HBA-MPM H.B. 3254 76(R) BILL ANALYSIS
Office of House Bill AnalysisH.B. 3254
By: Maxey
Public Health
3/24/1999
Introduced
BACKGROUND AND PURPOSE
Protection of a patient's privacy with respect to personal health
information is a key issue as Texas makes use of new technology and means
of health care delivery, however, the public interest sometimes requires
using private information for the public good. The Department of Health
and Human Services and the Center for Disease Control have created a
committee to review and develop a working plan for all states to address
issues that have arisen because of this dilemma.
H.B. 3254 addresses privacy and security issues arising from the
acquisition, use, disclosure, and storage of identifiable health
information by public health agencies at the state and local levels.
RULEMAKING AUTHORITY
It is the opinion of the Office of House Bill Analysis that this bill does
not expressly delegate any additional rulemaking authority to a state
officer, department, agency, or institution.
SECTION BY SECTION ANALYSIS
SECTION 1. Amends Subtitle D, Title 2, Health and Safety Code, by adding
Chapter 93, as follows:
CHAPTER 93. PUBLIC HEALTH PRIVACY ACT
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 93.001. SHORT TITLE. Cites this chapter as the Public Health Privacy
Act.
Sec. 93.002. UNIFORMITY PROVISION. Provides that this chapter is a
uniform Act intended to be applied and construed to effectuate its general
purpose to make uniform the law among states enacting it with respect to
the subject of this chapter.
Sec. 93.003. LEGISLATIVE FINDINGS. Sets forth legislative findings.
Sec. 93.004. PURPOSES. Sets forth the purposes of this chapter.
Sec. 93.005. DEFINITIONS. Defines for the purposes of this chapter the
following terms: "amend," "confidentiality statement," "disclose" and
"disclosure," "expunge," "health oversight agency," "institutional review
board," "nonidentifiable health information," "protected health
information," "public health," "public health agency," "public health
official," "public health purpose," "public information," "request,"
"requestor," and "store" and "storage."
SUBCHAPTER B. ACQUISITION OF PROTECTED HEALTH INFORMATION
Sec. 93.031. ACQUISITION OF INFORMATION. Authorizes a public health
agency to acquire protected health information only under certain
conditions. Prohibits this information from being secretly acquired by a
public health agency. Makes this section applicable to the acquisition of
information from a federal, state, or local public health agency, as well
as other sources.
SUBCHAPTER C. USE OF PROTECTED HEALTH INFORMATION
Sec. 93.061. USE CONSISTENT WITH ORIGINAL PURPOSE. Provides that
protected health information may only be used by public health agencies for
public health purposes that are reasonably related to the purpose for which
the information was acquired.
Sec. 93.062. SUBSEQUENT USE. Authorizes a public health agency to use
protected health information for public health purposes that are not
reasonably related to the purpose for which the information was acquired
only if the agency could have acquired the information for that purpose
under Subchapter B.
Sec. 93.063. SCOPE OF USE. Authorizes a public health agency to use only
nonidentifiable health information to the extent possible to accomplish a
public health purpose. Requires the agency to use this information only in
accordance with this chapter and to the minimum extent reasonably believed
to be necessary to accomplish a public health purpose.
Sec. 93.064. COMMERCIAL USE PROHIBITED. Prohibits a public health agency
or public health official from using protected health information for a
commercial purpose.
Sec. 93.065. EXPUNGING INFORMATION. Requires a public health agency to
expunge in a confidential manner protected health information which no
longer furthers any public health purpose.
SUBCHAPTER D. DISCLOSURE OF PROTECTED
HEALTH INFORMATION
Sec. 93.101. INFORMATION NOT PUBLIC. Provides that protected health
information is not public information, except as provided by this chapter.
Prohibits this information from being disclosed without the informed
consent of the individual or individual's representative who is the subject
of the information.
Sec. 93.102. INFORMED CONSENT. (a) Defines "informed consent" for the
purposes of this chapter as a written authorization to disclose public
health information made on a form substantially similar to that prescribed
by the Texas Department of Health (department) that is signed in writing or
electronically by the individual who is the subject of the information.
Provides that the authorization must be dated and specify to whom the
disclosure is authorized, the general purpose of the disclosure, and the
period during which the authorization is effective.
(b) Authorizes an individual to revoke authorization in writing at any
time. Provides that the individual is responsible for informing the person
who originally received the authorization of its revocation.
(c) Provides that an authorization automatically expires six months after
the date it is signed if it does not contain an expiration date or is not
previously revoked.
(d) Provides that a general authorization for the disclosure of
information related to health is not sufficient to authorize disclosure of
protected health information for purposes of this chapter unless the
authorization complies with this section.
(e) Authorizes written authorization under Subsection (a) to be provided
by an individual's parent, guardian, or other person authorized under law
to make health care decisions for the individual if the individual who is
the subject of protected health information is incompetent or otherwise
legally unable to give informed consent for the disclosure. Provides that
a minor under the age of 14 is not considered competent to give informed
consent for purposes of this subsection.
Sec. 93.103. SCOPE OF DISCLOSURE. (a) Authorizes protected health
information to be disclosed with the informed consent of the individual who
is the subject of the information to persons and for purposes that are
authorized under the terms of the informed consent.
(b) Requires protected health information to be disclosed in a
nonidentifiable form to the extent consistent with accomplishing the public
health purpose unless the disclosure is made with the individual's informed
consent whenever this chapter allows the disclosure of such information
without the individual's informed consent.
(c) Requires the disclosure of protected health information be limited to
the minimum amount that the person making the disclosure reasonably
believes necessary to accomplish the purpose of the disclosure unless it is
made with the individual's informed consent whenever this chapter allows
the disclosure of such information without an individual's informed consent
and the information is not disclosed in a nonidentifiable form.
(d) Requires a disclosure of protected health information, when made under
this chapter, to be accompanied by a statement in writing or followed
within three days by a statement in writing if the information was
disclosed orally, concerning the public health agency's policy on
disclosure. Provides that the statement must include specific language,
and sets forth an example.
Sec. 93.104. DISCLOSURE WITHOUT INFORMED CONSENT. Authorizes protected
health information to be disclosed without an individual's informed consent
if the disclosure is made under certain conditions and for certain reasons.
Sec. 93.105. DISCLOSURE IN LEGAL PROCEEDING. (a) Prohibits protected
health information from being disclosed in a civil, criminal,
administrative, or other legal proceeding, including any disclosure in
response to a subpeona, as part of discovery, or through the testimony of
any person with knowledge about the information because of its acquisition
by a public health agency, except in accordance with this section.
(b) Authorizes a court to grant an order mandating the disclosure of
protected health information on an application by a public health agency or
public health official under certain circumstances.
(c) Requires the court, on receiving an application for an order
authorizing disclosure under this section, to enter an order directing that
all materials that are part of the application and decision of the court be
sealed. Prohibits these materials from being made available to any person
except to the extent necessary to conduct proceedings concerning the
application, including any appeal. Requires the order to direct that all
proceedings concerning the application be conducted in camera ("in camera"
is defined as in a chamber, room, or apartment; a judge's chamber, Black's
Law Dictionary, Sixth Edition).
(d) Requires an individual who is the subject of the information and any
person in possession of the information from whom the information is sought
to be notified of an application for its disclosure.
(e) Authorizes an individual who is the subject of the information and any
person possessing this information to file a written response to the
application or to appear in person to provide evidence on the statutory
criteria for the issuance of an order under this section. Authorizes the
court to grant an order without the required notice or appearance if the
application by a public health agency or public health officer requires
immediate action to avert or mitigate a clear danger to the public health.
(f) Requires the court, in assessing whether clear danger exists, to weigh
the need for the disclosure against the privacy interests of the individual
and any public health purpose that may be adversely affected by the
disclosure. Requires the court to provide written findings of fact
regarding its determination.
(g) Requires an order authorizing disclosure of protected health
information to adhere to certain limitations and inclusions.
Sec. 93.106. DISCLOSURE FOR HEALTH OVERSIGHT PURPOSES. Authorizes a
public health agency to disclose protected health information to a health
oversight agency to enable the agency to perform a health oversight
function authorized by law under certain conditions and stipulations.
Sec. 93.107. DECEASED INDIVIDUALS. (a) Provides that this chapter does
not prohibit the disclosure of protected health information in certain
documentation regarding a deceased individual, for the purpose of
determining the individual's cause of death, or to provide necessary
information about the individual who is a donor or prospective donor of an
anatomical gift.
(b) Authorizes the rights of a deceased individual under this chapter to
be exercised for two years after the date of death by a specified list of
individuals. Sets forth the list of individuals in order of priority,
subject to any written limitations or restrictions made by the decedent.
Sec. 93.108. SECONDARY DISCLOSURE. Prohibits a person to whom protected
health information has been disclosed under this chapter from disclosing
the information in an identifiable form to another person except as
authorized by this chapter. Makes this section inapplicable to certain
individuals with respect to the disclosure.
Sec. 93.109. RECORD OF DISCLOSURE. (a) Requires a public health agency
to establish a written or electronic record of any disclosure of protected
health information made under this chapter. Provides that this record is
protected health information.
(b) Provides that a record of disclosure is required to include certain
information.
(c) Requires the record of disclosure to be maintained by the public
health agency for ten years, even if the protected health information
disclosed is no longer in the agency's possession.
SUBCHAPTER E. SECURITY SAFEGUARDS
AND RECORDS RETENTION
Sec. 93.151. DUTY TO HOLD INFORMATION SECURELY. (a) Specifies that
public health agencies have a duty to acquire, use, disclose, and store
protected health information in a confidential and secure manner.
(b) Requires public health agencies and recipients of protected health
information disclosed by an agency other than a recipient who is subject of
the information or such a recipient's representative, to take appropriate
measures to protect the security of the information. Sets forth specific
duties these entities and individuals are required to perform with respect
to this subsection.
(c) Requires there to be a prominently displayed notice concerning the
public health agency's disclosure policy whenever protected health
information is accessible to public health officials. Sets forth sample
wording of the notice.
(d) Requires all public health officials or other persons with authority
at any time to acquire, use, disclose, or store protected health
information to perform certain duties with respect to the preservation of
protected health information, including reporting to the public health
information officer any known or possible breaches of security.
(e) Prohibits the identity of any person making a report under Subsection
(d) from being disclosed to anyone, other than investigating public health
or law enforcement officers, without the consent of the person making the
report.
Sec. 93.152. ESTABLISHMENT OF PUBLIC HEALTH INFORMATION OFFICER. (a)
Requires each public health agency to appoint or designate a public health
official as the agency's public health information officer.
(b) Delegates overall responsibility for preserving the security of all
public health information to the public health information officer in a
manner consistent with this section and chapter. Requires the officer to
report directly to the highest ranking public health official at the
agency.
(c) Requires the public health information officer to perform all duties
required by this section and this chapter. Sets forth specific duties with
respect to the maintenance of protected health information.
Sec. 93.153. ISSUANCE OF PUBLIC REPORTS. (a) Requires each public health
agency to prepare an annual report concerning the status of security
protections of protected health information required to be sent to the
public health information officer for the department upon request.
Requires the report to be prepared according to guidelines issued by the
public health information officer for the department.
(b) Requires the department's public health information officer to prepare
a summary report on the status of security protections of protected health
information for all public health agencies in this state within 60 days
after the reports required under Subsection (a) are requested. Requires
this report to be issued to the legislature together with any
recommendations for amendments to state law that are relevant to improving
the security of protected health information.
(c) Prohibits a report prepared under this section from containing any
protected health information or other personally identifiable information.
(d) Provides that reports prepared under this section are public
information.
SUBCHAPTER F. FAIR INFORMATION PRACTICES
Sec. 93.201. INDIVIDUAL ACCESS TO PUBLIC HEALTH INFORMATION. (a) Makes
this section applicable to a request by an individual who is the subject of
protected health information, or by the individual's parent or guardian, to
inspect or copy the information when it is in the possession of a public
health agency.
(b) Authorizes the public health agency to place reasonable limitations on
the time, place, and frequency of any inspections. Requires the agency to
request the opportunity to review the information with the requestor.
Prohibits such a review from being a prerequisite to providing the
information.
(c) Requires any information contained in that information relating to the
individual regarding the health status of other persons or other
confidential information regarding other persons to be deleted prior to
inspection or copying under this section.
(d) Authorizes any information contained in that information regarding the
individual that is unrelated to the requestor's health status to be deleted
prior to inspection or copying under this section.
(e) Authorizes a public health agency to deny a request to inspect or copy
protected health information under this section under certain
circumstances.
(f) Requires the public health agency to notify the requestor in writing
of the reasons for denying a request under this section, including a denial
for the reason the agency does not have in its possession any requested
protected health information relating to the requestor.
(g) Authorizes a requestor to appeal a denial of access under this section
through an administrative review procedure for this purpose by the
department.
Sec. 93.202. ACCURACY OF INFORMATION. (a) Requires public health
agencies to reasonably ensure the accuracy and completeness of protected
health information.
(b) Authorizes the requestor to request that the public health agency
correct, amend, or delete erroneous, incomplete, or false information after
inspection or review of protected health information.
(c) Requires a brief written statement from the requestor challenging the
veracity of the protected health information to be retained by the public
health agency while it possesses the information. Requires the agency to
note on the disputed portions of the information the original language and
the requestor's proposed change and disclose the notation on request to any
person authorized to receive the information.
(d) Requires the public health agency to correct, amend, or delete
erroneous, incomplete, or false information within 14 calendar days after
it receives a request to do so if it is determined that the modification is
reasonably supported by the facts. Provides that the requestor has the
burden of proving that the information needs to be corrected, amended, or
deleted.
(e) Requires the requestor to be notified in writing of any corrections,
amendments, or deletions made, or, alternately, the reasons for denying a
request under this section in whole or part.
(f) Authorizes the requestor to appeal a decision under this section
through an administrative review procedure prescribed for this purpose by
the department.
(g) Requires a public health agency to take reasonable steps to notify all
persons indicated by the requestor, or others for which known disclosures
have previously been made, of corrections, amendments, or deletions made to
protected information.
Sec. 93.203. APPEALS. (a) Authorizes a requestor to appeal the decision
of a public health agency to a Travis County district court or to a
district court in the county in which the requestor resides if an
administrative review procedure has been exhausted.
(b) Requires the court to determine whether there exists a reasonable
basis for the action or decision of the public health agency by conducting
an in camera review of the relevant protected health information, the
administrative record, and other admissible evidence.
(c) Limits the relief that may be granted to a requestor under this
section to a judgment requiring the public health agency to make the
requested information available to the requestor for inspection or copying
or to correct, amend, or delete erroneous, incomplete, or false information
as requested.
SUBCHAPTER G. CRIMINAL SANCTIONS; CIVIL REMEDIES
Sec. 93.251. CRIMINAL OFFENSES AND PENALTIES. (a) Provides that a public
health official who wilfully commits an act violating this chapter and knew
or should have known that the act is prohibited commits a misdemeanor
punishable by a fine not to exceed $5,000, confinement for a period not to
exceed one year, or both the fine and confinement.
(b) Provides that a person who is not a public health official who
wilfully discloses protected health information in violation of this
chapter and who knows or should know that the disclosure is prohibited
commits a misdemeanor punishable by a fine not to exceed $5,000,
confinement for a period not to exceed one year, or both the fine and the
confinement.
(c) Provides that any person who by unlawful means, including bribery,
fraud, theft, false pretenses, or other misrepresentation of identity,
misrepresentation of purpose of use, or misrepresentation of entitlement to
information, inspects, copies, examines, or obtains protected health
information in violation of this chapter commits a felony and that each
such felony is punishable by a fine not to exceed $50,000, imprisonment for
a period not to exceed five years, or both the fine and imprisonment.
(d) Provides that an offense committed under Subsection (a), (b), or (c)
for the purpose of commercial gain or with intent to cause malicious harm
is a felony punishable by a fine not to exceed $50,000, imprisonment for a
period not to exceed five years, or both the fine and imprisonment.
(e) Doubles the maximum penalties described in Subsections (a), (b), (c),
and (d) for every subsequent conviction of a person arising out of a
violation or violations related to a different set of circumstances from
those involved in the previous offense or set of offenses under Subsection
(a), (b), (c), or (d).
(f) Provides that a prosecution under this section is barred if the
indictment or information is not presented within three years after the
date of the offense.
(g) Provide that each violation of this chapter is a separate offense.
Sec. 93.252. CIVIL ENFORCEMENT. Authorizes the attorney general or a
district or county attorney to bring a civil action to enforce this chapter
and obtain relief that the court is authorized to grant under Section
93.253.
Sec. 93.253. CIVIL REMEDIES. (a) Authorizes a person aggrieved by a
negligent or intentional violation of this chapter, including a negligent
or intentional disclosure of protected health information in violation of
this chapter, failure to adequately safeguard the confidentiality or
security of information, or failure to supervise persons responsible for
the acquisition, use, disclosure, or storage of information, to bring an
action for relief under this section.
(b) Authorizes the court to order a public health agency, public health
official, or other person to comply with this chapter and to order any
appropriate civil or equitable relief, including injunctive relief, to
prevent noncompliance with this chapter.
(c) Entitles the aggrieved person to recover damages for losses sustained
as a result of the violation if the court determines that there is a
violation of this chapter. Entitles the person to recover the greater of
actual damages or liquidated damages of $1,000 for each violation.
Prohibits the liquidated damages awarded to a person from exceeding
$10,000.
(d) Authorizes an aggrieved person to recover punitive damages from the
violator in an amount not to exceed $10,000 per violation, it the court
determines that the violation results from wilful or grossly negligent
conduct.
(e) Authorizes the court to assess reasonable attorney's fees and all
other expenses reasonably incurred in the litigation against the parties
that did not prevail if the aggrieved party prevails.
(f) Provides that responsible parties are jointly and severally liable for
any compensatory damages, attorney's fees, or other costs awarded.
(g) Bars any action under this section unless the action is commenced
within one year after the cause of action accrues or was or should
reasonably have been discovered by the aggrieved person or the person's
representative.
(h) Provides that each separate violation of this chapter is an
actionable violation.
(i) Provides that this section does not limit or expand the right of an
aggrieved person or the person's representative to recover damages under
other applicable law.
Sec. 93.254. IMMUNITIES. (a) Provides that it is not a violation of or
an offense under this chapter to disclose protected health information in
accordance with an informed consent to disclose the information executed
according to this chapter.
(b) Provides that if a public health official is a superior or supervisory
officer over another public health official and the other official violates
a part of this chapter, the superior or supervisory officer is subject to
application of a civil remedy under this chapter only on a theory of
vicarious liability if the superior or supervisory official had no prior
actual or constructive knowledge of the violation or actions leading to it
and was not otherwise responsible for ensuring against the occurrence of
the violation.
(c) Provides that a person who is not a public health official is not
subject to the imposition of a criminal sanction or civil liability under
this chapter as a result of disclosing protected health information in
violation of this chapter if the original disclosure of information by the
public health agency was not accompanied by the language required by
Section 93.103(d). Provides that this subsection does not affect whether a
criminal sanction or civil liability may be imposed on a public health
official or other person failing to include the language required under
that section in the prior disclosure.
(d) Provides that the parent or guardian of a minor or the court-appointed
guardian of a mentally incompetent individual is not subject to the
imposition of a criminal sanction or civil liability under this chapter as
a result of disclosing protected health information relating to a minor or
individual if the parent or guardian obtained the information according to
this chapter.
SECTION 2. Requires the highest ranking public health official at each
public health agency affected by this Act to prepare and submit a report to
the department concerning the probable effect of the Act on the agency no
later than January 3, 2000. Requires the department to issue a
comprehensive report to the legislature on behalf of each public health
agency concerning the effect of the Act, including any recommendations for
legislative amendments no later than November 1, 2000.
SECTION 3. Effective date: September 1, 2000.
SECTION 4. Emergency clause.