GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2001
S	1
SENATE BILL 992

 
 
Short Title:	Protected Health Information.	()	
Sponsors:	Senators Rand;  Dannelly, Garrou, Hagan, Swindell, Thomas, and Wellons.	
Referred to:	Judiciary I.	
April 5, 2001

A BILL TO BE ENTITLED
AN ACT TO PROVIDE FOR AN INDIVIDUAL TO HAVE ACCESS TO PROTECTED HEALTH INFORMATION ABOUT THE INDIVIDUAL.

The General Assembly of North Carolina enacts:
SECTION 1.  The General Statutes are amended by adding the following new Chapter to read:
"Chapter 132A.
"Article 1.
"Patient Access to Medical Records.
"§ 132A-1. Definitions.
As used in this Article, unless the context clearly requires otherwise, the term:
(1)	'Covered entity' means a:
a.	Health benefit plan as defined in G.S. 58-3-167;
b.	Health care clearinghouse; and
c.	Health care provider that transmits any health information in electronic form in connection with a transaction under this Article.
(2)	'Designated record set' means:
a.	A group of records maintained by or for a covered entity that is:
1.	The medical records and billing records about individuals maintained by or for a covered health care provider;
2.	The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health benefit plan; or
3.	Used, in whole or in part, by or for the covered entity to make decisions about individuals.
b.	For purposes of this subdivision, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.
(3)	'Health care clearinghouse' means a public or private entity, including a billing service, repricing company, community health management information system, or community health information system, and value-added networks and switches, that does either of the following:
a.	Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.
b.	Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.
(4)	'Health care provider' means a provider of medical or health services, and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
(5)	'Health information' means any information, whether oral or recorded, in any form or medium, that:
a.	Is created or received by a health care provider, health benefit plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
b.	Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
(6)	'Individual' means the person who is the subject of protected health information.
(7)	'Protected health information' means individually identifiable health information that is transmitted or maintained by electronic media or by another form or medium.
(8)	'Transaction' means the transmission of information between two parties to carry out financial or administrative activities related to health care. It includes the following types of information transmission:
a.	Health care claims or equivalent encounter information.
b.	Health care payment and remittance advice.
c.	Coordination of benefits.
d.	Health care claim status.
e.	Enrollment and disenrollment in a health benefit plan.
f.	Eligibility for a health benefit plan.
g.	Health plan premium payments.
h.	Referral certification and authorization.
i.	First report of injury.
j.	Health claims attachments.
"§ 132A-2. Right of access of individuals to protected health information; exceptions; grounds for denial; review of denial; implementation specifications.
(a)	Access to Protected Health Information. – Except as otherwise provided in this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is in the designated record set, except for:
(1)	Psychotherapy notes;
(2)	Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding; and
(3)	Protected health information maintained by a covered entity that is:
a.	Subject to the Clinical Laboratory Improvement Amendments of 1988, to the extent the provision of access to the individual would be prohibited by law; or
b.	Exempt from Clinical Laboratory Improvement Amendments of 1988.
(b)	Unreviewable Grounds for Denial of Access. – A covered entity may deny an individual access without providing the individual an opportunity for review of the denial, in the following circumstances:
(1)	The protected health information is excepted from the right of access by subsection (a) of this section.
(2)	A covered entity that is a correctional institution or a covered health care provider acting under the direction of the correctional institution may deny, in whole or in part, an inmate's request to obtain a copy of protected health information, if obtaining the copy would jeopardize the health, safety, security, custody, or rehabilitation of the individual or of other inmates, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the inmate.
(3)	An individual's access to protected health information created or obtained by a covered health care provider in the course of research that includes treatment may be temporarily suspended for as long as the research is in progress, provided that the individual has agreed to the denial of access when consenting to participate in the research that includes treatment, and the covered health care provider has informed the individual that the right of access will be reinstated upon completion of the research.
(4)	An individual's access may be denied if the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.
(c)	Reviewable Grounds for Denial of Access. – A covered entity may deny an individual access, provided that the individual is given a right to have the denial reviewed, as required by subsection (d) of this section, in the following circumstances:
(1)	A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;
(2)	The protected health information makes reference to another person (unless the other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to the other person; or
(3)	The request for access is made by the individual's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to the personal representative is reasonably likely to cause substantial harm to the individual or another person.
(d)	Review of Denial of Access. – If access is denied on a ground permitted under subsection (c) of this section, the individual has the right to have the denial reviewed by a licensed health care professional who is designated by the covered entity to act as a reviewing official and who did not participate in the original decision to deny. The covered entity must provide or deny access in accordance with the determination of the reviewing official under subdivision (g)(4) of this section.
(e)	Implementation.
(1)	Individual request for access. – The covered entity must permit an individual to request access to inspect or to obtain a copy of the protected health information about the individual that is maintained in a designated record set. The covered entity may require individuals to make requests for access in writing, provided that it informs individuals of the requirement.(2)	Entity timely action. 
a.	Except as otherwise provided in this subsection, the covered entity must act on a request for access not later than 30 days after receipt of the request, as follows:
1.	If the covered entity grants the request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, in accordance with subsection (f) of this section.
2.	If the covered entity denies the request, in whole or in part, it must provide the individual with a written denial, in accordance with subsection (g) of this section.
b.	If the request for access is for protected health information that is not maintained or accessible to the covered entity on-site, the covered entity must take an action required by sub-subdivision a. of this subdivision by not later than 60 days from the receipt of the request.
c.	If the covered entity is unable to take an action required by sub-subdivision a. of this subdivision within the time required by sub-subdivision a. or b. of this subdivision, as applicable, a covered entity may extend the time for the action by no more than 30 days provided that:
1.	The covered entity, within the time limit set by sub-subdivision a. or b. of this subdivision, as applicable, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request; and
2.	The covered entity may have only one such extension of time for action on a request for access.
(f)	Implementation: Provision of Access. – If the covered entity provides an individual with access, in whole or in part, to protected health information, the covered entity must comply with the following requirements:
(1)	Providing the access requested. – The covered entity must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the protected health information about them in designated record sets. If the same protected health information that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the covered entity need only produce the protected health information once in response to a request for access.
(2)	Form of access requested.
a.	The covered entity must provide the individual with access to the protected health information in the form or format requested by the individual if it is readily producible in the form or format requested. If it is not readily producible in the form or format requested, then access must be provided in a readable hard copy form or such other form or format as agreed to by the covered entity and the individual.
b.	The covered entity may provide the individual with a summary of the protected health information requested, in lieu of providing access to the protected health information or may provide an explanation of the protected health information to which access has been provided, if:
1.	The individual agrees in advance to the summary or explanation; and
2.	The individual agrees in advance to the fees imposed, if any, by the covered entity for the summary or explanation.
(3)	Time and manner of access. – The covered entity must provide the access as requested by the individual in a timely manner as required by subsection (e) of this section, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the protected health information, or mailing the copy of the protected health information at the individual's request. The covered entity may discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.
(4)	Fees. – If the individual requests a copy of the protected health information or agrees to a summary or explanation of the information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:
a.	Copying, including the cost of supplies for and labor of copying, the protected health information requested by the individual;
b.	Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and
c.	Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by subdivision (2) of this subsection.
(g)	Implementation: Denial of Access. – If the covered entity denies access, in whole or in part, to protected health information, the covered entity must comply with the following requirements:
(1)	Making other information accessible. – The covered entity must, to the extent possible, give the individual access to any other protected health information requested, after excluding the protected health information as to which the covered entity has a ground to deny access.
(2)	Denial. – The covered entity must provide a timely, written denial to the individual, in accordance with subsection (e) of this section. The denial must be in plain language and contain:
a.	The basis for the denial;
b.	If applicable, a statement of the individual's review rights under subsection (d) of this section, including a description of how the individual may exercise the review rights; and
c.	A description of how the individual may complain to the covered entity pursuant to the complaint procedures in G.S. 132A-3. The description must include the name, or title, and telephone number of the contact person designated in G.S. 132A-3.
(3)	Other responsibility. – If the covered entity does not maintain the protected health information that is the subject of the individual's request for access, and the covered entity knows where the requested information is maintained, the covered entity must inform the individual where to direct the request for access.
(4)	Review of denial requested. – If the individual has requested a review of a denial under subsection (d) of this section, the covered entity must designate a licensed health care professional, who was not directly involved in the denial to review the decision to deny access. The covered entity must promptly refer a request for review to the designated reviewing official. The designated reviewing official must determine, within a reasonable period of time, whether or not to deny the access requested based on the standards in  subsection (c) of this section. The covered entity must promptly provide written notice to the individual of the determination of the designated reviewing official and take other action as required by this section to carry out the designated reviewing official's determination.
(h)	Implementation: Documentation. – A covered entity must document the following and retain the documentation as required by G.S. 132A-3:
(1)	The designated record sets that are subject to access by individuals; and
(2)	The titles of the persons or offices responsible for receiving and processing requests for access by individuals.
"§ 132A-3. Administrative requirements.
(a)	Personnel Designations.
(1)	A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity.
(2)	A covered entity must designate a contact person or office who is responsible for receiving complaints under this section.
(3)	A covered entity must document the personnel designations required under this subsection.
(b)	Training.
(1)	A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this Article as necessary and appropriate for members of the workforce to carry out their functions within the covered entity.
(2)	Training provided by the covered entity shall be provided as follows:
a.	To each member of the covered entity's workforce.
b.	To each member of the covered entity's workforce whose functions are affected by a material change in the policies or procedures required by this Article, within a reasonable period of time after the material change becomes effective.
	A covered entity must document that the training required by this subsection has been provided.
(c)	Safeguards. – A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.
(d)	Complaints. – A covered entity must provide a process for individuals to make complaints concerning the covered entity's policies and procedures required by this Article or its compliance with required policies and procedures.
(e)	Sanctions. – A covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity or the requirements of this Article.
(f)	Mitigation. – A covered entity must mitigate, to the extent practicable, any harmful effect that is known to the covered entity of a use or disclosure of protected health information in violation of its policies and procedures or the requirements of this Article.
(g)	Retaliation. – A covered entity may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against an individual or other persons for filing a complaint or otherwise assisting in an investigation into the covered entity's compliance with this Article.
(h)	Waiver of Right. – A covered entity may not require individuals to waive their rights under this Article as a condition of the treatment, payment, enrollment in a health plan or eligibility for benefits.
(i)	Policies and Procedures. – A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the requirements of this Article.
(j)	Documentation. – A covered entity must maintain:
(1)	Policies and procedures required under this Article in written or electronic form;
(2)	Communications required to be maintained in writing, or an electronic copy of the writing, as documentation of the writing; and 
(3)	Written or electronic record of actions, activities, or designations required by this Article.
A covered entity must retain the document required by this subsection for six years from the date of its creation or the date when it was last in effect, whichever is later."
SECTION 2.  This act becomes effective January 1, 2002.