REPORT TITLE:
Health Care Info Privacy


DESCRIPTION:
Protects privacy of health care information by stipulating
conditions under which information can be disclosed.  Provides
criminal penalties and a civil cause of action.  (SD1)

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                        351
HOUSE OF REPRESENTATIVES                H.B. NO.           H.D. 2
TWENTIETH LEGISLATURE, 1999                                S.D. 1
STATE OF HAWAII                                            
                                                             
________________________________________________________________
________________________________________________________________


                   A  BILL  FOR  AN  ACT

RELATING TO PRIVACY OF HEALTH CARE INFORMATION.



BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 1      SECTION 1.  The legislature finds that individuals have a
 
 2 constitutional right to privacy with respect to personal health
 
 3 information and records, and with respect to information about
 
 4 medical care and health status.
 
 5      Traditionally, the primary health care relationship existed
 
 6 only between the patient and the doctor, and such a relationship
 
 7 was founded upon the principle that all information transmitted
 
 8 between the patient and the doctor was confidential.  The
 
 9 legislature further finds that with the advancements in modern
 
10 technology and the systematic changes in health care practices,
 
11 the primary relationship between a patient and the doctor has now
 
12 been expanded to a multi-party relationship that includes health
 
13 plans, employers, consulting physicians and other health care
 
14 providers, laboratories and hospitals, researchers and data
 
15 organizations, and various governmental and private oversight
 
16 agencies.  These multiple relationships have fundamentally
 
17 changed the way in which medical information is used, and the
 
18 legislature acknowledges that individuals are often unaware of
 
19 how their medical information is being used and disclosed in the
 
20 modern health care delivery system.  Currently, there is no
 

 
Page 2                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 general statute that governs the disclosure covering all medical
 
 2 records.  Most individuals sign a one-time blanket consent to
 
 3 release their medical records when they sign up for medical
 
 4 insurance.  The doctors, hospitals, and insurance companies share
 
 5 these records as they see fit.  Thus, the legislature 
 
 6 believes that an individual's right to privacy is currently
 
 7 unclear and at risk.
 
 8      However, the legislature also recognizes that there are
 
 9 strong public policy justifications in encouraging health care
 
10 quality through the review of medical information.  First, such
 
11 reviews help to improve the quality of health care in Hawaii by
 
12 assessing the results or outcomes of certain modes of treatment,
 
13 thereby giving patients more information with which to make
 
14 better medical choices.  Second, reviewing medical information
 
15 helps to ferret out and prevent fraud and abuse in the health
 
16 care delivery system.  It is estimated that approximately $100
 
17 billion of the $1 trillion spent on health care nationally can be
 
18 attributed to health care fraud.  This drives up health care
 
19 costs and takes needed health care dollars away from deserving
 
20 patients.  Third, encouraging clinical and epidemiological
 
21 research to improve health care also helps to promote the
 
22 quality, efficiency, and effectiveness of the modern health care
 
23 delivery system.  Research leads to new treatments which relieve
 

 
Page 3                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 suffering and save lives.
 
 2      Therefore, the legislature firmly believes that encouraging
 
 3 affordable quality health care, facilitating effective medical
 
 4 research, and preventing fraud and abuse are necessary to the
 
 5 health and safety of our citizens.  These are compelling state
 
 6 interests which require the sharing of medical information for
 
 7 limited purposes without eliminating confidentiality within the
 
 8 patient-doctor relationship.
 
 9      Thus, the purpose of this Act is to:
 
10      (1)  Implement the right of the people to privacy
 
11           established under section 6, article I of the
 
12           Constitution of the State of Hawaii which provides that
 
13           the legislature shall take affirmative steps to
 
14           implement the right to privacy through legislation;
 
15      (2)  Protect individuals from the adverse effects of the
 
16           improper disclosure of protected health information in
 
17           medical records;
 
18      (3)  Establish strong and effective mechanisms to protect
 
19           against the unauthorized and inappropriate use of
 
20           protected health information that is created or
 
21           maintained as part of health care treatment, diagnosis,
 
22           enrollment, payment, plan administration, testing, or
 
23           research processes;
 

 
Page 4                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      (4)  Promote the health and welfare of the public by
 
 2           encouraging the effective exchange and transfer of
 
 3           health information in a manner that will ensure the
 
 4           confidentiality of protected health information without
 
 5           impeding the delivery of high quality health care;
 
 6      (5)  Promote the public health and welfare by allowing the
 
 7           transfer of personal health information into
 
 8           nonidentifiable health information for oversight,
 
 9           health research, public health, law enforcement,
 
10           judicial, and administrative purposes, where
 
11           appropriate; and
 
12      (6)  Establish remedies for violations of this Act.
 
13      SECTION 2.  The Hawaii Revised Statutes is amended by adding
 
14 a new chapter to be appropriately designated and to read as
 
15 follows:
 
16                             "CHAPTER
 
17                PRIVACY OF HEALTH CARE INFORMATION
 
18                    PART I.  GENERAL PROVISIONS
 
19      §   -1  Definitions.  As used in this chapter, except as
 
20 otherwise specifically provided:
 
21      "Accrediting body" means a committee, organization, or
 
22 institution that has been authorized by law or is recognized by a
 
23 health care regulating authority as an accrediting entity or any
 

 
Page 5                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 other entity that has been similarly authorized or recognized by
 
 2 law to perform specific accreditation, licensing, or
 
 3 credentialing activities.
 
 4      "Agent" means a person who represents and acts for another
 
 5 under a contract or relationship of agency, or whose function is
 
 6 to bring about, modify, affect, accept performance of, or
 
 7 terminate contractual obligations between the principal and a
 
 8 third person, including a contractor.
 
 9      "Commissioner" means the insurance commissioner.
 
10      "Disclose" means to release, transfer, provide access to,
 
11 share, or otherwise divulge protected health information to any
 
12 person other than the individual who is the subject of the
 
13 information.  The term includes the initial disclosure and any
 
14 subsequent redisclosures of protected health information.
 
15      "Educational institution" means 
 
16 
 
17      "Employer" means any individual or type of organization,
 
18 including any partnership, association, trust, estate, joint
 
19 stock company, insurance company, or corporation, whether
 
20 domestic or foreign, a debtor in possession or receiver or
 
21 trustee in bankruptcy, or a legal representative of a deceased
 
22 person, who employs one or more regular individuals.
 
23      "Employment" means services performed for wages under any
 

 
Page 6                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 contract of hire, written or oral, expressed or implied, with an
 
 2 employer.
 
 3      "Entity" means a health care provider, health care data
 
 4 organization, health plan, health oversight agency, public health
 
 5 authority, employer, insurer, health researcher, law enforcement
 
 6 official, or educational institution.
 
 7      "Health care" means:
 
 8      (1)  Preventive, diagnostic, therapeutic, rehabilitative,
 
 9           palliative, or maintenance services:
 
10           (A)  With respect to the physical or mental condition
 
11                of an individual; or
 
12           (B)  Affecting the structure or function of the human
 
13                body or any part of the human body, including the
 
14                banking of blood, sperm, organs, or any other
 
15                tissue;
 
16           or
 
17      (2)  Any sale or dispensing of a drug, device, equipment, or
 
18           other health care-related item to an individual, or for
 
19           the use of an individual pursuant to a prescription or
 
20           order by a health care provider.
 
21      "Health care data organization" means an entity, including a
 
22 not-for-profit entity that engages primarily in the business or
 
23 practice of collecting, analyzing, and disseminating identifiable
 

 
Page 7                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 and nonidentifiable patient information, and not a health care
 
 2 provider, an insurer, a health researcher, or a health oversight
 
 3 agency.
 
 4      "Health care provider" means a person who, with respect to
 
 5 any protected health information, receives, creates, uses,
 
 6 maintains, or discloses the protected health information while
 
 7 acting in whole or in part in the capacity of or on the behalf
 
 8 of:
 
 9      (1)  A person who is licensed, certified, registered, or
 
10           otherwise authorized by federal or state law to provide
 
11           an item or service that constitutes health care in the
 
12           ordinary course of business, or practice of a
 
13           profession;
 
14      (2)  A federal, state, or employer-sponsored program that
 
15           directly provides items or services that constitute
 
16           health care to beneficiaries; or
 
17      (3)  An officer, employee, or agent of a person described in
 
18           paragraph (1) or (2).
 
19      "Health oversight agency" means a person who, with respect
 
20 to any protected health information, receives, creates, uses,
 
21 maintains, or discloses the information while acting in whole or
 
22 in part in the capacity of or on the behalf of:
 
23      (1)  A person who performs or oversees the performance of an
 

 
Page 8                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           assessment, evaluation, determination, or
 
 2           investigation, relating to the licensing,
 
 3           accreditation, or credentialing of health care
 
 4           providers; or
 
 5      (2)  A person who:
 
 6           (A)  Performs or oversees the performance of an audit,
 
 7                assessment, evaluation, determination, or
 
 8                investigation relating to the effectiveness of,
 
 9                compliance with, or applicability of, legal,
 
10                fiscal, medical, or scientific standards or
 
11                aspects of performance related to the delivery of,
 
12                or payment for, health care; and
 
13           (B)  Is a public agency, acting on behalf of a public
 
14                agency, acting pursuant to a requirement of a
 
15                public agency, or carrying out activities under a
 
16                federal or state law governing the assessment,
 
17                evaluation, determination, investigation, or
 
18                prosecution for violations of paragraph (1).
 
19      "Health plan" means any health insurance plan, including any
 
20 hospital or medical service plan, dental or other health service
 
21 plan or health maintenance organization plan, provider-sponsored
 
22 organization, or other program providing or arranging for the
 
23 provision of health benefits, whether or not funded through the
 

 
Page 9                                                     351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 purchase of insurance.
 
 2      "Health researcher" means a person, or an officer, employee
 
 3 or independent contractor of a person, who receives protected
 
 4 health information as part of a systematic investigation,
 
 5 testing, or evaluation designed to develop or contribute to
 
 6 generalized scientific and clinical knowledge.
 
 7      "Individual's designated representative" means a person who
 
 8 is authorized by law (based on grounds other than the minority of
 
 9 an individual), or by an instrument recognized under law, to act
 
10 as an agent, attorney, guardian, proxy, or other legal
 
11 representative of a protected individual, and includes a health
 
12 care power of attorney.
 
13      "Institutional review board" means a research committee
 
14 established and operating in accord with Title 45 C.F.R. 46
 
15 sections 107, 108, 109, and 115.
 
16      "Insurer" means any person regulated under chapter 431 or
 
17 432, and groups that have purchased a group insurance policy on
 
18 behalf of their members; provided that:
 
19      (1)  Insurers regulated under chapter 431, and life
 
20           insurers, disability income insurers, and long-term
 
21           care insurers regulated under article 10A, chapter 431,
 
22           shall not be considered an insurer for the purposes of
 
23           this Act until July 1, 2001; and
 

 
Page 10                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      (2)  Insurers regulated under article 10A, chapter 431,
 
 2           excluding life insurers, disability income insurers,
 
 3           and long-term care insurers, shall be included as an
 
 4           insurer for the purposes of this Act.
 
 5      "Nonidentifiable health information" means any information
 
 6 that would otherwise be protected health information except that
 
 7 the information does not reveal the identity of the individual
 
 8 whose health or health care is the subject of the information or
 
 9 that has been coded or encrypted to protect the identity of the
 
10 individual, and there is no reasonable basis to believe that the
 
11 information could be used, either alone or with other information
 
12 that is, or should reasonably be, known to be available to
 
13 recipients of the information, to reveal the identity of that
 
14 individual.
 
15      "Office of information practices" shall be as defined by
 
16 chapter 92F.
 
17      "Payment" means the activities undertaken by a health plan
 
18 or provider, which are reasonably necessary to determine
 
19 responsibility for coverage, services, and the actual payment for
 
20 services, if any.
 
21      "Person" means a government, governmental subdivision,
 
22 agency or authority, corporation, company, association, firm,
 
23 partnership, insurer, estate, trust, joint venture, individual,
 

 
Page 11                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 individual representative, and any other legal entity.
 
 2      "Protected health information" means any information,
 
 3 excluding non-identifiable health information, including
 
 4 demographic information, whether or not recorded in any form or
 
 5 medium that relates directly or indirectly to the past, present,
 
 6 or future:
 
 7      (1)  Physical or mental health or condition of a person,
 
 8           including tissue and genetic information;
 
 9      (2)  Provision of health care to an individual; or
 
10      (3)  Payment for the provision of health care to an
 
11           individual.
 
12      "Public health authority" means the department of health.
 
13      "Qualified health care operations" means:
 
14      (1)  Only those services provided by or on behalf of a
 
15           health plan or health care provider for the purpose of
 
16           carrying out the management functions of a health care
 
17           provider or health plan, or implementing the terms of a
 
18           contract for health plan benefits as follows:
 
19           (A)  Conducting quality assurance activities or
 
20                outcomes assessments;
 
21           (B)  Reviewing the competence or qualifications of
 
22                health care professionals;
 
23           (C)  Performing accreditation, licensing, or
 

 
Page 12                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1                credentialing activities;
 
 2           (D)  Analyzing health plan claims or health care
 
 3                records data;
 
 4           (E)  Evaluating provider clinical performance;
 
 5           (F)  Carrying out utilization management; or
 
 6           (G)  Conducting or arranging for auditing services in
 
 7                accordance with statute, rule, or accreditation
 
 8                requirements;
 
 9      (2)  A qualified health care operation is one that:
 
10           (A)  Is an operation which cannot be carried on with
 
11                reasonable effectiveness and efficiency without
 
12                identifiable patient information;
 
13           (B)  Is limited to using only that protected health
 
14                information collected under the terms of the
 
15                contract for health plan benefits and without
 
16                which the operation cannot be carried on with
 
17                reasonable effectiveness and efficiency;
 
18           (C)  Is limited to using the minimum amount of
 
19                protected health information, including the
 
20                minimum number of records and the minimum number
 
21                of documents within each patient's record,
 
22                necessary to carry on the operation with
 
23                reasonable effectiveness and efficiency; and
 

 
Page 13                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           (D)  Limits the handling and examination of protected
 
 2                health information to those persons who are
 
 3                reasonably well qualified, by training,
 
 4                credentials, or experience, to conduct the phase
 
 5                of the operation in which they are involved.
 
 6      "Surrogate" means a person, other than an individual's
 
 7 designated representative or relative, who is authorized to make
 
 8 a health-care decision for the individual.
 
 9      "Treatment" means the provision of health care by, or the
 
10 coordination of health care among, health care providers, or the
 
11 referral of a patient from one provider to another, or
 
12 coordination of health care or other services among health care
 
13 providers and third parties authorized by the health plan or the
 
14 plan member.
 
15      "Unique patient identifier" means a number or alpha-numeric
 
16 string assigned to an individual, which can be or is used to
 
17 identify individuals' protected health information.
 
18      "Writing" means a written form that is either paper- or
 
19 computer- based, and includes electronic signatures.
 
20                   PART II.  INDIVIDUAL'S RIGHTS
 
21      §   -11  Inspection and copying of protected health
 
22 information.(a)  For the purposes of this section only,
 
23 "entity" means a health care provider, health plan, employer,
 

 
Page 14                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 health care data organization, insurer, or educational
 
 2 institution.
 
 3      (b)  Except as otherwise provided in this section, after
 
 4 receiving a request in writing by an individual who is the
 
 5 subject of protected health information, an entity shall permit
 
 6 the individual to inspect and copy protected health information
 
 7 concerning the individual, including records created under
 
 8 section    -12, that the entity maintains.
 
 9      (c)  If, in the opinion of the individual's health care
 
10 provider, it would be detrimental to the health of the individual
 
11 to obtain the records, then the entity may decline to release the
 
12 records directly to the individual.  If the entity declines to
 
13 release records under this subsection, the entity shall make
 
14 copies of the records available to the individual's designated
 
15 representative upon presentation of a proper authorization signed
 
16 by the individual.  The entity shall advise the individual that
 
17 it will release records to the individual's designated
 
18 representative.
 
19      (d)  An entity may exclude from the copies of medical
 
20 records released under this section the following information:
 
21      (1)  Information protected from discovery under section 624-
 
22           25.5; or
 
23      (2)  Information collected for or during a clinical trial
 

 
Page 15                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           monitored by an institutional review board, if the
 
 2           trial is not complete and the researcher reasonably
 
 3           believes that access to the information would harm the
 
 4           conduct of the trial.
 
 5      (e)  An entity may set forth appropriate procedures to be
 
 6 followed for the inspection or copying of records under this
 
 7 section.  An entity may require an individual to pay costs
 
 8 associated with the inspection or copying, not to exceed the
 
 9 reasonable costs incurred by the entity in making and providing
 
10 the copies.
 
11      (f)  An entity shall comply with a request for inspection or
 
12 copying of protected health information under this section no
 
13 later than ten business days after the date on which the entity
 
14 receives the request; provided that if the records requested are
 
15 not in electronic form, are located off the premises of the
 
16 entity involved, and are not readily available, the entity may
 
17 comply with the request no later than thirty days after the date
 
18 on which the entity receives the request.
 
19      (g)  An agent of an entity shall not be required to provide
 
20 for the inspection and copying of protected health information,
 
21 except where:
 
22      (1)  The protected health information is retained by the
 
23           agent; and
 

 
Page 16                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      (2)  The agent has received a written request from the
 
 2           entity involved to fulfill the requirements of this
 
 3           section, at which time this information shall be
 
 4           provided to the requestor.  The requestor shall comply
 
 5           with subsection (e) with respect to any such
 
 6           information.
 
 7      §   -12  Additions to protected health information.  A
 
 8 health care provider is the owner of the medical records in the
 
 9 health care provider's possession that were created by the health
 
10 care provider in treating a patient.  An individual or the
 
11 individual's designated representative may submit to the health
 
12 care provider an addition to the individual's medical records,
 
13 which must be retained with the medical record by the health care
 
14 provider.  If the health care provider adds to the medical record
 
15 a statement in response to the submitted addition, the health
 
16 care provider shall provide a copy to the individual.
 
17      §   -13  Notice of confidentiality practices; forms of
 
18 notices.(a)  For the purposes of this section only, "entity"
 
19 means health care provider, health care data organization, health
 
20 plan, health oversight agency, public health authority, employer,
 
21 insurer, health researcher, or educational institution.
 
22      (b)  An entity shall post or provide in writing, in a clear
 
23 and conspicuous manner, and in plain language, the current notice
 

 
Page 17                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 of the entity's confidentiality practices.  This notice shall be
 
 2 given pursuant to the requirements of section     -22.  For the
 
 3 purpose of informing each individual of the individual's rights
 
 4 under this chapter, the notice shall contain the following
 
 5 language, placed prominently at the beginning:
 
 6           IMPORTANT! THIS NOTICE DEALS WITH THE SHARING OF YOUR
 
 7           MEDICAL RECORDS.  PLEASE READ IT CAREFULLY.  THIS
 
 8           NOTICE DESCRIBES YOUR PRIVACY RIGHTS AS IT RELATES TO
 
 9           YOUR MEDICAL RECORDS AND EXPLAINS THE SITUATIONS UNDER
 
10           WHICH YOUR MEDICAL RECORDS MAY BE SHARED WITH OTHERS.
 
11           IF YOU DO NOT AGREE WITH THE TERMS OF THIS NOTICE, AS
 
12           POSTED BELOW, PLEASE ASK FOR FURTHER EXPLANATION.
 
13 In addition, the notice shall include:
 
14      (1)  A description of an individual's rights with respect to
 
15           protected health information which shall contain at a
 
16           minimum, the following:
 
17           (A)  An individual's right to inspect and copy their
 
18                record;
 
19           (B)  An individual's right to request that a health
 
20                care provider append information to their medical
 
21                record;
 
22           (C)  An individual's right to receive this notice by
 
23                each health plan upon enrollment, annually, and
 

 
Page 18                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1                when confidentiality practices are substantially
 
 2                amended; and 
 
 3           (D)  An individual's right to ask for any entity's
 
 4                notice of confidentiality practices.
 
 5      (2)  The uses and disclosures of protected health
 
 6           information authorized under this chapter:
 
 7           (A)  Conducting quality assurance activities or
 
 8                outcomes assessments;
 
 9           (B)  Reviewing the competence or qualifications of
 
10                health care professionals;
 
11           (C)  Performing accreditation, licensing, or
 
12                credentialing activities;
 
13           (D)  Analyzing health plan claims or health care
 
14                records data;
 
15           (E)  Evaluating provider clinical performance;
 
16           (F)  Carrying out utilization management; or
 
17           (G)  Conducting or arranging for auditing services in
 
18                accordance with statute, rule, or accreditation
 
19                requirements;
 
20      (3)  The right of the individual to limit disclosure of
 
21           protected health information by deciding not to utilize
 
22           any health insurance or other third party payment as
 
23           payment for the service, as set forth in section
 

 
Page 19                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1              -21(c).
 
 2      (4)  The procedures for giving consent to disclosures of
 
 3           protected health information and for revoking the
 
 4           consent to disclose;
 
 5      (5)  The description of procedures established by the entity
 
 6           for the exercise of the individual's rights; and
 
 7      (6)  The right of the individual to obtain a copy of the
 
 8           notice of confidentiality practices required under this
 
 9           chapter.
 
10      (c)  The actual procedures established by the entities for
 
11 the exercise of individual rights under this part shall be
 
12 available in writing upon request.
 
13      §   -14  Establishment of safeguards.(a)  An entity shall
 
14 establish and maintain administrative, technical, and physical
 
15 safeguards that are appropriate to the size and nature of the
 
16 entity establishing the safeguards, and that are appropriate to
 
17 protect the confidentiality, security, accuracy, and integrity of
 
18 protected health information created, received, obtained,
 
19 maintained, used, transmitted, or disposed of by the entity.
 
20      (b)  The office of information practices shall adopt rules
 
21 under chapter 91 to implement subsection (a).
 
22           PART III.  RESTRICTIONS ON USE AND DISCLOSURE
 
23      §   -21  General rules regarding use and disclosure.(a)
 

 
Page 20                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 An entity shall not use or disclose protected health information
 
 2 except as authorized under this part and under part IV.
 
 3 Disclosure of health information in the form of nonidentifiable
 
 4 health information shall not be construed as a disclosure of
 
 5 protected health information.
 
 6      (b)  For the purpose of treatment, payment, or qualified
 
 7 health care operations, an entity described in subsection (a) may
 
 8 only use or disclose protected health information within the
 
 9 entity if the use or disclosure is properly noticed pursuant to
 
10 sections    -13 and    -22.  For all other uses and disclosures,
 
11 an entity may only use or disclose protected health information,
 
12 if the use or disclosure is properly consented to pursuant to
 
13 section    -23.  Disclosure to agents of an entity shall be
 
14 considered as a disclosure within an entity.
 
15      (c)  If an individual does not want protected health
 
16 information released pursuant to section (b), the individual
 
17 shall advise the provider that the relevant protected health
 
18 information shall not be disclosed pursuant to subsection (b).  A
 
19 health plan may decline to cover health care services for work an
 
20 individual has refused to allow the release of protected health
 
21 care information.  Protected health information related to health
 
22 care services paid for directly by the individual shall not be
 
23 disclosed without a consent.
 

 
Page 21                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      (d)  An agent who receives protected health information from
 
 2 an entity shall be subject to all rules of disclosure and
 
 3 safeguard requirements under this part.
 
 4      (e)  Every use and disclosure of protected health
 
 5 information shall be limited to the purpose for which it was
 
 6 collected.  Any other use without a valid consent to disclose
 
 7 shall be an unauthorized disclosure.
 
 8      (f)  Nothing in this part permitting the disclosure of
 
 9 protected health information shall be construed to require
 
10 disclosure.
 
11      (g)  An entity may disclose protected health information to
 
12 an employee or agent of the entity not otherwise authorized to
 
13 receive such information for purposes of creating nonidentifiable
 
14 information, if the entity prohibits the employee or agent of the
 
15 entity from using or disclosing the protected health information
 
16 for purposes other than the sole purpose of creating
 
17 nonidentifiable information as specified by the entity.
 
18      (h)  Any individual or entity who manipulates or uses
 
19 nonidentifiable health information to identify an individual,
 
20 shall be deemed to have disclosed protected health information.
 
21 The disclosure or transmission of a unique patient identifier
 
22 shall be deemed to be a disclosure of protected health
 
23 information.
 

 
Page 22                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      §   -22  Giving notice regarding disclosure of protected
 
 2 health information for treatment, payment, or qualified health
 
 3 care operations.(a)  The notice required by section    -13
 
 4 shall be:
 
 5      (1)  Given by each health plan upon enrollment, annually,
 
 6           and when confidentiality practices are substantially
 
 7           amended, to each individual who is eligible to receive
 
 8           care under the health plan, or to the individual's
 
 9           parent or guardian if the individual is a minor or
 
10           incompetent; and
 
11      (2)  Posted in a conspicuous place or provided by an entity
 
12           other than a health plan.
 
13      (b)  Except as provided in this chapter, a notice required
 
14 by this section shall not be construed as a waiver of any rights
 
15 that the individual has under other federal or state laws, rules
 
16 of evidence, or common law.
 
17      (c)  For each new enrollment or re-enrollment by an
 
18 individual on a health plan on or after the effective date of
 
19 this Act, a health plan shall obtain the individual's signature
 
20 on the notice of confidentiality practices.  The notice to be
 
21 signed shall state that the individual is signing on behalf of
 
22 the individual and all others covered by the individual's health
 
23 plan.  The failure of a health plan to obtain this written
 

 
Page 23                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 acknowledgement shall not be used by the health plan as the basis
 
 2 for a denial of coverage of a claim.
 
 3      §   -23  Authorization to disclose protected health
 
 4 information other than for treatment, payment, or qualified
 
 5 health care operations.(a)  An entity may disclose protected
 
 6 health information for purposes other than those noticed under
 
 7 section    -22, pursuant to a separate written authorization to
 
 8 disclose executed by the individual who is the subject of the
 
 9 information.  The authorization must meet the requirements of
 
10 subsection (b).
 
11      (b)  To be valid, an authorization shall be separate from
 
12 any other notice or authorization required by this part, shall be
 
13 either in writing, dated, and signed by the individual, or in
 
14 electronic form, dated, and authenticated by the individual using
 
15 a unique identifier, shall not have been revoked, and shall do
 
16 the following:
 
17      (1)  Identify the person or entity authorized to disclose
 
18           protected health information;
 
19      (2)  Identify the individual who is the subject of the
 
20           protected health information;
 
21      (3)  Describe the nature of and the time span of the
 
22           protected health information to be disclosed;
 
23      (4)  Identify the person to whom the information is to be
 

 
Page 24                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           disclosed;
 
 2      (5)  Describe the purpose of the disclosure;
 
 3      (6)  State that it is subject to revocation by the
 
 4           individual and indicate that the consent to disclose is
 
 5           valid until revocation by the individual; and
 
 6      (7)  Include the date at which the consent to disclose ends.
 
 7      (c)  An individual may revoke in writing an authorization
 
 8 under this section at any time.  An authorization obtained by a
 
 9 health plan is deemed to be revoked at the time of the
 
10 cancellation or nonrenewal of enrollment in the health plan.  An
 
11 entity that discloses protected health information pursuant to an
 
12 authorization that has been revoked under this subsection shall
 
13 not be subject to any liability or penalty under this part for
 
14 the disclosure if that entity acted in good faith and had no
 
15 actual or constructive notice of the revocation.
 
16      (d)  Sections    -31 to    -39 provide for exceptions to the
 
17 requirement for the authorization.
 
18      (e)  A recipient of protected health information pursuant to
 
19 an authorization under this section may use the information
 
20 solely to carry out the purpose for which the information was
 
21 authorized for release.
 
22      (f)  Each entity collecting or storing protected health
 
23 information shall maintain for seven years, as part of an
 

 
Page 25                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 individual's protected health information, a record of each
 
 2 authorization by the individual and any revocation of
 
 3 authorization by the individual.
 
 4              PART IV.  EXCEPTED USES AND DISCLOSURES
 
 5      §   -31  Coroner or medical examiner.  When a coroner or
 
 6 medical examiner or one of their duly appointed deputies seek
 
 7 protected health information for the purpose of inquiry into and
 
 8 determination of the cause, manner, and circumstances of a death,
 
 9 any person shall provide the requested protected health
 
10 information to the coroner or medical examiner or to the duly
 
11 appointed deputies without undue delay.  If a coroner or medical
 
12 examiner or their duly appointed deputies receives protected
 
13 health information, this protected health information shall
 
14 remain protected health information unless it is attached to or
 
15 otherwise made a part of a coroner's or medical examiner's
 
16 official report.  Health information attached to or otherwise
 
17 made a part of a coroner's or medical examiner's official report
 
18 shall be exempt from this chapter.
 
19      §   -32  Individual's designated representative, relative,
 
20 or surrogate, and directory information.(a)  A health care
 
21 provider, or a person who receives protected health information
 
22 under subsection (b), may disclose protected health information
 
23 regarding an individual to an individual's designated
 

 
Page 26                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 representative, relative, or surrogate if:
 
 2      (1)  The individual who is the subject of the information:
 
 3           (A)  Has been notified of the individual's right to
 
 4                object to the disclosure and the individual has
 
 5                not objected to the disclosure; or
 
 6           (B)  Is in a physical or mental condition such that
 
 7                the individual is not capable of objecting, and
 
 8                there are no prior indications that the
 
 9                individual would object; and
 
10      (2)  The information disclosed is for the purpose of
 
11           providing health care to that individual; or
 
12      (3)  The disclosure of the protected health information is
 
13           consistent with good medical or professional practice.
 
14      (b)  Except as provided in subsection (d), a health care
 
15 provider may disclose the information described in subsection (c)
 
16 to any other person if the individual who is the subject of the
 
17 information:
 
18      (1)  Has been notified of the individual's right to object
 
19           and the individual has not objected to the disclosure;
 
20           or
 
21      (2)  Is in a physical or mental condition such that the
 
22           individual is not capable of objecting; and
 
23           (A)  The individual's designated representative,
 

 
Page 27                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1                relative, or surrogate has not objected; and
 
 2           (B)  There are no prior indications that the individual
 
 3                would object.
 
 4      (c)  Information that may be disclosed in subsection (b) is
 
 5 only that information that consists of any of the following
 
 6 items:
 
 7      (1)  The name of the individual who is the subject of the
 
 8           information;
 
 9      (2)  The general health status of the individual, described
 
10           as critical, poor, fair, stable, or satisfactory or in
 
11           terms denoting similar conditions; or
 
12      (3)  The location of the individual on premises controlled
 
13           by a provider.  This disclosure shall not be made if
 
14           the information would reveal specific information about
 
15           the physical or mental condition of the individual,
 
16           unless the individual expressly authorizes the
 
17           disclosure.
 
18      (d)  A disclosure shall not be made under this section if
 
19 the health care provider involved has reason to believe that the
 
20 disclosure of this information could lead to physical or mental
 
21 harm to the individual, unless the individual expressly
 
22 authorizes the disclosure.
 
23      §   -33  Identification of deceased individuals.  A health
 

 
Page 28                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 care provider may disclose protected health information if the
 
 2 disclosure is necessary to assist in the identification or safe
 
 3 handling of a deceased individual.
 
 4      §   -34  Emergency circumstances.  Any person who creates or
 
 5 receives protected health information under this chapter may use
 
 6 or disclose protected health information in emergency
 
 7 circumstances when the use or disclosure is necessary to protect
 
 8 the health or safety of the individual who is the subject of the
 
 9 information from serious, imminent harm.  A disclosure made in
 
10 the good faith belief that the use or disclosure was necessary to
 
11 protect the health or safety of an individual from serious,
 
12 imminent harm shall not be a violation of this chapter.
 
13      §   -35  Disclosures for health oversight.(a)  Any person
 
14 may disclose protected health information to a health oversight
 
15 agency for purposes of an oversight function authorized by law.
 
16      (b)  For purposes of this section, the individual with
 
17 authority to authorize the health oversight function involved
 
18 shall provide to the person described in subsection (a) a
 
19 statement that the protected health information is being sought
 
20 for a legally authorized oversight function.
 
21      (c)  Protected health information about an individual that
 
22 was obtained under this section may not be used in, or disclosed
 
23 to any person for use in, an administrative, civil, or criminal
 

 
Page 29                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 action or investigation directed against the individual unless
 
 2 the action or investigation arises out of and is directly related
 
 3 to:
 
 4      (1)  The receipt of health care or payment for health care;
 
 5      (2)  An action involving a fraudulent claim related to
 
 6           health; or
 
 7      (3)  An action involving oversight of a public health
 
 8           authority or a health researcher.
 
 9      (e)  Protected health information disclosed for purposes of
 
10 this section remains protected health information and shall not
 
11 be further disclosed by the receiving health oversight agency,
 
12 except as permitted under this section.
 
13      §   -36  Public health.(a)  Any person or entity may
 
14 disclose protected health information to a public health
 
15 authority or other person authorized by law, for use in a legally
 
16 authorized:
 
17      (1)  Disease or injury report;
 
18      (2)  Public health surveillance;
 
19      (3)  Public health investigation or intervention; or
 
20      (4)  Health or disease registry.
 
21      (b)  The disclosure of protected health information,
 
22 pursuant this section, to a public health authority or other
 
23 person authorized by law shall not be a violation of this part.
 

 
Page 30                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      (c)  Protected health information disclosed for purposes of
 
 2 this section remains protected health information and shall not
 
 3 be further disclosed by the receiving authority or person, except
 
 4 as permitted under this section.
 
 5      §   -37  Health research.  A health care provider, health
 
 6 plan, public health authority, employer, insurer, or educational
 
 7 institution may disclose protected health information to a health
 
 8 researcher if the following requirements are met:
 
 9      (1)  The research has been approved by an institutional
 
10           review board.  In evaluating a research proposal, an
 
11           institutional review board shall require that the
 
12           proposal demonstrate a clear purpose, scientific
 
13           integrity, and a realistic plan for maintaining the
 
14           confidentiality of protected health information;
 
15      (2)  The research involves analysis of protected health
 
16           information previously created or collected by the
 
17           holder of protected health information;
 
18      (3)  The person who receives protected health information
 
19           removes or destroys, at the earliest opportunity
 
20           consistent with the purposes of the project involved,
 
21           information that would enable an individual to be
 
22           identified;
 
23      (4)  The person who receives protected health information
 

 
Page 31                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           does not disclose or use the protected health
 
 2           information for any purposes other than the health
 
 3           research project for which the information was
 
 4           obtained, except that the health researcher may also
 
 5           disclose the information pursuant to section    -35(a);
 
 6           and
 
 7      (5)  The holder of protected health information keeps a
 
 8           record of all health researchers to whom protected
 
 9           health information has been made available.
 
10      §   -38  Disclosure in civil, judicial, and administrative
 
11 procedures.(a)  Protected health information may be disclosed
 
12 pursuant to a discovery request or subpoena in a civil action
 
13 brought in a state court or a request or subpoena related to a
 
14 state administrative proceeding, only if the disclosure is made
 
15 pursuant to a court order as provided for in subsection (b) or to
 
16 a written authorization under section    -23.
 
17      (b)  A court order issued under this section shall:
 
18      (1)  Provide that the protected health information involved
 
19           is subject to court protection;
 
20      (2)  Specify to whom the information may be disclosed;
 
21      (3)  Specify that the information may not otherwise be
 
22           disclosed or used; and
 
23      (4)  Meet any other requirements that the court determines
 

 
Page 32                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           are needed to protect the confidentiality of the
 
 2           information.
 
 3      (c)  This section shall not be construed to supersede:
 
 4           (1)  Any grounds that may apply under federal or state
 
 5                law for objecting to turning over the protected
 
 6                health information; and
 
 7           (2)  Section 622-59.
 
 8      (e)  The release of any protected health information under
 
 9 this section shall not violate this part.
 
10      §   -39  Payment card and electronic payment transaction.
 
11 (a)  If an individual pays for health care by presenting a debit,
 
12 credit, or other payment card or account number, or by any other
 
13 electronic payment means, the entity receiving payment may
 
14 disclose to a person described in subsection (b) only such
 
15 protected health information about the individual as is necessary
 
16 for the processing of the payment transaction or the billing or
 
17 collection of amounts charged to, debited from, or otherwise paid
 
18 by, the individual using the card, number, or other electronic
 
19 means.
 
20      (b)  A person who is a debit, credit, or other payment card
 
21 issuer, or is otherwise directly involved in the processing of
 
22 payment transactions involving such cards or other electronic
 
23 payment transactions, or is otherwise directly involved in the
 

 
Page 33                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 billing or collection of amounts paid through these means, may
 
 2 use or disclose protected health information about an individual
 
 3 that has been disclosed in accordance with subsection (a) only
 
 4 when necessary for:
 
 5      (1)  The settlement, billing, or collection of amounts
 
 6           charged to, debited from, or otherwise paid by the
 
 7           individual using a debit, credit, or other payment card
 
 8           or account number, or by other electronic payment
 
 9           means;
 
10      (2)  The transfer of receivables, accounts, or interest
 
11           therein;
 
12      (3)  The internal audit of the debit, credit, or other
 
13           payment card account information;
 
14      (4)  Compliance with federal, state, or county law; or
 
15      (5)  Compliance with a properly authorized civil, criminal,
 
16           or regulatory investigation by federal, state, or
 
17           county authorities as governed by the requirements of
 
18           this section.
 
19      §   -40  Standards for electronic disclosures.  The office
 
20 of information practices shall adopt rules, pursuant to chapter
 
21 91, to establish standards for disclosing, authorizing, and
 
22 authenticating, protected health information in electronic form
 
23 consistent with this part.
 

 
Page 34                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      §   -41  Rights of minors.(a)  In the case of an
 
 2 individual who is eighteen years of age or older, all rights of
 
 3 an individual under this chapter shall be exercised by the
 
 4 individual.
 
 5      (b)  In the case of an individual of any age who, acting
 
 6 alone, can obtain a type of health care without violating any
 
 7 applicable federal or state law, and who has sought this care,
 
 8 the individual shall exercise all rights of an individual under
 
 9 this chapter with respect health care.
 
10      (c)  Except as provided in subsection (b), in the case of an
 
11 individual who is:
 
12      (1)  Under fourteen years of age, all of the individual's
 
13           rights under this chapter shall be exercised only
 
14           through the parent or legal guardian; or
 
15      (2)  At least fourteen but under eighteen years of age, the
 
16           rights of inspection and amendment, and the right to
 
17           authorize use and disclosure of protected health
 
18           information of the individual may be exercised by the
 
19           individual, or by the parent or legal guardian of the
 
20           individual.  If the individual and the parent or legal
 
21           guardian do not agree as to whether to authorize the
 
22           use or disclosure of protected health information of
 
23           the individual, the individual's authorization or
 

 
Page 35                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           revocation of authorization shall control.
 
 2      §   -42  Deceased individuals.  This chapter shall continue
 
 3 to apply to protected health information concerning a deceased
 
 4 individual following the death of that individual.  A person who
 
 5 is authorized by law or by an instrument recognized under law, to
 
 6 act as a personal representative of the estate of a deceased
 
 7 individual, or otherwise to exercise the rights of the deceased
 
 8 individual, to the extent so authorized, may exercise and
 
 9 discharge the rights of the deceased individual under this
 
10 chapter.
 
11                        PART V.  SANCTIONS
 
12      §   -51  Wrongful disclosure of protected health
 
13 information.(a)  A person who knowingly or intentionally
 
14 obtains protected health information relating to an individual
 
15 or discloses protected health information to another person in
 
16 violation of this chapter shall be guilty of a class C felony.
 
17      (b)  A person who knowingly or intentionally sells,
 
18 transfers, or uses protected health information for commercial
 
19 advantage, personal gain, or malicious harm, in violation of this
 
20 chapter shall be guilty of a class B felony.
 
21      §   -52  Civil actions by individuals.(a)  Any individual
 
22 whose rights under this chapter have been violated may bring a
 
23 civil action against the person or entity responsible for the
 

 
Page 36                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 violation.
 
 2      (b)  In any civil action brought under this section, if the
 
 3 court finds a violation of an individual's rights under this
 
 4 chapter, the court may award:
 
 5      (1)  Injunctive relief, including enjoining a person or
 
 6           entity from engaging in a practice that violates this
 
 7           chapter;
 
 8      (2)  Equitable relief;
 
 9      (3)  Compensatory damages for injuries suffered by the
 
10           individual.  Injuries compensable under this section
 
11           may include, but are not limited to, personal injury
 
12           including emotional distress, reputational injury,
 
13           injury to property, and consequential damages;
 
14      (4)  Punitive damages, as appropriate;
 
15      (5)  Costs of the action;
 
16      (6)  Attorneys' fees, as appropriate; and
 
17      (7)  Any other relief the court finds appropriate.
 
18      (c)  No action may be commenced under this section after the
 
19 time period stated in section 657-7.
 
20      §   -53  Cease and desist orders; civil penalty.(a)  A
 
21 court shall issue and cause to be served upon a person, who has
 
22 violated any provision of this chapter, a copy of the court's
 
23 findings and an order requiring the person to cease and desist
 

 
Page 37                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 from violating this chapter, or to otherwise comply with the
 
 2 requirements of this chapter.  The court may also order any one
 
 3 or more of the following:
 
 4      (1)  For any violation of this chapter, payment of a civil
 
 5           penalty of not more than $500 for each and every act or
 
 6           violation but not to exceed $5,000 in the aggregate for
 
 7           multiple violations;
 
 8      (2)  For a knowing violation of this chapter, payment of a
 
 9           civil penalty of not more than $25,000 for each and
 
10           every act or violation but not to exceed $100,000 in
 
11           the aggregate for multiple violations; and
 
12      (3)  For violations of this chapter that have occurred with
 
13           such frequency as to constitute a general business
 
14           practice, a civil penalty of $100,000.
 
15      (b)  Any person who violates a cease and desist order or
 
16 injunction issued under this section may be subject to a civil
 
17 penalty of not more than $10,000 for each and every act in
 
18 violation of the cease and desist order.
 
19      (c)  No order or injunction issued under this section shall
 
20 in any way relieve or absolve any person affected by the order
 
21 from any other liability, penalty, or forfeiture required by law.
 
22      §   -54  Relationship to other laws.(a)  Nothing in this
 
23 chapter shall be construed to preempt or modify any provisions of
 

 
Page 38                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 state law concerning a privilege of a witness or person in a
 
 2 court of the State.  Receipt of notice pursuant to section    -22
 
 3 or consent to disclose pursuant to section    -23 shall not be
 
 4 construed as a waiver of these privileges.
 
 5      (b)  Nothing in this chapter shall be construed to preempt,
 
 6 supersede, or modify the operation of any state law that:
 
 7      (1)  Provides for the reporting of vital statistics such as
 
 8           birth or death information;
 
 9      (2)  Relates to public or mental health and that prevents or
 
10           otherwise restricts disclosure of information otherwise
 
11           permissible under this chapter;
 
12      (3)  Governs a minor's right to access protected health
 
13           information or health care services;
 
14      (4)  Otherwise requires or specifically permits release of
 
15           health information."
 
16      SECTION 3.  Section 622-52, Hawaii Revised Statutes, is
 
17 amended to read as follows:
 
18      "§622-52  Subpoena duces tecum for medical records,
 
19 compliance.(a) [ Whenever a subpoena duces tecum is served upon
 
20 the custodian of medical records or other qualified witness from
 
21 a medical facility, in an action or other proceeding on a claim
 
22 for personal injuries in which the custodian or the custodian's
 
23 employer is neither a party to the action or proceeding nor is it
 

 
Page 39                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 alleged that the claim arose at the medical facility, and such
 
 2 subpoena requires the production in court, or before an officer,
 
 3 board, commission, or tribunal, of all or any part of the medical
 
 4 records of a patient who is or has been cared for or treated at
 
 5 the medical facility, it shall be sufficient compliance therewith
 
 6 if the custodian or other qualified witness within five days
 
 7 after receipt of such subpoena, delivers by registered or
 
 8 certified mail or by messenger a true and correct copy (which may
 
 9 be by any method described in rule 1001(4), Hawaii rules of
 
10 evidence) of all the medical records described in such subpoena
 
11 to the clerk of the court or the clerk's deputy authorized to
 
12 issue it, together with the affidavit described in section
 
13 622-53.]  A subpoena duces tecum or discovery request for
 
14 protected health information is valid only if accompanied by
 
15 either a court order, or a written authorization signed in
 
16 accordance with    -23.  An order issued under this section
 
17 shall:
 
18      (1)  Provide that the protected health information involved
 
19           is subject to court protection;
 
20      (2)  Specify to whom the information may be disclosed;
 
21      (3)  Specify that the information may not be disclosed or
 
22           used except as provided in the order; and
 
23      (4)  Meet any other requirements that the court determines
 

 
Page 40                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1           are needed to protect the confidentiality of the
 
 2           information.
 
 3      (b)  Whenever a subpoena duces tecum is served upon the
 
 4 custodian of medical records or other qualified witness from a
 
 5 health care provider, health plan, public health authority,
 
 6 employer, insurer, law enforcement official, educational
 
 7 institution, health oversight agency, health researcher, or
 
 8 medical facility, in a civil action or other proceeding in which
 
 9 the custodian or the custodian's employer is neither a party to
 
10 the action or proceeding nor is it alleged that the claim arose
 
11 at the office, facility, or institution to which the request for
 
12 information is directed, and such subpoena requires the
 
13 production in court, or before an officer, board, commission, or
 
14 tribunal, of all or any part of the medical records of a patient
 
15 who is or has been cared for or treated at the office, facility,
 
16 or institution, it shall be sufficient compliance if the
 
17 custodian or other qualified witness within five days after
 
18 receipt of such subpoena, delivers by registered or certified
 
19 mail or by messenger a true and correct copy (which may be by any
 
20 method described in rule 1001(4), Hawaii rules of evidence) of
 
21 all the medical records described in such subpoena to the clerk
 
22 of the court or the clerk's deputy authorized to issue it,
 
23 together with the affidavit described in section 622-53.
 

 
Page 41                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      [(b)](c)  The copy of the medical records shall be
 
 2 separately enclosed in an inner envelope or wrapper, sealed, with
 
 3 the title and number of the action, name of the custodian or
 
 4 other qualified witness, and date of the subpoena clearly
 
 5 inscribed thereon; the sealed envelope or wrapper shall then be
 
 6 enclosed in an outer envelope or wrapper, sealed, and directed as
 
 7 follows:
 
 8      (1)  If the subpoena directs attendance in court, to the
 
 9           clerk of such court or the clerk's deputy authorized to
 
10           issue it, at the courthouse[.]; and
 
11      (2)  In other cases, to the officer, board, commission, or
 
12           tribunal conducting the hearing, at the place
 
13           designated in the subpoena.
 
14      [(c)](d)  The copy of the medical records shall remain
 
15 sealed and shall be opened only at the time of trial, or other
 
16 hearing, upon the direction of the judge, officer, board,
 
17 commission, or tribunal conducting the proceeding, in the
 
18 presence of all parties who have appeared in person or by counsel
 
19 at such trial, or hearing, unless the parties or counsel in the
 
20 proceeding otherwise agree, or unless the sealed envelope or
 
21 wrapper is returned to the custodian or other qualified witness
 
22 who is to appear personally.  Copies of medical records [which]
 
23 that are not introduced in evidence or required as part of the
 

 
Page 42                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1 record shall be returned by registered or certified mail or by
 
 2 messenger to the person or entity from whom received.  If the
 
 3 copies of the medical records are introduced in evidence or are
 
 4 required as part of the record, they shall be returned by
 
 5 registered or certified mail or messenger to the person or entity
 
 6 from whom received as soon as their use is no longer needed,
 
 7 after the trial, or other hearing.
 
 8      (e)  This section shall not be construed to supercede any
 
 9 grounds that may apply under federal or state law for objecting
 
10 to turning over the protected health information."
 
11      SECTION 4.  The office of information practices shall submit
 
12 a status report to the legislature on the adoption of rules
 
13 required by this Act, and regarding the use of existing
 
14 licensure, certification, and regulatory mechanisms for the
 
15 imposition of sanctions or penalties for the wrongful disclosure
 
16 of protected health information, no later than twenty days prior
 
17 to the convening of the 2000 regular session.
 
18      SECTION 5.  The exempt insurers, as defined in section 2,
 
19 and in consultation with the insurance commissioner, shall submit
 
20 a status report to the legislature regarding their support for or
 
21 opposition to the National Association of Insurance Commissioners
 
22 Insurance Information and Privacy Protection Act, which governs
 
23 the treatment of protected health information, or substantially
 
24 similar legisation, no later than twenty days prior to the
 
25 convening of the 2001 regular session.
 

 
Page 43                                                    351
                                     H.B. NO.           H.D. 2
                                                        S.D. 1
                                                        

 
 1      SECTION 6.  If any provision of this Act, or the application
 
 2 thereof to any person or circumstance is held invalid, the
 
 3 invalidity does not affect other provisions or applications of
 
 4 this Act which can be given affect without the invalid provision
 
 5 or application, and to this end the provisions of this Act are
 
 6 severable.
 
 7      SECTION 7.  Statutory material to be repealed is bracketed.
 
 8 New statutory material is underscored.
 
 9      SECTION 8.  This Act shall take effect on June 18, 1815.