Background:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by the HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. The HIPAA allows a state to establish standards that are more stringent than its provisions. In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents or employees. The UHCIA provides that a health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; and judicial proceedings.Washington has heightened protections for information related to mental health, human immunodeficiency virus (HIV), and sexually transmitted disease (STD). For mental health information, the fact of admission and all information and records compiled in the course of providing services to patients at public or private mental health agencies is confidential. With respect to HIV and STD information, it is prohibited to disclose the identity of a person who has considered or requested a test for a STD; the identity of the subject of a HIV antibody test or test for any other STD; the results of those tests, and information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD. Both the protections related to mental health information and HIV and STD information have several exceptions to allow the disclosure of the information without the patient's authorization or consent.

Summary of Substitute Bill:

Human Immunodeficiency Virus and Sexually Transmitted Disease Information.

The prohibition against the disclosure of information regarding: (1) the identity of a person who has considered or requested a test for a sexually transmitted disease (STD); (2) the identity of the subject of a human immunodeficiency virus (HIV) antibody test or test for any other STD; (3) the results of those tests; and (4) information regarding the diagnosis of or treatment for HIV infection and for any other confirmed STD (collectively, "HIV and STD information") are removed. Human immunodeficiency virus and STD information is to be considered "health care information" under the Uniform Health Care Information Act (UHCIA) and all of its confidentiality and disclosure provisions apply.

Several permissible disclosures of HIV and STD information are eliminated. These include disclosures to:

the subject of the information;
any person who receives a specific release;
state, local, and federal health officers;
a person pursuant to a court order; and
claims management personnel for insurance payment purposes.

These disclosures are similar to permissible disclosures under the UHCIA.

Other permitted releases of HIV and STD information continue as exceptions to the UHCIA. The requirement that the Department of Health report annually to the State Board of Health regarding any incidents of unauthorized disclosures by agency or local health jurisdiction staff is repealed.

Mental Health Information.

The fact of admission and all information, records, and treatment records compiled in the course of providing services to voluntary or involuntary patients at mental health agencies are included in the definition of "health care information" under the UHCIA and all of its confidentiality and disclosure provisions apply. The standard for an individual to agree to release a record is changed from "informed written consent" to "authorization."

Several permissible disclosures of mental health-related information and records are eliminated. These include disclosures:

for making a claim for insurance or Medicaid;
for research pursuant Department of Social and Health Services (DSHS) rules;
to the Department of Health to determine compliance with licensing standards;
for management or financial audits;
to the DSHS or regional support network directors and staff as needed for billing and collection;
to staff at a treatment facility as needed for them to perform their duties;
to physicians and psychiatric advanced registered nurse practitioners to treat a medical emergency;
to health or mental health professionals and their administrative staff to coordinate care to the person; and
for coordinating health care through billing information from the DSHS to providers who have written a prescription for the patient in a prior year.

These disclosures are similar to permissible disclosures under the UHCIA.

Other permitted releases of mental health-related information and records continue as exceptions to the UHCIA. Additional protections are provided for copies of court documents maintained by health care providers and facilities that are related to proceedings regarding competency to stand trial and civil commitment determinations.

Legislative Findings and Intent.

Legislative findings are made regarding Washington's history of protecting health care information. Legislative intent is declared to improve the coordination of health care to patients.

Staff Summary of Public Testimony:

(In support) When trying to get health records to manage a patient, health care providers must follow different standards for sharing information, even though all of the providers are treating the same patient and all are covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The mental health and human immunodeficiency virus (HIV) protections passed before the HIPAA became law, but now those statutes apply to all health information. As providers move toward technology and electronic medical records, health information should be treated uniformly.

(Opposed) The assumption that stigma associated with HIV does not exist is flawed. These privacy protections allow outreach and prevention programs to speak with clients about personal issues via these protections. Testing protocols are reliant upon these privacy protections in order to encourage people to test because the individual can be assured of confidentiality. This bill came up too rapidly. The current statutory protections do not create administrative burdens in the Evergreen Health Insurance Program for billings and claims. Clients in group benefit settings are concerned about employers learning of their HIV status because the stigma still exists.