GENERAL ASSEMBLY OF NORTH CAROLINA

SESSION 1997

H	1 

HOUSE BILL 925

Short Title:  Health Care Information Privacy.	(Public)

─────────────────────────────────────── 
Sponsors: Representatives Reynolds, Neely, Hackney (Cosponsors); Baddour, Luebke, and Mosley.

─────────────────────────────────────── 
Referred to:  Technology, if favorable, Judiciary II.

─────────────────────────────────────── 

April 10, 1997

A BILL TO BE ENTITLED
AN ACT TO PROTECT THE PRIVACY OF HEALTH INFORMATION.
The General Assembly of North Carolina enacts:
Section 1.  The General Statutes are amended by adding a new Chapter to read:
"Chapter 132A.
"ARTICLE 1.
"Legislative Findings and Definitions.
"§ 132A-1-1.  Legislative findings.
The General Assembly finds that:
(a)	Health information is personal and sensitive information which, if inaccurately collected, documented, or improperly used or released may cause significant harm to a patient's interests in privacy and health care.  Benefits of electronic health information include:
(1)	Facilitating timely, authorized communications of more complete health information that is now available through paper-based systems;
(2)	Improving the accuracy, integrity, and security of health information;
(3)	Providing access to medical knowledge bases;
(4)	Enhancing efficiencies of health care; and
(5)	Facilitating health care research and health care quality improvement.
Consequently, it is in the public interest to establish legislative policies and guidelines to ensure that health information is:
(1)	Secure, private, accurate, and reliable;
(2)	Properly disclosed or modified; and
(3)	Accessible only to those with a legitimate need for the information.
(b)	Certain types of information, such as information about HIV infection, AIDS, mental health, or substance abuse, are so highly sensitive that more strict requirements for disclosure are needed.
"§ 132A-1-2.  Definitions.
As used in this Chapter, unless the context otherwise requires:
(a)	'Audit' means an assessment, evaluation, determination, investigation, or prosecution of a custodian, provider, or facility, to determine, evaluate, or monitor practices concerning the applicability of, or compliance with:
(1)	Legal, fiscal, quality assurance, quality control, risk management, utilization review, or scientific standards or practices, or aspects of performance relating to:
a.	The delivery of or payment for health care, health care services or equipment;
b.	Health care fraud or fraudulent claims regarding health care, health care services or equipment, or related activities and items;
c.	Security of health information; and
d.	Coordination of services among providers or facilities or planning for future services; or
(2)	Requirements for licensing and professional discipline, accreditation, credentialing, or certification, including peer review.
(b)	'Custodian' means any person operating in a business, professional, or governmental capacity that collects, creates, receives, obtains, maintains, uses, analyzes, or transmits identifying health information, including a college, employer, facility, payer, health oversight agency, health researcher, penal institution, provider, public health authority, school, State agency, third-party administrator, or university.
(c)	'Directory information' means the following information concerning a patient who is an inpatient or outpatient or who is currently receiving emergency health care in a health care facility:
(1)	The presence of the patient at the facility, including room, bed number, or telephone number;
(2)	Date of admission; and
(3)	The patient's health status whether 'critical', 'poor', 'fair', 'good', 'excellent', or a term denoting a similar condition.
(d)	'Electronic signatures' means digital or electronic signatures in conformity with applicable provisions of the Uniform Commercial Code recommended by the National Conference of Commissioners on Uniform State Laws and the American Law Institute, electronic information and digital signature guidelines established by the organizations set forth in G.S. 132A-4-1(d), the digital signature guidelines recommended by the American Bar Association Science and Technology Committee Section, Committee on Information Security, or other electronic signature guidelines authorized by federal or State law.
(e)	'Facility' means any place where health care is regularly provided to two or more persons by a provider.
(f)	'Health care' means:
(1)	Preventive, diagnostic, therapeutic, rehabilitative, maintenance, investigational, experimental, cosmetic, reconstructive, or palliative care, including assistance with disease or symptom management and maintenance, counseling, service, laboratory test, or procedure:
a.	With respect to the physical or mental condition of a patient; or
b.	Affecting the structure or function of the human body or any part of the human body including the banking of blood, sperm, ova, organs, or any other tissue.
(2)	Any sale or dispensing of a drug, device, durable or disposable goods or equipment, or other health care related item to a patient, or for the use of a patient pursuant to a prescription, a purpose specified in subdivision (1) of this subsection.
(g)	'Health information' means any data, information, or orders, including advance directives, documents granting anatomical gifts, biological samples from the human body from which information can be drawn, films, videotapes, consent forms, genetic sequences, digitized images, sound recordings, and demographic information recorded or stored in any form that:
(1)	Relates to a specific patient's past, present, or future health care or condition, including the patient's individual cells and their components or personal and family medical history;
(2)	Was created or obtained by a custodian in connection with health care diagnosis, treatment, screening, counseling, intake, or discharge of a patient or related to the application for, or enrollment of, a patient in a reimbursement plan, or for insurance use; or
(3)	Was obtained by or from a provider, facility, a patient, a member of the patient's family, or any other person about a patient and in connection with a patient's health care.
(h)	'Health oversight agency' means a public agency or other person that receives a disclosure of, uses, maintains, or discloses health information while acting in the capacity of a person authorized by law or recognized by a government agency to perform or oversee the performance of an audit.
(i)	'Health research' means scientific, actuarial, survey, or statistical research based upon health information, including clinical investigations governed by the Code of Federal Regulations, Chapter I of Title 21.  Health research does not include disclosure of health information for purposes of providing health care, peer review, audit functions, or reporting to State and federal authorities.
(j)	'Identifying health information' means a collection of health information that includes the name, address, social security number, unique identifier established by State or federal law, likenesses or other information which readily identifies a patient's personal identity, could be used or manipulated to identify a patient by foreseeable method, or could be linked or matched by a foreseeable method to any other information in order to identify a patient.  Identifying health information includes information stored in a master person index authorized by G.S. 132A-3-5.  Health information shall not be considered identifying health information solely based on the inclusion in a collection of health information of a code assigned to a patient by a custodian if that code does not consist of or contain symbols that could be used to readily identify a patient with reasonable accuracy and speed from sources external to the custodian.
(k)	'Identifying provider information' means the collection of health information that includes the name, address, social security number, medical billing number, employer identification number, likenesses, or other information by which the identity of a health care provider can readily be determined with reasonable accuracy and speed, either directly or by reference to other publicly available information.  The term does not include a unique identification code assigned to a provider by a custodian and used and disclosed only internally to the custodian if that code does not consist of or contain symbols that could be used to identify readily a health care provider with reasonable accuracy and speed from sources external to the custodian.
(l)	'Master person index' means an index indicating the existence of medical records of patients held by a custodian and other information to facilitate the request for the information under circumstances permitted by this Chapter.
(m)	'Medical record' means identifying health information which is maintained in a health information collection, storage, and retrieval system of the custodian in the usual course of health care in accordance with applicable standards of practice.
(n)	'Patient' means an individual who is requesting, receives, or has received health care.  References to the term ‘patient' in this Chapter shall include other persons legally empowered to authorize the disclosure of a patient's identifying health information to the extent necessary to effectuate the terms or purposes of the individual's grant of authority.
(o)	'Payer' means a person acting in a business capacity who undertakes to furnish health insurance, disability insurance, life insurance, workers' compensation insurance, or otherwise to pay for all or some of health care services rendered to the patient.
(p)	'Person' means an individual, government, governmental subdivision, agency or authority, association, corporation, firm, limited liability company, partnership, society, estate, trust, joint venture, or any other legal entity.
(q)	'Provider' means:
(1)	A person licensed, certified, registered, or otherwise authorized by State or federal law to provide health care in the ordinary course of business or practice of profession;
(2)	A State or federal program that directly provides health care; or
(3)	A student training to provide health care acting under the supervision of a provider described in subdivision (1) of this subsection.
"ARTICLE 2.
"Patient Interests.
"§ 132A-2-1.  Patient's examination and copying of health information.
(a)	Upon a written request from a patient to examine or copy the patient's medical record, a custodian who is a provider or facility shall, within a reasonable time of the receipt of the request, at the custodian's option, make the patient's medical record available for examination during regular business hours or provide a copy to the patient.
(b)	If in the professional judgment of the provider it would be injurious to the mental or physical health of the patient who is the subject of the health information or in violation of the provider's professional ethical responsibilities to disclose (pursuant to subsection (a) of this section) certain identifying health information to the patient; the provider is not required to provide the information to the patient, but shall upon written request of the patient disclose the information to another provider designated by the patient.
(c)	A patient shall not have a right of access to health information compiled and used by a custodian solely for purposes of audit, peer review, or other administrative functions, to information protected by an evidentiary privilege of a person other than the patient, or information collected about the patient for or during a clinical trial monitored by an institutional review board when such trial is not complete.
"§ 132A-2-2.  Request for amendment.
(a)	A patient or provider treating a patient may request that a facility or provider amend identifying health information in a patient's medical record maintained by the provider or facility.
(b)	Upon a request for an amendment, the custodian shall either amend the record or inform the patient or provider in writing of the reasons for refusal to amend the medical record.  If the custodian refuses to amend the record, the patient or provider shall be entitled to add a statement about the disagreement to the disputed identifying health information.
(c)	When amending a record, the custodian shall add the amending information to the patient's identifying health information without affecting the original information and shall sign and date the amendment.
"§ 132A-2-3.  Health information confidentiality; public records.
(a)	A custodian shall maintain as confidential identifying health information.  Disclosures of identifying health information may be made only as authorized by this Chapter.
(b)	Unless otherwise provided by law and this section, identifying health information is not a public record.
(c)	No recipient of identifying health information shall use or redisclose identifying health information except for the purpose and authority under which the disclosure was made.
(d)	A custodian's employees, agents, and contractors shall be subject to this Chapter to the same extent as the custodian.
(e)	No person shall use health information that is not identifying health information for the purpose of identifying an individual patient unless the person is authorized under this Chapter to receive disclosures of the information as identifying health information.
(f)	No person shall use health information that is not identifying provider information for the purpose of identifying an individual provider unless the person is authorized under this Chapter to receive disclosures of the information as identifying provider information.
(g)	The records established pursuant to G.S. 132A-3-4(a)(4) may only be disclosed as follows:
(1)	To a patient, subject to G.S. 132A-2-1(c);
(2)	To a custodian except for records recording peer review functions and investigations of a custodian;
(3)	To health oversight agencies to the extent such records relate to the performance of authorized audit function;
(4)	By court order pursuant to G.S. 132A-3-3(a)(4).
(h)	All disclosures of identifying health information shall be limited only to information which the disclosing party reasonably believes is necessary to accomplish the purpose of the disclosure, except to the extent that disclosure is authorized by a patient or G.S. 132A-3-3(a)(4).
"ARTICLE 3.
"Health Information Communications.
"§ 132A-3-1.  Authorization to disclose health information.
(a)	Except for disclosures otherwise authorized by this Chapter, a custodian may disclose a patient's identifying health information only with authorization of the patient.
(b)	A custodian shall retain a patient's authorization to disclose identifying health information with the patient's health information.  A patient's authorization, to be valid shall have the following:
(1)	The patient's identity;
(2)	A dated written or electronic signature of the patient;
(3)	A description of the health information to be disclosed;
(4)	The name or title of a person, or the description of a group of persons, and the physical or electronic address of the person to whom the information is to be disclosed or a description of the class of persons to whom the information is to be disclosed; and
(5)	The purpose of the disclosure.
(c)	A patient's authorization to disclose identifying health information may also include any of the following:
(1)	Any limitation on the scope of disclosure that may be made by the  recipient in carrying out the authorized purpose for which the disclosure is requested;
(2)	An acknowledgment from the patient that the patient understands that the authorization is valid for the time period stated unless revoked; or
(3)	Any other information believed by the custodians to be needed to facilitate the authorization or to inform the patient as to the patient's rights with respect to the authorization.
(d)	A patient may revoke or amend an authorization at any time, except to the extent that the custodian has acted in reliance on the authorization.
(e)	An authorization under subsection (b) of this section shall remain effective for the time specified by the patient in the authorization.  If no time is specified, an authorization shall remain effective for one year.
"§ 132A-3-2.  Disclosures and uses of health information.
(a)	When a disclosure authorized pursuant to this section may be reasonably accomplished by disclosing nonidentifying health information rather than identifying health information, a custodian shall disclose only nonidentifying health information.
(b)	A custodian shall disclose identifying health information to federal, State, or local law enforcement authorities or to federal or State authorities and other law enforcement authorities, as otherwise required by law, only as provided in G.S. 132A-3-3.
(c)	A custodian may disclose identifying health information about a patient without the patient's authorization if the disclosure is:
(1)	To a provider currently providing authorized health care to a patient or to a referring provider who continues to provide authorized health care to a patient if the information is necessary to provide health care to the patient, and the patient does not object to the disclosure;
(2)	To another provider in the same group practice or provider network, or to a custodian under contract with the group practice or provider network, for the purpose of providing patient health care within the practice or network;
(3)	To a provider with a need for information to treat a condition which poses an immediate threat to a patient's health;
(4)	Unless otherwise limited by G.S. 90-21.4, to a member of a patient's immediate family, a legal guardian of a patient, or to a person with whom the patient is known to have a close personal relationship, when the attending provider reasonably believes that notification is necessary to avoid serious jeopardy to the health of a patient and the patient lacks the capacity to authorize the disclosure;
(5)	Necessary because in a provider's opinion, a person is in serious and imminent danger or a person is likely to commit a violent felony or violent misdemeanor.  This subdivision shall not impose a duty upon the provider to disclose health information;
(6)	To a custodian that originally disclosed the information to verify the accuracy of the information;
(7)	To a health oversight agency performing authorized audit functions;
(8)	To perform internal audit functions within a custodian's organization;
(9)	To agents, employees, and contractors of a custodian for the purpose of providing health care to a patient or performing administrative services for or on behalf of a custodian;
(10)	If not prohibited by federal or State law, to a health researcher for health research;
(11)	To a provider to confirm a past method or outcome of a course of treatment performed by the provider;
(12)	To a successor in interest of a custodian that is or was a provider, facility, or payer for the patient whose information is being disclosed;
(13)	To a group policyholder when reasonably necessary to conduct an audit of a payer's or provider's operation or service; and
(14)	Directory information, unless the patient has instructed the custodian not to make the disclosure, or the disclosure of the location of the patient would reveal that the patient may be receiving mental health or substance abuse treatment and the patient has not consented to the disclosure.
"§ 132A-3-3.  Subpoenas, search warrants, requests for discovery and court orders.
(a)	A patient's medical record or other health information shall be disclosed by a custodian pursuant to a civil, criminal, or administrative subpoena search warrant or request for discovery in any federal or State judicial or administrative investigation or proceeding only if:
(1)	The patient has authorized the disclosure in writing;
(2)	The patient is deceased and the disclosure is authorized in writing by the executor or administrator of the patient's estate, or, if the estate is unadministered, by the next of kin;
(3)	The information disclosed is to be used in the patient's involuntary commitment, adjudication of incompetency, or guardianship proceeding; or
(4)	A federal or State court or an administrative agency having subpoena power, and having jurisdiction of a matter relating to a patient orders the disclosure after finding that the disclosure is necessary for the proper administration of justice.
(b)	The provisions of G.S. 1A-1, Rule 45(c), shall apply to all identifying health information disclosed under subsection (a) of this section as if such information were hospital medical records.  If authorization is refused or not obtainable, a court order requiring disclosure shall be necessary before the disclosed identifying health information may be used in a deposition or at trial.
(c)	Nothing in this section shall be construed to waive the privilege between a patient and a provider or, unless a patient's authorization or a court order is obtained, to require any communications privileged under law to be disclosed.
"§ 132A-3-4.  Responsibilities of custodians as to disclosures.
(a)	Custodians shall adopt and implement technical, contractual, and physical policies and safeguards to effect the requirements of this Chapter and shall undertake to carry out such policies and safeguards to protect the confidentiality, security, accuracy, and integrity of health information maintained, used, or disclosed by the custodian.  These policies and safeguards shall include:
(1)	Providing for internal disciplinary or corrective measures for violations of the custodian's policy for implementing the requirements of this Chapter;
(2)	Requiring a signed statement by each employee, agent, or contractor having access to identifying health information that acknowledges the receipt of and understanding of the policies adopted by the custodian;
(3)	Providing periodic training of employees, agents, and contractors having access to identifying health information as to their obligations and liabilities under this Chapter;
(4)	Maintaining a record of the creation, revision, or disclosure of identifying health information that contains:
a.	The name, address, and institutional affiliation, if any, of the person to whom the information was disclosed, or by whom the information was created or revised;
b.	The date and purpose of the action;
c.	A description or reference to the information; and
d.	A description of the legal authority for the creation, revision, or disclosure; and
(5)	Limiting, to the extent practicable, the disclosure to that which is legitimately needed to be known in order to perform authorized functions.
(b)	A custodian need not maintain a record of disclosures if the disclosures are:
(1)	Made pursuant to G.S. 132A-3-2(c)(1) or (2), unless the disclosures were accomplished through an electronic information system; or
(2)	Oral disclosures to a patient, authorized by a patient, pursuant to G.S. 132A-3-2(c)(4).
"§ 132A-3-5.  Master person index.
(a)	A custodian may maintain or participate in and use, directly or through a contractor, a master person index.  A custodian utilizing a master person index shall disclose or permit access to the index only to a custodian who has entered into a written agreement requiring protection of confidentiality of health information as required in this Chapter with the disclosing custodian.  A master person index may utilize a unique identifier to identify patients and custodians.
(b)	Notwithstanding subsection (a) of this section, the existence of the following medical records shall not be disclosed in a master person index unless the requesting party has authority under State or federal law to receive a disclosure of the information:
(1)	Confidential information as defined in G.S. 122C-3(9);
(2)	Information and records regulated by G.S. 130A-143; and
(3)	Identifying health information that is otherwise maintained by a health care provider or health care facility and is identified by the provider as being related to a patient's evaluation, diagnosis, or treatment of HIV infection, AIDS, communicable disease, substance abuse, or mental health condition.
(c)	Access to an entry in a master person index indicating the existence of identifying health information shall not be permitted except to the extent that the disclosure of the information sought is authorized pursuant to G.S. 132A-3-1, 132A-3-2, or 132A-3-3.
"§ 132A-3-6.  Electronic and other medical records.
Notwithstanding any other State law, if a custodian maintains and preserves health information or signatures utilizing electronic, optical, or other technology and media, a custodian shall not be required to maintain a separate paper copy of the health information or signatures.  However, if a person receiving a disclosure requests the disclosure be in a paper form, the custodian may not refuse to provide the requested information in a paper form, unless another medium is required by State or federal law.
"§ 132A-3-7.  Authentication of persons and information; electronic signatures.
(a)	Notwithstanding any other State law, written signatures, electronic signatures, and other authentication techniques recognized as having comparable or superior reliability to electronic signatures shall be acceptable as a legally binding signature and for identification of any individual, entity, or health information associated with an individual or entity.
(b)	All individuals authorized by a custodian to authenticate health information utilizing an authentication technique requiring a secure code shall sign an agreement with the custodian to the effect that only the individual will use or permit access to the code assigned to the individual.
"ARTICLE 4.
"General Provisions.
"§ 132A-4-1.  Safe harbors.
Notwithstanding any other provision of this Chapter, no custodian or employee, agent, or contractor of a custodian shall be liable for actions authorized to be taken under this Chapter when the custodian, or employee, agent, or contractor of the custodian:
(a)	Acted in good faith and in reliance upon health information disclosed consistent with this Chapter;
(b)	Disclosed health information in good faith and in reliance upon a request for disclosure when the request identified a purpose for which disclosure is authorized under this Chapter;
(c)	Disclosed health information as authorized by this Chapter, and the transmission of the information was interrupted, or an error in the transmission otherwise was caused, by a common carrier or enhanced service provider while facilitating the disclosure;
(d)	Acted in good faith and in reliance upon recommendations, guidelines, or specifications implemented by the custodian that address the subject matter of this Chapter and that are designed to protect patients from the damages complained of, in whole or in part, and which recommendations, guidelines, or specifications are:
(1)	Adopted by the United States Secretary of Health and Human Services; or
(2)	To the extent not preempted by or inconsistent with recommendations, guidelines, or specifications authorized by subdivision (1) of this subsection, recommendations, guidelines, or specifications recommended as model standards or specifications by:
a.	The National Committee on Vital and Health Statistics,
b.	The National Uniform Billing Committee,
c.	The National Uniform Claim Committee,
d.	The North Carolina Health Care Information and Communications Alliance, Inc.,
e.	The Workgroup for Electronic Data Interchange, or
f.	Other public purpose organizations created under section 501(c) of the Internal Revenue Code and certified by Executive Order of the Governor as having the technical capability and breadth of representation in the health care community to address the subject matter of this Chapter in the public interest; or
(e)	Disclosed identifying health information in good faith reliance on an authorization pursuant to G.S. 132A-3-1 or G.S. 132A-3-3(a)(1) or (2).
"§ 132A-4-2.  Civil remedies.
(a)	Subject to G.S. 132A-4-1 and Chapter 1D of the General Statutes, a custodian or an employee, agent, or contractor of a custodian shall be subject to civil liability for damages incurred by a person with respect to the patient's identifying health information to the extent that such damages arise out of the intentional or negligent act or omission of a custodian in violation of the requirements of this Chapter.
(b)	If a patient believes that a custodian, employee, agent, or contractor of a custodian has failed to comply with its obligations under this Chapter with respect to the patient's identifying health information, a patient may apply to a court of competent jurisdiction for appropriate equitable relief in either the county in which the patient resides, the county where the identifying health information is retained, or the county where the custodian is located.
(c)	Any agreement purporting to limit the liability arising from violations of this Chapter, other than pursuant to a settlement agreement, is void.
"§ 132A-4-3.  Conflicting laws.
(a)	This Chapter does not restrict a custodian from complying with obligations imposed by federal health care payment programs or federal law or regulations.  To the extent the provisions of this Chapter conflict with other State law, the provisions of this Chapter shall control unless the other State law specifically states that it is an exception to a specific provision of this Chapter.  Notwithstanding the foregoing, if this Chapter conflicts with another State statute governing the nondisclosure of identifying health information held by a health oversight agency for the purposes of peer review, professional review, or other professional disciplinary or corrective action, the other statute shall control.
(b)	G.S. 132A-2-1, 132A-2-2, 132A-3-4(a)(4), and 132A-4-2 shall not apply to disclosures of identifying health information regulated by Article 39 of Chapter 58 of the General Statutes.  Health information regulated by Article 39 of Chapter 58 of the General Statutes may also be disclosed as permitted by that Article or G.S.132A-3-1 and G.S. 132A-3-2(b) and (c).
(c)	G.S. 132A-2-1 and G.S. 132A-3-2(c) shall not apply to disclosures of identifying health information regulated by Chapter 122C of the General Statutes.
(d)	G.S. 132A-3-2(c) shall not apply to disclosures of identifying health information regulated by G.S. 130A-143 when a custodian is acting pursuant to that section.
(e)	This Chapter does not apply to a telecommunications common carrier and an enhanced service provider if they are certified or subject to regulation:
(1)	Under Chapter 62 of the General Statutes; or
(2)	By the Federal Communications Commission pursuant to federal law.
(f)	Except as provided in G.S. 132A-2-3(e) and (f), this Chapter does not regulate the disclosure of health information that is not identifying health information.
"§ 132A-4-4.  Rules of construction.
Except as otherwise required by law, this Chapter does not require the disclosure of trade secrets or other commercial information."
Section 2.  This act becomes effective July 1, 1999, except that G.S. 132A-3-3, 132A-3-5, 132A-3-6, and 132A-3-7 become effective when this act becomes law.  Custodians who comply with this act prior to its effective date may rely on G.S. 132A-4-1 as to causes of action that accrue after their compliance.