NOTE: As provided in LFC policy, this report is intended for use by the standing finance committees of the legislature.  The Legislative Finance Committee does not assume responsibility for the accuracy of the information in this report when used in any other situation.

Only the most recent FIR version, excluding attachments, is available on the Intranet. Previously issued FIRs and attachments may be obtained from the LFC office in Suite 101 of the State Capitol Building North.

(Parenthesis ( ) Indicate Expenditure Decreases)

SOURCES OF INFORMATION

Health Policy Commission (HPC)

Public Regulation Commission (PRC)

Retiree Health Care Authority (RHCA)

SUMMARY

     Synopsis of SPAC Amendment

The SPAC amendment has changed the requirement that rules promulgated by the Superintendent of Insurance under this bill must be at least as restrictive as the federal requirements. The rules must "meet" the applicable federal requirements.

Synopsis of Original Bill

The bill authorizes and directs the Superintendent of Insurance to promulgate rules to protect the privacy of insurance consumers' "nonpublic personal information," including personal health and financial information.

Significant Issues

The bill is prompted by the passage of the federal Gramm, Leach, Bliley Act, Public Law 106-102, which repealed the Glass-Steagal Act and permitted the combination of the banking, securities, and insurance industries under common ownership. Title V of Gramm, Leach, Bliley Act requires states to adopt insurance rules to "insure the security and confidentiality of customer records and information" and to "protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer."

Current state law authorizes privacy rules for managed care organizations such as HMOs, but does not extend to other health insurers and other types of insurers that might possess nonpublic personal information of its customers.

SB 352 extends the authority of the PRC to promulgate regulations beyond the federal legislation by establishing the Gramm, Leach, Bliley Act as the floor-not the ceiling.

ADMINISTRATIVE IMPLICATIONS

No new FTE required. Some oversight and enforcement will be required, but the PRC does not think that the burden will be significant.

OTHER SUBSTANTIVE ISSUES

The HPC has provided the following:

• Privacy of personal health and financial information is a great concern of New Mexico's citizens due to the lack of regulatory protections regarding privacy and the potential for abuse of this information. However, the federal government, through its rulemaking capacity has already introduced legislation, The Health Insurance Portability and Accountability Act of 1996 (HIPPA). The section referred to as Administrative Simplification includes extensive provisions for privacy. The privacy rules that were recently published in the Federal Register consist of some 1500 pages of detailed rules. In addition, over 40,000 pages of comments were received by the federal Department of Health and Human Services (HHS) prior to their publication of the final rules. Insurance companies, their associated health plans, providers and business associates meet the definition of "covered entities" under the HIPAA privacy rules and are already required to comply with the federal regulations. A state legislative initiative may be redundant.



• The federal privacy rules further state that they apply to all individually identifiable health information that is transmitted or maintained in any form. This means that any information that is created or received by a health care provider, health plan, employer, or health care clearinghouse that relates to the provision or payment for health care, or physical or mental health and identifies or could reasonably identify the individual is covered by the rule. Health information is broadly defined as any information that relates to provision or payment of health care or physical, mental or behavioral health. Health care is defined as care, counseling, service or procedure related to physical, mental or behavioral condition or functional status; sale/dispensing of prescription items; or procurement/banking of blood, organs, genetic material, etc. The federal rule applies not only to personal health information, but is also protective of financial information as well.

• Covered entities may use or disclose protected information only as permitted or required by the rule. This means that insurance companies and their associated trading partners could disclose the protected information with consent, for treatment, payment or health care operations; without consent, if not required, for treatment, payment or health care operations, except for psychotherapy notes; pursuant to an authorization; pursuant to an agreement, to the individual; or as otherwise permitted by the rule. Only the minimum amount of information that is necessary to accomplish the intended purpose may be disclosed. For example, if the patient presents at an emergency room with a suspected leg fracture, his/her psychiatric records are not relevant to the intended purpose and may not be disclosed. Covered entities must make reasonable efforts to limit access by members of their workforce to the amount of information necessary to carry out their duties, and must implement policies and procedures for limiting disclosures.

• Consent must be obtained prior to using or disclosing protected information for purposes of treatment, payment or health care operations. The rule contains specific requirements for the consent to be valid.

• Authorization must be obtained for use or disclosure of protected information, except as otherwise permitted or required by the rule.

• Individuals have a right to inspect and obtain a copy of their protected information for as long as the information is maintained by the covered entity, except for psychotherapy notes, information compiled for litigation, or information exempted under certain federal laws.

• Individuals also have a right to have a covered entity amend their protected information for as long as the entity maintains their information.

• The rule also provides procedures for accepting or denying amendments; timelines for responding to request for amendments (60 days); procedures for the individual to file a statement of disagreement, and the entity to file a rebuttal statement, if the amendment is denied; and procedures for providing notification of certain past and future recipients of the protected information.

• Individuals have a right to receive an accounting of the disclosures of their protected health information made by a covered entity in the past six years, except for disclosures for treatment, payment or health care operations; disclosures made to the individual; disclosures made for directory or family notification purposes; disclosures for national security purposes or made to correctional or law enforcement officials or disclosures that occurred prior to the compliance date for the rule.

• There are specific exemptions to the privacy rule that do not require individual permission. These include when disclosure is required by law, for public health purposes, for health oversight activities required by law, for judicial and administrative proceedings in response to a court order, a subpoena, discovery request, or other legal process if the individual has been notified and had an opportunity to object to the disclosure. Other exemptions include for law enforcement use, for health services research as approved by an Institutional Review Board (IRB), and if there is reason believe there is a serious and imminent threat to the health or safety of a person or the public, for Workers' Compensation purposes, for organ donation and for victims of abuse, neglect and domestic violence.

• The rule also outlines numerous changes in administrative practices. These changes include new business processes, policies and procedures, staff training and will require additional organizational resources.

• The date for compliance will be for providers, health plans and health care clearinghouses, February 26, 2003. For small health plans, the date is pushed back one year until February 26, 2004.

• The rule preempts any contrary provision of state law, with limited exceptions. A provision of state law relating to the privacy of health information that is more stringent than the rule would not be preempted.

• Finally, the cost to the industry of implementing these new federal privacy regulations is significant, especially for providers in private practice. Sufficient time is needed to implement the new requirements for privacy protection, adopt new business processes that are compliant with the rule, designate a privacy official to write policies and procedures, train staff, and develop sanctions for staff member who fail to comply with the rule.

• Given the enormous change in business practices and the broad scope of the federal rules, perhaps it would be prudent to follow the federal timelines for implementation of this wide-reaching change in health care.

DW/lrs:njw:prr:ar