identification of an individual who provided the information in confidence and under circumstances in which confidentiality was appropriate;

(c) Knowledge of the health-care information could reasonably be expected to cause danger to the life or safety of any individual;

(d) The health-care information was compiled and is used solely for litigation, quality assurance, peer review, or administrative purposes; or

(e) Access to the health-care information is otherwise prohibited by law.

(2) If a health-care provider denies a request for examination and copying under this section, the provider, to the extent possible, shall segregate health-care information for which access has been denied under subsection (1) of this section from information for which access cannot be denied and permit the patient to examine or copy the disclosable information.

(3) If a health-care provider denies a patient's request for examination and copying, in whole or in part, under subsection (1) (a) or (c) of this section, the provider shall permit examination and copying of the record by another health-care provider, selected by the patient, who is licensed, certified, registered, or otherwise authorized under the laws of this state to treat the patient for the same condition as the health-care provider denying the request. The health-care provider denying the request shall inform the patient of the patient's right to select another health-care provider under this subsection. The patient shall be responsible for arranging for compensation of the other health-care provider so selected.

ARTICLE IV

CORRECTION AND AMENDMENT OF RECORD

NEW SECTION. Sec. 401. REQUEST FOR CORRECTION OR AMENDMENT. (1) For purposes of accuracy or completeness, a patient may request in writing that a health-care provider correct or amend its record of the patient's health-care information to which a patient has access under section 301 of this act.

(2) As promptly as required under the circumstances, but no later than ten days after receiving a request from a patient to correct or amend its record of the patient's health-care information, the health-care provider shall:

(a) Make the requested correction or amendment and inform the patient of the action;

(b) Inform the patient if the record no longer exists or cannot be found;

(c) If the health-care provider does not maintain the record, inform the patient and provide the patient with the name and address, if known, of the person who maintains the record;

(d) If the record is in use or unusual circumstances have delayed the handling of the correction or amendment request, inform the patient and specify in writing, the earliest date, not later than twenty-one days after receiving the request, when the correction or amendment will be made or when the request will otherwise be disposed of; or

(e) Inform the patient in writing of the provider's refusal to correct or amend the record as requested, the reason for the refusal, and the patient's right to add a statement of disagreement.

NEW SECTION. Sec. 402. PROCEDURE FOR ADDING CORRECTION OR AMENDMENT OR STATEMENT OF DISAGREEMENT. (1) In making a correction or amendment, the health-care provider shall:

(a) Add the amending information as a part of the health record; and

(b) Mark the challenged entries as corrected or amended entries and indicate the place in the record where the corrected or amended information is located, in a manner practicable under the circumstances.

(2) If the health-care provider maintaining the record of the patient's health-care information refuses to make the patient's proposed correction or amendment, the provider shall:

(a) Permit the patient to file as a part of the record of the patient's health-care information a concise statement of the correction or amendment requested and the reasons therefor; and

(b) Mark the challenged entry to indicate that the patient claims the entry is inaccurate or incomplete and indicate the place in the record where the statement of disagreement is located, in a manner practicable under the circumstances.

ARTICLE V

NOTICE OF INFORMATION PRACTICES

NEW SECTION. Sec. 501. CONTENT AND DISSEMINATION OF NOTICE. (1) A health-care provider who provides health care at a health-care facility that the provider operates and who maintains a record of a patient's health-care information shall create a "notice of information practices" that contains substantially the following:

NOTICE

"We keep a record of the health-care services we provide you. You may ask us to see and copy that record. You may also ask us to correct that record. We will not disclose your record to others unless you direct us to do so or unless the law authorizes or compels us to do so. You may see your record or get more information about it at ............... ."

(2) The health-care provider shall place a copy of the notice of information practices in a conspicuous place in the health-care facility, on a consent form or with a billing or other notice provided to the patient.

ARTICLE VI

PERSONS AUTHORIZED TO ACT FOR PATIENT

NEW SECTION. Sec. 601. HEALTH-CARE REPRESENTATIVES. (1) A person authorized to consent to health care for another may exercise the rights of that person under this chapter to the extent necessary to effectuate the terms or purposes of the grant of authority. If the patient is a minor and is authorized to consent to health care without parental consent under federal and state law, only the minor may exercise the rights of a patient under this chapter as to information pertaining to health care to which the minor lawfully consented.

(2) A person authorized to act for a patient shall act in good faith to represent the best interests of the patient.

NEW SECTION. Sec. 602. REPRESENTATIVE OF DECEASED PATIENT. A personal representative of a deceased patient may exercise all of the deceased patient's rights under this chapter. If there is no personal representative, or upon discharge of the personal representative, a deceased patient's rights under this chapter may be exercised by persons who would have been authorized to make health care decisions for the deceased patient when the patient was living under RCW 7.70.065.

ARTICLE VII

SECURITY SAFEGUARDS AND RECORD RETENTION

NEW SECTION. Sec. 701. DUTY TO ADOPT SECURITY SAFEGUARDS. A health-care provider shall effect reasonable safeguards for the security of all health-care information it maintains.

NEW SECTION. Sec. 702. RETENTION OF RECORD. A health-care provider shall maintain a record of existing health-care information for at least one year following receipt of an authorization to disclose that health-care information under section 203 of this act, and during the pendency of a request for examination and copying under section 301 of this act or a request for correction or amendment under section 401 of this act.

ARTICLE VIII

CIVIL REMEDIES AND CRIMINAL SANCTIONS

NEW SECTION. Sec. 801. CRIMINAL PENALTY. (1) A person who willfully discloses health-care information in violation of this chapter, and who knew that disclosure is prohibited, is guilty of a misdemeanor.

(2) A person who, by means of (a) bribery, (b) theft, (c) misrepresentation of identity, purpose of use, or entitlement to the information, or (d) trespass, examines or obtains, in violation of this chapter, health-care information maintained by a health-care provider, is guilty of a gross misdemeanor, and upon conviction is punishable by a fine not exceeding ten thousand dollars or imprisonment for a period not exceeding one year, or both.

NEW SECTION. Sec. 802. CIVIL ENFORCEMENT. The attorney general, county prosecuting attorney, or city attorney may maintain a civil action to enforce this chapter. The court may order any relief authorized by section 803 of this act.

NEW SECTION. Sec. 803. CIVIL REMEDIES. (1) A person aggrieved by a violation of this chapter may maintain an action for relief as provided in this section.

(2) The court may order the health-care provider or other person to comply with this chapter.

(3) Any action under this chapter is barred unless the action is commenced within one year after the cause of action accrues.

ARTICLE IX

MISCELLANEOUS PROVISIONS

NEW SECTION. Sec. 901. CONFLICTING LAWS. (1) This chapter does not restrict a health-care provider from complying with obligations imposed by federal or state health-care payment programs or federal or state law.

(2) In the event of a conflict between this chapter on the uniform information practices act, the provisions of this chapter apply.

(3) This chapter does not apply to disclosure under RCW 13.50.100, 69.54.070, 71.34.200, or chapter 70.24 RCW.

NEW SECTION. Sec. 902. A new section is added to chapter 42.17 RCW to read as follows:

FREEDOM OF INFORMATION ACT. Chapter 70.-- RCW (sections 101 through 901 of this act) applies to public inspection and copying of health-care information of patients.

NEW SECTION. Sec. 903. UNIFORMITY OF APPLICATION AND CONSTRUCTION. This act shall be applied and construed to effectuate its general purpose to make uniform the law with respect to the subject of this act among states enacting it.

NEW SECTION. Sec. 904. SHORT TITLE. This act may be cited as the uniform health-care information act.

NEW SECTION. Sec. 905. SEVERABILITY. If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

NEW SECTION. Sec. 906. SAVING CLAUSE. This act does not affect other law restricting, to a greater extent than does this act, the disclosure of specific types of health-care information to any person other than the patient to whom it relates.

NEW SECTION. Sec. 907. CAPTIONS. As used in this act, captions constitute no part of the law.

NEW SECTION. Sec. 908. LEGISLATIVE DIRECTIVE. Sections 101 through 901 of this act shall constitute a new chapter in Title 70 RCW.