Washington State

House of Representatives

Office of Program Research

BILL

ANALYSIS

Health Care & Wellness Committee

HB 1005

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

Background:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information. Entities covered by the HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. The HIPAA allows a state to establish standards that are more stringent than its provisions.

Washington allows for the disclosure of health care information by health care providers and their agents or employees. A health care provider may not disclose health care information about a patient unless there is a statutory exception or a written authorization by the patient. Some exceptions include disclosures for the provision of health care; quality improvement, legal, actuarial, and administrative services; research purposes; directory information; public health and law enforcement activities as required by law; immediate family members; for penal or custodial institutions; for death investigations; for anatomical donation purposes; and judicial proceedings.

Until July 1, 2014, third-party payors were also prohibited from disclosing health care information without an authorization except to the extent that health care providers were allowed to make an unauthorized disclosure. After July 1, 2014, changes in state law restricted third-party payors to only sharing health care information without an authorization to provide health care; to provide quality improvement, legal, actuarial, and administrative services; to avoid imminent danger to a patient or other person; for payment; to assist government agencies with determining regulatory compliance; and to protect public health.

Summary of Bill:

The circumstances under which a third-party payor may release health care information without an authorization is expanded from circumstances related to providing health care; providing quality improvement, legal, actuarial, and administrative services; avoiding imminent danger to a patient or other person; providing payment; assisting government agencies with determining regulatory compliance; and protecting public health. The expanded authority allows third-party payors to disclose health care information without an authorization to the same extent that health care providers are authorized to disclose health care information under state health care privacy laws.