Click here for Fiscal Note

Second Regular Session

Sixty-first General Assembly

LLS NO. 98­0019.01 PLC HOUSE BILL 98­1153

STATE OF COLORADO

BY REPRESENTATIVE Hagedorn;

also SENATOR Chlouber.

HEWI

A BILL FOR AN ACT

CONCERNING THE MAINTAINING OF THE CONFIDENTIALITY OF PATIENT MEDICAL RECORDS AND INFORMATION.

Bill Summary

(Note: This summary applies to this bill as introduced and does not necessarily reflect any amendments which may be subsequently adopted.)

Prohibits health care providers from disclosing any patient medical record or medical information without first obtaining written authorization from the patient unless compelled to by law or if such information is to be conveyed to another health care provider, the patient's insurer, certain investigators, the patient's employer, or the health care provider's licensing body under very limited circumstances.

Requires anyone who compiles, maintains, or dispenses patient medical records to implement administrative, technical, and physical safeguards for the security of identifiable health information.

Forbids any 3rd­party recipient of patient medical records or medical information from a health care provider, including insurance companies, from redisclosing such medical records or information without the specific authorization of the patient.

Makes the violation of this prohibition against the disclosure of patient medical records and medical information a class 6 felony.

Allows the commissioner of insurance to assess a fine and penalties for an insurance carrier's violation of the prohibition against the disclosure of patient medical records and medical information.

Adds violation of the prohibition against the disclosure of patient medical records and medical information to the grounds for discipline in the following medical practices:



Be it enacted by the General Assembly of the State of Colorado:

SECTION 1.  Part 8 of article 1 of title 25, Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW SECTION to read:

25­1­804.  Confidentiality of patient records ­ applicability ­ penalties. (1)  FOR THE PURPOSES OF THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a)  "AGENT" MEANS A PERSON WHO HAS BEEN APPOINTED AS A PATIENT'S AGENT UNDER A MEDICAL DURABLE POWER OF ATTORNEY PURSUANT TO SECTION 15­14­506, C.R.S.

(b)  "GUARDIAN" MEANS A COURT­APPOINTED GUARDIAN OF A PERSON.

(c)  "HEALTH CARE PROVIDER" MEANS ANY PERSON LICENSED OR CERTIFIED BY THE STATE OF COLORADO TO DELIVER HEALTH CARE SERVICES AND ANY CLINIC, HEALTH DISPENSARY, OR HEALTH FACILITY LICENSED BY THE STATE OF COLORADO. THE TERM INCLUDES ANY PROFESSIONAL CORPORATION OR OTHER PROFESSIONAL ENTITY COMPRISED OF SUCH HEALTH CARE PROVIDERS AS PERMITTED BY THE LAWS OF THIS STATE.

(d)  "HEALTH CARE SERVICES" SHALL HAVE THE SAME MEANING AS SET FORTH IN SECTION 10­16­102 (22), C.R.S.

(e)  "MEDICAL INFORMATION" MEANS ANY INFORMATION CONTAINED IN THE MEDICAL RECORD OR ANY INFORMATION PERTAINING TO THE MEDICAL AND HEALTH CARE SERVICES PERFORMED AT THE DIRECTION OF A PHYSICIAN OR OTHER LICENSED HEALTH CARE PROVIDER THAT IS PROTECTED BY THE PHYSICIAN­PATIENT PRIVILEGE ESTABLISHED BY SECTION 13­90­107 (1) (d), C.R.S.

(f)  "MEDICAL RECORD" SHALL HAVE THE SAME MEANING AS SET FORTH IN SECTION 18­4­412 (2) (a), C.R.S.

(g)  "PARENT" MEANS A BIOLOGICAL, ADOPTIVE, OR FOSTER PARENT.

(h)  "PATIENT" MEANS A PERSON WHO IS RECEIVING OR HAS RECEIVED HEALTH CARE SERVICES FROM A HEALTH CARE PROVIDER.

(2)  NO HEALTH CARE PROVIDER SHALL DISCLOSE PATIENT MEDICAL RECORDS WITHOUT FIRST OBTAINING WRITTEN AUTHORIZATION FROM THE PATIENT OR THE PATIENT'S AGENT, GUARDIAN, PARENT, OR OTHER LEGAL REPRESENTATIVE, EXCEPT AS PROVIDED IN SUBSECTIONS (3) OR (4) OF THIS SECTION.

(3)  A HEALTH CARE PROVIDER SHALL DISCLOSE A PATIENT'S MEDICAL RECORDS IF THE DISCLOSURE IS COMPELLED BY ANY OF THE FOLLOWING:

(a)  BY A COURT ORDER;

(b)  BY A BOARD, COMMISSION, OR ADMINISTRATIVE AGENCY FOR PURPOSES OF ADJUDICATION PURSUANT TO ITS LAWFUL AUTHORITY;

(c)   BY A PARTY TO A PROCEEDING BEFORE A COURT OR ADMINISTRATIVE AGENCY PURSUANT TO A SUBPOENA, SUBPOENA DUCES TECUM, OR ANY PROVISION AUTHORIZING DISCOVERY IN A PROCEEDING BEFORE A COURT OR ADMINISTRATIVE AGENCY;

(d)  BY A SEARCH WARRANT LAWFULLY ISSUED TO A GOVERNMENT LAW ENFORCEMENT AGENCY;

(e)  WHEN OTHERWISE SPECIFICALLY REQUIRED BY LAW.

(4)  A HEALTH CARE PROVIDER MAY DISCLOSE A PATIENT'S MEDICAL RECORDS AS FOLLOWS:

(a)  TO HEALTH CARE PROVIDERS OR OTHER HEALTH CARE PROFESSIONALS OR FACILITIES FOR PURPOSES OF DIAGNOSIS OR TREATMENT OF THE PATIENT;

(b)  TO AN INSURER, EMPLOYER, HEALTH CARE SERVICE PLAN, HOSPITAL SERVICE PLAN, EMPLOYEE BENEFIT PLAN, GOVERNMENTAL AUTHORITY, OR ANY OTHER PERSON OR ENTITY RESPONSIBLE FOR PAYING FOR HEALTH CARE SERVICES RENDERED TO THE PATIENT, ONLY TO THE EXTENT NECESSARY TO ALLOW RESPONSIBILITY OF PAYMENT TO BE MADE. THE MEDICAL RECORDS MAY ALSO BE DISCLOSED TO ANOTHER HEALTH CARE PROVIDER AS NECESSARY TO ASSIST IN OBTAINING PAYMENT FOR HEALTH CARE SERVICES RENDERED BY THAT PROVIDER TO THE PATIENT.

(c)  TO ANY PERSON OR ENTITY THAT PROVIDES BILLING, CLAIMS MANAGEMENT, MEDICAL DATA PROCESSING, OR OTHER ADMINISTRATIVE SERVICES FOR HEALTH CARE PROVIDERS; EXCEPT THAT NO MEDICAL RECORD SO DISCLOSED SHALL BE FURTHER DISCLOSED BY THE RECIPIENT IN ANY WAY THAT WOULD VIOLATE THIS SECTION;

(d)  TO ORGANIZED COMMITTEES AND PROFESSIONAL SOCIETIES OR MEDICAL STAFFS OF LICENSED HOSPITALS, OR TO PROFESSIONAL STANDARDS REVIEW ORGANIZATIONS, OR TO PERSONS OR ORGANIZATIONS INSURING, RESPONSIBLE FOR, OR DEFENDING PROFESSIONAL LIABILITY THAT A PROVIDER MAY INCUR, TO THE COMMITTEES, ORGANIZATIONS, OR PERSONS THAT ARE ENGAGED IN REVIEWING HEALTH CARE SERVICES WITH RESPECT TO MEDICAL NECESSITY, LEVEL OF CARE, QUALITY OF CARE, OR JUSTIFICATION OF CHARGES;

(e)  TO ANY PRIVATE OR PUBLIC BODY RESPONSIBLE FOR LICENSING OR ACCREDITING SUCH HEALTH CARE PROVIDER; EXCEPT THAT NO PATIENT IDENTIFYING INFORMATION SHALL BE REMOVED FROM THE PREMISES UNLESS EXPRESSLY PERMITTED OR OTHERWISE REQUIRED BY LAW;

(f)  TO A COUNTY CORONER IN THE COURSE OF AN INVESTIGATION BY THE CORONER'S OFFICE;

(g)  TO AN EMPLOYEE'S EMPLOYER IF THE HEALTH CARE PROVIDER HAS CREATED MEDICAL RECORDS AS A RESULT OF EMPLOYMENT­RELATED HEALTH CARE SERVICES TO AN EMPLOYEE CONDUCTED UPON THE SPECIFIC PRIOR WRITTEN REQUEST AND EXPENSE OF THE EMPLOYER THAT:

(I)  IS RELEVANT IN A LAW SUIT, ARBITRATION, GRIEVANCE, OR OTHER CLAIM OR CHALLENGE TO WHICH THE EMPLOYER AND THE EMPLOYEE ARE PARTIES AND IN WHICH THE PATIENT HAS PLACED IN ISSUE HIS OR HER MEDICAL HISTORY, MENTAL OR PHYSICAL CONDITIONS, OR TREATMENT; EXCEPT THAT SUCH MEDICAL RECORDS SHALL ONLY BE USED OR DISCLOSED IN CONNECTION WITH THAT PROCEEDING.

(II)  DESCRIBES FUNCTIONAL LIMITATIONS OF THE PATIENT THAT MAY ENTITLE THE PATIENT TO LEAVE FROM WORK FOR MEDICAL REASONS OR LIMIT THE PATIENT'S FITNESS TO PERFORM HIS OR HER PRESENT EMPLOYMENT; EXCEPT THAT NO STATEMENT OF MEDICAL CAUSE SHALL BE INCLUDED IN THE INFORMATION DISCLOSED.

(h)  TO A SPONSOR, INSURER, OR ADMINISTRATOR OF A GROUP OR INDIVIDUAL INSURED OR UNINSURED PLAN OR POLICY THAT THE PATIENT SEEKS COVERAGE BY OR BENEFITS FROM, IF THE INFORMATION WAS CREATED BY THE HEALTH CARE PROVIDER AS THE RESULT OF SERVICES CONDUCTED UPON THE SPECIFIC PRIOR WRITTEN REQUEST OF THE SPONSOR, INSURER, OR ADMINISTRATOR FOR THE PURPOSE OF EVALUATING THE APPLICATION FOR COVERAGE OR BENEFITS;

(i)  TO A PREPAYMENT HEALTH BENEFIT PLAN BY HEALTH CARE PROVIDERS WHO CONTRACT WITH THE PLAN AND MAY BE TRANSFERRED AMONG HEALTH CARE PROVIDERS WHO CONTRACT WITH THE PLAN, SOLELY FOR THE PURPOSE OF ADMINISTERING THE PLAN. MEDICAL RECORDS SHALL NOT OTHERWISE BE DISCLOSED BY A HEALTH BENEFIT PLAN EXCEPT IN ACCORDANCE WITH THIS SECTION.

(5)  NO THIRD PARTY TO WHOM DISCLOSURE OF PATIENT MEDICAL RECORDS IS MADE BY A HEALTH CARE PROVIDER SHALL REDISCLOSE OR OTHERWISE REVEAL THE MEDICAL RECORDS OF A PATIENT, BEYOND THE PURPOSE FOR WHICH SUCH DISCLOSURE WAS MADE, WITHOUT FIRST OBTAINING THE PATIENT'S SPECIFIC CONSENT TO SUCH REDISCLOSURE; EXCEPT THAT A HEALTH CARE PROVIDER WHO RECEIVES PATIENT MEDICAL RECORDS FROM ANOTHER HEALTH CARE PROVIDER MAY MAKE A SUBSEQUENT DISCLOSURE AS PERMITTED BY THIS SECTION. A "THIRD PARTY" INCLUDES, BUT IS IN NO WAY LIMITED TO, ANY PROVIDER OF HEALTH INSURANCE COVERAGE UNDER ARTICLE 16 OF TITLE 10, C.R.S.

(6)  ANY HEALTH CARE PROVIDER, PROVIDER OF HEALTH INSURANCE COVERAGE, OR ANY OTHER PERSON OR ENTITY THAT COMPILES, MAINTAINS, AND DISPENSES PATIENT MEDICAL RECORDS SHALL IMPLEMENT ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS FOR THE SECURITY OF IDENTIFIABLE HEALTH INFORMATION.

(7)  IN ADDITION TO ANY OTHER REMEDIES AVAILABLE AT LAW, A PATIENT WHOSE MEDICAL RECORD HAS BEEN USED OR DISCLOSED IN VIOLATION OF THIS SECTION AND WHO HAS SUSTAINED ECONOMIC LOSS OR PERSONAL INJURY THEREFROM MAY RECOVER COMPENSATORY DAMAGES, PUNITIVE DAMAGES, ATTORNEY FEES, AND THE COSTS OF LITIGATION.

SECTION 2.  6­18­103 (1) (d), (2) (a), and (4), Colorado Revised Statutes, are amended to read:

6­18­103.  Privacy of health information. (1)  The privacy of individually identifiable health information collected for or by a cooperative shall be protected. Disclosure of such information is prohibited except:

(d)  Subject to rules promulgated by the executive director, disclosures for bona fide research projects.

(2) (a)  All disclosures of individually identifiable health information shall be restricted to the minimum amount of information necessary to accomplish the purpose for which the information is being disclosed AND ONLY IN ACCORDANCE WITH SECTION 25­1­804, C.R.S.

(4)  Provider networks and providers in a network shall maintain the confidentiality of medical records as otherwise required by law, including section SECTIONS 18­4­412 AND 25­1­804, C.R.S.

SECTION 3.  Part 1 of article 16 of title 10, Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW SECTION to read:

10­16­122.  Confidentiality of patient medical records ­ violation ­ penalties. IF ANY CARRIER REGULATED BY THE COMMISSIONER OF INSURANCE KNOWINGLY VIOLATES ANY PROVISION OF SECTION 25­1­804, C.R.S., CONCERNING THE CONFIDENTIALITY OF PATIENT MEDICAL RECORDS AND MEDICAL INFORMATION AS OTHERWISE REQUIRED BY LAW, THE COMMISSIONER MAY ASSESS A PENALTY NOT TO EXCEED ONE THOUSAND DOLLARS FOR THE INITIAL VIOLATION AND A PENALTY OF TEN THOUSAND DOLLARS FOR ANY SUBSEQUENT VIOLATION.

SECTION 4.  The introductory portion to 12­29.5­106 (1), Colorado Revised Statutes, is amended, and the said 12­29.5­106 (1) is further amended BY THE ADDITION OF A NEW PARAGRAPH, to read:

12­29.5­106.  Grounds for disciplinary action. (1)  The director may deny registration to or take disciplinary action against an acupuncturist pursuant to section 24­4­105, C.R.S., if he OR SHE finds that the acupuncturist has committed any of the following acts:

(p)  VIOLATED THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 5.  12­32­107 (3), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­32­107.  Issuance, revocation, or suspension of license ­ probation ­ immunity in professional review. (3)  "Unprofessional conduct" as used in this article means:

(ff)  VIOLATING THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 6.  12­33­117 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­33­117.  Discipline of licensees ­ letters of admonition, suspension, revocation, denial, and probation ­ grounds. (1)  Upon any of the following grounds, the board may issue a letter of admonition to a licensee or may revoke, suspend, deny, refuse to renew, or impose conditions on such licensee's license:

(dd)  VIOLATING THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 7.  12­35­118 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­35­118.  Causes for denial of issuance or renewal ­ suspension or revocation of licenses ­ other disciplinary action ­ unprofessional conduct defined ­ immunity in professional review. (1)  The board may deny the issuance or renewal of, suspend for a specified time period, or revoke any license provided for by this article or may reprimand, censure, or place on probation any licensed dentist or dental hygienist after notice and hearing, which may be conducted by an administrative law judge, pursuant to the provisions of article 4 of title 24, C.R.S., or it may issue a letter of admonition without a hearing (except that any licensed dentist or dental hygienist to whom such a letter of admonition is sent may, within thirty days after the date of the mailing of such letter by the board, request in writing to the board a formal hearing thereon, and the letter of admonition shall be deemed vacated, and the board shall, upon such request, hold such a hearing) for any of the following causes:

(gg)  VIOLATING THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 8.  12­36­117 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­36­117.  Unprofessional conduct. (1)  "Unprofessional conduct" as used in this article means:

(jj)  VIOLATING THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 9.  12­37­107 (3), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­37­107.  Disciplinary action authorized ­ grounds for discipline. (3)  The director has the power to deny, revoke, or suspend any registration or to issue a letter of admonition or place a registrant on probation for any of the following acts or omissions:

(l)  VIOLATION OF THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 10.  12­38­117 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­38­117.  Grounds for discipline. (1)  The board has the power to revoke, suspend, withhold, limit the scope of, or refuse to renew any license, to place on probation a licensee or temporary license holder, or to issue a letter of admonition to a licensee in accordance with the procedures set forth in subsection (3) of this section, upon proof that such person:

(u)  HAS VIOLATED THE PROVISIONS OF SECTION 25­1­804, C.R.S.

SECTION 11.  12­38.1­111 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­38.1­111.  Grounds for discipline. (1)  The board may suspend, revoke, or deny any certification to practice as a nurse aide or issue a letter of admonition to a certified nurse aide upon proof that such person:

(o)  HAS VIOLATED SECTION 25­1­804, C.R.S.

SECTION 12.  12­39­111 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­39­111.  Grounds for discipline. (1)  The board has the power to revoke, suspend, withhold, or refuse to renew any license, to place on probation a licensee or temporary license holder, or to issue a letter of admonition to a licensee in accordance with the procedures set forth in subsection (3) of this section, upon proof that such person:

(l)  HAS VIOLATED SECTION 25­1­804, C.R.S.

SECTION 13.  12­40­118 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­40­118.  Unprofessional conduct defined. (1)  The term "unprofessional conduct", as used in this article, means:

(mm)  VIOLATING SECTION 25­1­804, C.R.S.

SECTION 14.  12­41­115 (1), Colorado Revised Statutes, is amended BY THE ADDITION OF A NEW PARAGRAPH to read:

12­41­115.  Grounds for disciplinary action. (1)  The director is authorized to take disciplinary action in accordance with section 12­41­116 if the licensee has:

(r)  VIOLATED SECTION 25­1­804, C.R.S.

SECTION 15.  12­42­113 (1) (k), Colorado Revised Statutes, is amended to read:

12­42­113.  Grounds for discipline. (1)  The board has the power to revoke, suspend, withhold, limit the scope of, or refuse to renew any license to practice as a psychiatric technician, to place on probation a licensee, or to issue a letter of admonition to a licensee in accordance with the procedures set forth in subsection (3) of this section, upon proof that such person:

(k)  Has violated the confidentiality of information or knowledge ACCORDING TO SECTION 25­1­804, C.R.S., OR as OTHERWISE prescribed by law concerning any patient;

SECTION 16.  The introductory portion to 12­43­704 (1), Colorado Revised Statutes, is amended, and the said 12­43­704 (1) is further amended BY THE ADDITION OF A NEW PARAGRAPH, to read:

12­43­704.  Prohibited activities ­ related provisions. (1)  A person practicing psychotherapy under this article is in violation of this article if he SUCH PERSON:

(v)  HAS VIOLATED SECTION 25­1­804, C.R.S.

SECTION 17.  18­4­412 (1), Colorado Revised Statutes, is amended to read:

18­4­412.  Theft of medical records or medical information ­ penalty. (1)  Any person who, without proper authorization, knowingly obtains a medical record or medical information with the intent to appropriate the medical record or medical information to his OR HER own use or to the use of another, who steals or discloses to an unauthorized person a medical record or medical information, or who, without authority, makes or causes to be made a copy of a medical record or medical information, OR WHO KNOWINGLY VIOLATES SECTION 25­1­804, C.R.S., commits theft of a medical record or medical information.

SECTION 18.  Effective date ­ applicability. (1)  This act shall take effect September 1, 1998, unless a referendum petition is filed during the ninety­day period after final adjournment of the general assembly that is allowed for submitting a referendum petition pursuant to article V, section 1 (3) of the state constitution. If such a referendum petition is filed against this act or an item, section, or part of this act within such period, then the act, item, section, or part, shall take effect on the specified date only if approved by the people.

(2)  The provisions of this act shall apply to all health care providers who are licensed, certified, or registered under title 12, Colorado Revised Statutes, and to all persons who receive patient medical records or information from health care providers on or after the applicable effective date of this act.