Senate Bill No. 30

(By Senator Hunter)

____________

[Introduced January 14, 1998;

referred to the Committee on Health and Human Resources; and then to the Committee on the Judiciary.]

____________




A BILL to amend chapter sixteen of the code of West Virginia, one thousand nine hundred thirty-one, as amended, by adding thereto a new article, designated article one-a, relating to the creation of the uniform health care information act; legislative findings; definitions; notice of information practices; patient's right to examine or copy health care information; authority to act for a patient; requiring health care provider to effect reasonable safeguards for security of all health care information it maintains; providing for criminal and civil liability; criminal penalties; and authorizing civil actions and court-ordered relief.

Be it enacted by the Legislature of West Virginia:
That chapter sixteen of the code of West Virginia, one thousand nine hundred thirty-one, as amended, be amended by adding thereto a new article, designated article one-a, to read as follows:
ARTICLE 1A. UNIFORM HEALTH CARE INFORMATION ACT.
§16-1A-1. Legislative findings.
The Legislature finds that:
(a) Health care information is personal and sensitive information that if improperly used or released may do significant harm to a patient's interests.
(b) Patients need access to their own health care information as a matter of fairness to enable them to make informed decisions about their health care and correct inaccurate or incomplete information about themselves.
(c) In order to retain the full trust and confidence of patients, health care providers have an interest in ensuring that health care information is not disclosed improperly, and in having clear and certain rules for the disclosure of health care information.
(d) Persons other than health care providers obtain, use and disclose health record information in many different contexts and for many different purposes. It is the public policy of this state that a patient's interest in the proper use and disclosure of the patient's health care information survives even when the information is held by persons other than health care providers.
(e) The movement of patients and their health care information across state lines, access to and exchange of health care information from automated data banks, and the emergence of multistate health care providers creates a compelling need for uniform law, rules and procedures governing the use and disclosure of health care information.
§16-1A-2. Definitions.
As used in this article unless the context otherwise requires:
(a) "Audit" means an assessment, evaluation, determination or investigation of a health care provider by a person not employed by or affiliated with the provider to determine compliance with:
(1) Statutory, regulatory, fiscal, medical or scientific standards;
(2) A private or public program of payments to a health care provider; or
(3) Requirements for licensing, accreditation or certification.
(b) "Directory information" means information disclosing the presence and the general health condition of a particular patient who is an inpatient in a health care facility or who is currently receiving emergency health care in a health care facility, or who is receiving health care in the house or through an outpatient care facility.
(c) "General health condition" means the patient's health status described in terms of "critical," "poor," "fair," "good," "excellent" or terms denoting similar conditions.
(d) "Health care" means any care, service or procedure provided by a health care provider:
(1) To diagnose, treat or maintain a patient's physical or mental condition; or
(2) That affects the structure or any function of the human body.
(e) "Health care facility" means a hospital, clinic, nursing home, laboratory, office, in-home or similar place where a health care provider provides health care to patients.
(f) "Health care information" means any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and relates to the patient's health care. The term includes any record of disclosures of health care information.
(g) "Health care provider" means a person who is licensed, certified or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession. The term does not include a person who provides health care solely through the sale or dispensing of drugs or medical devices.
(h) "Institutional review board" means any board, committee or other group formally designated by an institution, or authorized under federal or state law, to review, approve the initiation of or conduct periodic review of research programs to assure the protection of the rights and welfare of human research subjects.
(i) "Maintain" as related to health care information, means to hold, possess, preserve, retain, store or control that information.
(j) "Patient" means an individual who receives or has received health care. The term includes a deceased individual who has received health care.
(k) "Person" means an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency or any other legal or commercial entity.
§16-1A-3. Patient's right to examine or copy health care information.
(a) A health care provider who provides health care through a health care organization that the provider operates and who maintains a record of a patient's health care information shall create a "notice of information practices" that contains substantially the following:
"We keep a record of the health care services we provide you. You may ask us to see and copy that record. You may also ask us to correct that record. We will not disclose your record to others unless you direct us to do so or unless the law authorizes or compels us to do so. You may see your record or get more information about it at ...."
(b) The health care provider shall post a copy of the notice of information practices in a conspicuous place in the health care facility and provide patients with information about its availability, upon request, and provide patients or prospective patients with a copy of the notice.
§16-1A-4. Patient's representative to act in good faith to represent the best interests of patient.
(a) A person authorized to consent to health care for another may exercise the rights of that person under this article to the extent necessary to effectuate the terms or purposes of the grant of authority. If the patient is a minor and is authorized to consent to health care without parental consent under the laws of this state, only the minor may exclusively exercise the rights of a patient under this article as to information pertaining to health care to which the minor lawfully consented.
(b) A person authorized to act for a patient shall act in good faith to represent the best interests of the patient.
A personal representative of a deceased patient may exercise all of the deceased patient's rights under this article. If there is no personal representative, or upon discharge of the personal representative, a deceased patient's rights under this article may be exercised by persons who are authorized by law to act for the deceased patient, including a health care surrogate.
§16-1A-5. Health care provider to effect reasonable safeguards for security of all health care information it maintains.
A health care provider shall effect reasonable safeguards for the security of all health care information it maintains.
A health care provider shall maintain a record of existing health care information for at least one year following receipt of an authorization to disclose that health care information and during the pendency of a request for examination and copying or a request for correction or amendment.
§16-1A-6. Criminal liability; penalty.
(a) A person who willfully discloses health care information in violation of this article, and who knows or should know that disclosure is prohibited, is guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than five hundred dollars, or confined in the county or regional jail not more than six months, or both fined and confined.
(b) A person who, by means of: (1) Bribery; (2) theft; (3) misrepresentation of identity, purpose of use, or entitlement to the information; or (4) trespass, examines or obtains, in violation of this article, health care information maintained by a health care provider, is guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than five hundred dollars, or confined in the county or regional jail not more than six months, or both fined and confined.
(c) A person who, knowing that a certification or a disclosure authorization is false, willfully presents the certification or disclosure authorization to a health care provider, is guilty of a misdemeanor and, upon conviction thereof, shall be fined not more than five hundred dollars, or confined in the county or regional jail not more than six months, or both fined and confined.
§16-1A-8. Civil liability; civil actions; court orders.
The attorney general or appropriate local law-enforcement official may maintain a civil action to enforce this article. The court may order any relief authorized by this section.
(a) A person aggrieved by a violation of this article may maintain an action for relief as provided in this section.
(b) The court may order the health care provider or other person to comply with this article and may order any other appropriate relief.
(c) A health care provider who relies in good faith upon a certification is not liable for disclosures made in reliance on that certification.
(d) In an action by a patient alleging that health care information was improperly withheld under the provisions of this article, the burden of proof is on the health care provider to establish that the information was properly withheld.
(e) If the court determines that there is a violation of this article, the aggrieved person is entitled to recover damages for pecuniary losses sustained as a result of the violation; and, in addition, if the violation results from willful or grossly negligent conduct, the aggrieved person may recover not in excess of five thousand dollars, exclusive of any pecuniary loss.
(f) If a plaintiff prevails, the court may assess reasonable attorney's fees and all other expenses reasonably incurred in the litigation.
(g) Any action under this article is barred unless the action is commenced within ten years after the cause of action accrues.



NOTE: The purpose of this bill is to protect patients from the improper disclosure of health care information. It requires health care providers to provide patients with notice of information practices; affirms the patient's right to examine or copy health care information; establishes the responsibilities of persons with authority to act for a patient; requires health care provider to effect reasonable safeguards for security of all health care information it maintains; provides for criminal and civil liability; criminal penalties; and authorizes civil actions and court ordered relief.

This article is new; therefore, strike-throughs and underscoring have been omitted.