STATE SUPPLEMENTAL HEALTH PRIVACY LAWS

Transcription

1 AL None N/A AK None N/A AZ None N/A AR None N/A CA Health and Safety Code Civil Code Civil Code Civil Code Civil Code Requires clinics and health facilities to report any unlawful or unauthorized access, use or disclosure of a patient s medical information to the affected patient and the state within five business days of the clinic or facility s detection of the breach. Makes providers, health plans, pharmaceutical companies and contractors liable for negligently creating, maintaining, preserving, storing, abandoning, destroying or disposing of medical information. Prohibits an authorized recipient of Protected Health Information (PHI) from further disclosing that information without a new authorization. Provides for possible civil and criminal penalties for a health care service plan s negligent or willful disclosure of genetic test results without written authorization. Requires employers who receive medical information to establish procedures to protect the information, including training of employees and agents and security systems that restrict access to files containing medical information. CO CRSA Makes obtaining a medical record or medical information with the intent to appropriate the information, steal it, disclose it to an unauthorized person or make an unauthorized copy a Class 6 felony. CT CGSA 38a-983 Requires insurance companies, agents and support organizations to provide an accounting of all disclosures of PHI over the past two years and a summary of how to request correction, amendment or deletion of PHI within 30 days of a written request. CGSA 38a-984 CGSA 38a-988a Requires insurance companies, agents and support organizations to, within 30 days of a written request to correct, amend or delete PHI, either make the requested change or allow the individual to submit a statement specifying what he or she believes is the correct, relevant or fair information. The insurance company, agent or support organization must then provide notice of the modification or the individual s statement to any person who may have received or furnished the disputed PHI within the previous two years. Provides a private cause of action against a person who discloses PHI for marketing purposes without authorization. AOA DIVISION OF STATE GOVERNMENT AFFAIRS AUGUST 2012

2 CGSA 38a-993 CGSA 38a-999 CGSA 38a-999a DE 16 Del. C. 1232/1212 Provides for civil penalties for the negligent or intentional violation of the Connecticut Insurance Information and Privacy Protection Act. Requires insurance companies, agents, and support organizations to develop policies, standards and procedures to protect PHI, including appropriate training of employees. Prohibits intentionally disclosing PHI with malicious intent to damage an individual s reputation or character. Violators are subject to fines or imprisonment. A person who has received PHI from the state may not disclose the information to another person without the patient s authorization, except as authorized by law. FL FSA (11) Requires employees of record owners to be trained in confidentiality and security policies, standards and procedures. GA Ga. Code Ann Ga. Code Ann Ga. Code Ann Requires a request for medical records to be accompanied by a HIPAA authorization and a signed written authorization that states that the person requesting the records is authorized to have access to the records. Any provider is justified in relying upon this written authorization. Any provider who releases PHI in good faith and pursuant to the state s requirements is immune from civil and criminal liability. Provides that an individual whose health information is reported to the state s Health Care Data System but does not identify the person by name or address has no cause of action against a person, entity or provider who reported the information without malice or willful intent to injure. HI None N/A ID None N/A IL 210 ILCS 85/6.17 A hospital staff member, agent or employee who willfully or wantonly discloses hospital or medical information, except as provided by this statute, is guilty of a Class A misdemeanor. 215 ILCS 5/1009 Requires insurance companies, agents and support organizations to provide the names of the individuals or organizations who received personal information over the prior two years, within 30 business days of a written request. 410 ILCS 305/13 Provides a private right of action against a person who negligently, intentionally or recklessly discloses the identity of the subject of an AIDS/HIV test or the results of such a test in a manner that permits identification of the subject of the test. 410 ILCS 513/40 Provides a private right of action against a person who unlawfully discloses a patient s genetic information. 740 ILCS 110/15 Provides a private right of action against a person who unlawfully discloses information concerning a patient s mental health or developmental disability. IN IC Provides that a person who is responsible for recording, reporting or

3 IC maintaining communicable disease information and recklessly, knowingly or intentionally discloses or fails to keep this information confidential commits a Class A misdemeanor. Provides that a person who fails to protect the identity of an individual whose information is reported as part of a public health project commits a Class C infraction. IA ICA 141A.11 Provides for possible civil and criminal penalties and a private right of action against a person who unlawfully discloses information concerning AIDS/HIV testing. KS KSA Makes the willful unlawful disclosure of mental health records a Class C misdemeanor. KY None N/A LA LSA-RS 22:1023 Provides a cause of action against any person who negligently collects, stores or analyzes a DNA sample or discloses genetic information without informed written consent. ME 5 MRSA D Requires providers and others with access to records containing HIV status to have a written policy with disciplinary procedures for violation of the confidentiality policy. 22 MRSA 1711-C Provides for civil penalties and a private cause of action against an individual who unlawfully discloses health care information. MD MD Code, Insurance MD Code, Insurance Provides a private cause of action against an insurer that knowingly and unlawfully discloses an insured s medical information or claims records. Provides a private cause of action against a nonprofit insurer that knowingly and unlawfully discloses an insured s medical information or claims records. MA MGLA 175I 8 Requires insurance companies, agents and support organizations to provide the names of the individuals or organizations who received personal information over the prior two years, within 30 business days of a written request. MI MCLA Provides patients and authorized patient representatives the right to examine or obtain the patient s medical records. Also requires health care providers and facilities to respond within 30 days, or 60 days if records are stored off-site. MCLA Exempts third party payers, insurers and self-funded plans from the Medical Records Access Act. MN MSA Requires providers to give a patient complete and current information concerning the patient s diagnosis, treatment and prognosis in terms and language that the patient can reasonably be expected to understand. MSA Requires providers to document in a patient s health record when they release the records as authorized by law, but without the patient s consent. Also permits a provider or group purchaser to release patient information to a record locator service, unless the patient chose to be excluded from the service.

4 MSA MS Miss. Code Ann Provides a cause of action for compensatory damages, costs and reasonable attorney fees against a person who negligently or intentionally violates the Minnesota Health Records Act in connection with a request for or release of a health record, forges or materially alters another person s consent form without their consent, or obtains another person s consent form or records under false pretenses. Also provides the same against a health information exchange or record locator service that negligently or intentionally fails to give a patient the option of opting out of the record locator service or fails to remove the patient s information from the record service if the patient opts out. Exempts the Mississippi Health Information Network (MS-HIN) from the requirement to provide patients with their personal medical information or records. MO VAMS Requires providers to provide a patient or authorized representative with a copy of the patient s medical record, if doing so is consistent with the patient s condition and sound therapeutic treatment. VAMS VAMS VAMS Provides a cause of action against a person who unlawfully discloses information regarding a patient s HIV test. Requires physicians to maintain a complete patient record for each patient. Permits records to be stored electronically only if they are capable of being printed for review by the state board. Permits the Director of Insurance, Financial Institutions and Professional Registration to issue an executive order or file a civil suit to prevent the unlawful disclosure of genetic information. MT MCA Requires a provider to respond to a patient s written request to copy or examine health information within 10 days. Also requires the provider to provide an explanation of any code or abbreviation used in the information upon request. MCA MCA through NE Neb. Rev. St Requires a provider to respond to a patient s written request to amend a health care record within 10 days. Provide for criminal penalties, civil enforcement and a private right of action for violations of the Uniform Health Care Information Act. Requires a provider to respond to a written request to examine records within 10 days and respond to a request for a copy of records within 30 days. NV NRS Requires a provider to make records available for inspection within five working days, or 10 working days if the records are stored in another state. NRS NRS NRS Makes a physician s willful violation of NRS a misdemeanor. Makes the unauthorized access of an electronic health record or a health exchange a misdemeanor. Also provides an action for damages that result from the unauthorized access. Requires a patient to provide informed consent before having his or her health care records included or transmitted in a health

5 NH NH Rev. Stat I:1 NH Rev. Stat I:2 NH Rev. Stat I:3 NH Rev. Stat I:4 information exchange. Also requires a patient to be notified of a breach of confidentiality of records or an exchange in the manner prescribed by the Director of the Department of Health and Human Services. Prohibits the release or use of patient identifiable medical information for sales or marketing purposes without written authorization. Grants a patient the right to obtain a report with information on all health care providers that had access to the patient s electronic medical record over the previous three years. Requires health information organizations to maintain an audit log. Also provides that a patient must be given the option of opting out of sharing information in the health insurance exchange. Requires providers and business associates to obtain an authorization to use protected health information for marketing. Also prohibits health information from being disclosed in an unsecure method of communication. NJ NJSA 17:23A-8 Requires an insurance institution, agent or support organization to respond to an individual s written request to access his or her recorded personal information within 30 business days. NJSA 17:23A-9 NJSA 17:23A-13 NM NMSA B-6 NY NMSA B-7 NMSA Public Health Law, 18 Requires an insurance institution, agent or support organization to respond to a written request to correct, amend or delete personal information within 30 business days. If a change is made or a statement of disputed information is filed, any person who is identified by the individual requesting the change who may have received the information within the past two years must be notified. Requires an insurance institution, agent or support organization to give individuals the opportunity to indicate they do not want their personal information disclosed for marketing purposes. Requires a health information exchange to provide an audit log containing information about the disclosure of the person s health information. Also requires record locator services and health information exchanges to allow individuals to exclude their information within 30 days of a written request. Provides that a record locator service, health information exchange, health care institution or provider that complies with an individual s request to exclude information is not liable for harm caused by the exclusion. Requires a provider to provide a patient or former patient who is applying for SSDI benefits or appealing a denial of SSDI benefits with a copy of his or her medical records within 30 days of the receipt of the request. Also permits the Department of Health to fine a provider $100 for a violation of this section. Requires a provider to allow a patient or a qualified individual to inspect a patient s information within 10 days of a written request

6 and permits a provider to notify the subject of such a request who is 12 years of age or older, and deny the request if the subject objects to the disclosure. Also permits a qualified person to challenge the accuracy of patient information and insert a statement into the challenged information. NC NCGSA 122C-52 Makes the unlawful disclosure of confidential mental health information a Class 3 misdemeanor punishable by a fine of up to $500. NCGSA , NCGSA NCGSA NCGSA Requires insurance institutions and agents to provide applicants and policyholders with written or electronic notice of their privacy policies. Requires an insurance institution, agent or support organization to respond to a written request for access to recorded personal information within 30 days. Requires an insurance institution, agent or support organization to respond to a request to correct, amend or delete recorded personal information within 30 days. Also requires notice of a change or statement of disagreement to be sent to any person designated by the individual who may have received the information over the past two years. ND NDCC Makes the knowingly unlawful disclosure of protected health information a Class A misdemeanor. NDCC Prohibits an insurance company or HMO from issuing or renewing a policy or health service contract unless it adopts and maintains procedures to ensure that all identifiable information maintained by the insurer is adequately protected and remains confidential in compliance with federal and state laws and professional ethical standards. OH RC Requires an insurance company to provide a copy of an enrollee s signed release to a health care facility or provider that requests it in response to the insurer s request for medical information about the enrollee. RC OK 76 Okl. St. Ann. 19, 20 Permits a patient, patient s representative or other person authorized to request a patient s medical record to bring a civil action to enforce the patient s right of access to the record if a provider fails to provide access to or a copy of the patient s medical record within a reasonable time. Grants patients the right to obtain access to their medical records. Makes a provider s refusal to furnish the required records or information a misdemeanor. OR ORS Requires a person authorized to obtain, retain or use an individual s genetic information or DNA sample to maintain the confidentiality of the information or sample and protect it from unauthorized disclosure or misuse. ORS Prohibits the compelled disclosure of the identity of the subject of a

7 genetic test or a blood relative of the subject, except under certain circumstances. ORS Provides a private right of action to an individual or their blood relative, representative or estate for violation of the state s genetic privacy laws. ORS Makes the unlawful acquisition, retention or disclosure of genetic information a Class A misdemeanor. ORS Requires an insurer, producer or support organization to provide an individual with access to their recorded personal information within 30 business days of a written request. ORS Requires an insurer, producer or support organization to respond to a written request to correct, amend or delete recorded personal information within 30 business days. Also requires notice of a change or a statement of disagreement to be sent to designated persons who may have received the information within the prior two years. PA 35 PS 7607 Prohibits the disclosure of confidential HIV-related information, except under certain circumstances and prohibits the unauthorized subsequent disclosure of such information. Also requires institutional health care providers with access to HIV-related information to establish written procedures for the confidentiality and disclosure of RI Gen. Laws Gen. Laws Gen. Laws SC Code Code the records. Provides a cause of action for actual and punitive damages, as well as criminal penalties, for the unauthorized release or transfer of confidential health care information. Also requires third parties that receive confidential health care information to establish specific security procedures. Prohibits the sale of patient data in a health information exchange, except as authorized in writing by the patient participant authorization form. Provides a cause of action for actual and exemplary damages, as well as criminal penalties, for the violation of Chapter Requires an insurance support organization to provide an individual with information from their recorded personal information in the manner the organization prefers within 30 business days of a written request. Requires a physician to publish notice of intent to sell medical records at least three times in the 90 days preceding the sale. Notice must advise patients that they may retrieve their records if they do not want their records included in the sale. SD None N/A TN TCA Prohibits employers from selling an employee s identifiable medical information without the patient s consent. Violation of this section is a Class C misdemeanor. TCA Prohibits insurers and hospitals from selling a patient s identifiable health information without the patient s consent.

8 TX TCA TCA TCA Health & Safety Code Health & Safety Code Health & Safety Code Health & Safety Code Requires a provider to make patient records available for inspection and copying by the Department of Health. Requires a provider to provide a copy or summary of a patient s medical records within 10 working days of a written request to do so. Requires a provider to have a policy to protect a patient s information and dignity, including the use of de-identified data. Also prohibits the sale of a patient s name, address and other identifying information for any purpose. Defines covered entity to include any person who assembles, collects, analyzes, uses, evaluates, stores, transmits, possesses or stores PHI, including employees, agents and contractors who do so. Requires covered entities to train employees on state and federal PHI law. Requires health care providers who use electronic health records to provide a patient s records in electronic form within 15 days of a written request. Requires a covered entity to provide notice to an individual whose PHI is subject to electronic disclosure. The covered entity may satisfy this requirement by posting a general notice on its website. UT UCA 62A Makes the knowing or intentional and unauthorized disclosure of information regarding involuntary commitment a Class B misdemeanor. VT None N/A VA : : Requires a health care entity to respond to a request for copies of or electronic access to health records within 15 days. Requires government entities that are not HIPAA covered entities or business associates to notify the Commissioner of Health, the Office of the Attorney General, the subject of the medical information and any affected resident in the event of a breach or suspected breach of medical information. Also requires the entity that maintains electronic health data that the entity does not own or license to notify the owner or licensee of the information. Requires an insurance company, agent or support organization to provide the names of the individuals or organizations that their personal information was disclosed to over the previous two years within 30 business days of a written request. Requires insurance companies, agents, and support organizations to, within 30 days of a written request to correct, amend or delete PHI, either make the requested change or allow the individual to submit a statement specifying what he or she believes is the correct, relevant or fair information. The insurance company, agent or support organization must then provide notice of the modification or the individual s statement to any person who may have received or furnished the disputed PHI within the previous two years. Requires an insurer to obtain written authorization before disclosing

9 genetic information Provides a private cause of action against an insurance institution, agent or support organization that violates , , or WA RCWA Requires a health care provider to respond to a written request for a copy of a patient s records within 15 working days. WV W.Va. Code 16-3C- 3 Prohibits secondary disclosure of the results of an HIV-related test without authorization. W.Va. Code 33-25A-26 Provides criminal and civil penalties for the unauthorized disclosure of medical information by a health maintenance organization. W.Va. Code 33-25D-25 Provides criminal and civil penalties for the unauthorized disclosure of medical information by a prepaid limited health service organization. WI WSA Provides civil and criminal penalties and a private cause of action for WSA the unlawful disclosure of confidential health records. Requires an insurer that complies with a request to correct, amend or delete any recorded medical information in the insurer s possession to provide notice of this change to any person who may have received the information within the prior two years and is identified by the individual, any insurance support organization that provided the insurer with the information that was changed, and any insurance support organization that the insurer has systematically provided personal medical information to over the preceding seven years. WY WS Requires a hospital to respond to a patient s request to examine or copy health records within 10 days.