NOTE: As provided in LFC policy, this report is intended for use by the standing finance committees of the legislature.  The Legislative Finance Committee does not assume responsibility for the accuracy of the information in this report when used in any other situation.

Only the most recent FIR version, excluding attachments, is available on the Intranet. Previously issued FIRs and attachments may be obtained from the LFC office in Suite 101 of the State Capitol Building North.

(Parenthesis ( ) Indicate Expenditure Decreases)

SOURCES OF INFORMATION

Human Services Department (HSD)

Health Policy Commission (HPC)

Retiree Health Care Authority (RHCA)

No Response

Department of Health (DOH)

SUMMARY

Synopsis of Bill

HB 829 creates privacy protections for personally identifiable health information, imposes obligations on persons who handle this information, restricts use and disclosure of this information except in specified circumstances, establishes personal rights to access and correct this information, require safeguards to protect the confidentiality of this information, creates civil and criminal penalties for misuse of this information and authorizes the DOH to issue regulations and oversee compliance.

Significant Issues

HB 829 tracks changes required by the Federal Health Insurance Portability and Accountability Act (HIPAA), though it is less specific

The HPC provided the following issues:

• HB 829 creates a category of "health information managers" who are subject to requirements in using and disclosing protected health information, safeguarding it, and providing individuals with access to it. A significant concern is the broad definition of "health information manager." Anyone who receives, obtains, creates, uses, maintains or discloses health information is a "health information manager" subject to all of the requirements. The definition does not require any intent to receive or obtain information, nor does it contain any language to indicate, for example, that the information be routinely or regularly received, or obtained in the regular course of business. A one-time receipt of protected health information makes a person a health information manager for purposes of that information, thereby requiring the person to post a notice of information prices and establish safeguards to protect the information's confidentiality. Disclosure of protected health information to another person, even when specifically authorized by the or when required by law, makes the recipient a health information manager. The category of health information managers could encompass, for example, teachers, journalists and an individual's family members or friends.



• SB676 applies to everyone's protected health information, meaning that inmates would have the same privacy rights and privacy expectations as anyone else, despite the fact that the special nature of imprisonment following conviction requires far greater oversight and control of information than is imposed on individuals outside of prison.



• The circumstances in which health information managers may disclose protected health information without authorization are very limited. There are no provisions for disclosures for public health purposes (unless this is otherwise required by law); for research purposes; for prevention of threatened immediate harm; for emergencies; for informing family and friends of an individual's condition (e.g., after surgery); or for including an individual's name in the directory of patients in a health care facility.



• The requires that individuals be provided access to their protected health information "in a timely manner." This lack of specificity could lead to differing interpretations and disagreements concerning timeliness.



• SB676 allows health information managers to deny access to protected health information only if disclosure of the information is legally prohibited . There are no provisions for denial when disclosure is reasonably likely to endanger an individual or a law enforcement operation, or when disclosure would reveal the identity of a person who provided information under a promise of confidentiality. Nor is there a provision for appeal or independent review of denials.

HSD says that in order to comply with HB 829, there would be significant changes required in MAD's Medicaid Management Information System (MMIS) to maintain a history of information disclosures, as well as a person's permission to use or disclose information. HSD could face monetary penalties in accordance with HB 829 if found in violation of state and federal statutes and regulations.

The HPC indicates that the costs to both government and business will be substantial, but is unable to quantify them.

DOH did not respond, but there will likely be significant cost to DOH as well.

ADMINISTRATIVE IMPLICATIONS

HSD indicates that there are significant implications to the required notifications and maintenance of disclosure history and use of information. The magnitude of such tracking would require significant computer system changes that could be costly and would require significant time to implement. It would be impossible to accomplish all of the changes manually. HB 829 does not provide for funding or for the necessary time in which MAD could implement such changes.

DOH will need to allocate significant staff and resources to accomplish the provisions of HB 829.

DUPLICATION/RELATIONSHIP

Duplicates SB 676, Health Information Privacy Act

Relates to HB 750, Consumer Privacy Act

DW/ar/njw