First Regular Session
Sixty-second General Assembly
LLS NO. 99-0272.01 Julie Pelegrin HOUSE BILL 99-1184
STATE OF COLORADO
BY REPRESENTATIVE Witwer
HEALTH, ENVIRONMENT, WELFARE, & INSTITUTIONS
A BILL FOR AN ACT
101 CONCERNING CONFIDENTIALITY OF MEDICAL INFORMATION.
Bill Summary
(Note: This summary applies to this bill as introduced and does
not necessarily reflect any amendments that may be subsequently
adopted.)
Clarifies that any entity that provides health care coverage in this
state is subject to the prohibition against theft of medical records or
medical information. Directs that, upon the third conviction within 12
months of an entity or of any employees of an entity for theft of medical
records or medical information, the entity's certificate of authority or
license shall be suspended for 6 months.
Makes misuse of medical information an unfair or deceptive act or
practice, commission of which may subject an insurance company or
agent to administrative sanctions. Requires the commissioner of
insurance to suspend a person's license if the person or any of the person's
employees commits the unfair or deceptive act or practice of misuse of
medical information 3 times within 12 months.
1 Be it enacted by the General Assembly of the State of Colorado:
2 SECTION 1. 18-4-412 (2), Colorado Revised Statutes, is
3 amended to read:
4 18-4-412. Theft of medical records or medical information -
5 penalty. (2) As used in this section:
6 (a) "Medical record" means the written or graphic documentation,
[ ] denotes HOUSE amendment. { } denotes SENATE amendment.
Capital letters indicate new material to be added to existing statute.
Dashes through the words indicate material to be deleted from existing statute.
Page 2
1 sound recording, or computer record of services pertaining to medical and
2 health care which THAT are performed at the direction of a physician or
3 other licensed health care provider on behalf of a patient by physicians,
4 dentists, nurses, technicians, or other health care personnel. "Medical
5 record" includes such diagnostic documentation as X rays,
6 electrocardiograms, electroencephalograms, and other test results.
7 (b) "Medical information" means any information contained in the
8 medical record or any information pertaining to the medical and health
9 care services performed at the direction of a physician or other licensed
10 health care provider which THAT is protected by the physician-patient
11 privilege established by section 13-90-107 (1) (d), C.R.S.
12 (c) "Proper authorization" means a written authorization signed
13 by the patient or his THE PATIENT'S duly designated representative or an
14 appropriate order of court or authorized possession pursuant to law or
15 regulation for claims processing, possession for medical audit or quality
16 assurance purposes, possession by a consulting physician to the patient,
17 or possession by hospital personnel for record-keeping and billing
18 purposes.
19 (c.5) "CARRIER" MEANS ANY ENTITY THAT PROVIDES HEALTH CARE
20 COVERAGE IN THIS STATE. "CARRIER" INCLUDES A FRANCHISE INSURANCE
21 PLAN, A FRATERNAL BENEFIT SOCIETY, A HEALTH MAINTENANCE
22 ORGANIZATION, A NONPROFIT HOSPITAL AND HEALTH SERVICE
23 CORPORATION, A SICKNESS AND ACCIDENT INSURANCE COMPANY, AND ANY
24 OTHER ENTITY PROVIDING A PLAN OF HEALTH INSURANCE OR HEALTH
25 BENEFITS SUBJECT TO THE INSURANCE LAWS AND REGULATIONS OF
26 COLORADO.
Page 3
1 (d) "Copy" means any facsimile, replica, photograph, sound
2 recording, magnetic or electronic recording, or other reproduction of a
3 medical record and any note, drawing, or sketch made of or from a
4 medical record.
5 SECTION 2. 18-4-412 (3), Colorado Revised Statutes, is
6 amended to read:
7 18-4-412. Theft of medical records or medical information -
8 penalty. (3) (a) Theft of a medical record or medical information is a
9 class 6 felony.
10 (b) IF A CARRIER IS CONVICTED OF THEFT OF MEDICAL RECORDS OR
11 MEDICAL INFORMATION THREE TIMES WITHIN TWELVE MONTHS, OR IF A
12 TOTAL OF THREE CONVICTIONS OF THEFT OF MEDICAL RECORDS OR
13 MEDICAL INFORMATION OCCUR WITHIN TWELVE MONTHS INVOLVING ONE
14 OR MORE EMPLOYEES OF THE CARRIER, ANY CERTIFICATE OF AUTHORITY
15 OR LICENSE HELD BY THE CARRIER SHALL BE SUSPENDED FOR SIX MONTHS,
16 IN ADDITION TO ANY OTHER PENALTY IMPOSED PURSUANT TO THIS
17 SECTION.
18 SECTION 3. 6-18-103 (4), Colorado Revised Statutes, is
19 amended to read:
20 6-18-103. Privacy of health information. (4) CARRIERS,
21 provider networks, and providers in a network shall maintain the
22 confidentiality of medical records as otherwise required by law, including
23 section 18-4-412, C.R.S., AND SHALL BE SUBJECT TO PENALTIES FOR
24 VIOLATION OF SAID SECTION, INCLUDING SUSPENSION OF THE ENTITY'S
25 CERTIFICATE OF AUTHORITY OR LICENSE UNDER CIRCUMSTANCES AS
26 PROVIDED IN SECTION 18-4-412 (3) (b), C.R.S.
Page 4
1 SECTION 4. 10-1-111 (1), Colorado Revised Statutes, is
2 amended BY THE ADDITION OF A NEW PARAGRAPH to read:
3 10-1-111. Grounds and procedure for suspension or
4 revocation of certificate or license of entities. (1) The certificate of
5 authority of an insurance company to do business in this state may be
6 revoked or suspended by the commissioner for any reason specified in
7 this title, article 7 of title 12, and article 14 of title 24, C.R.S.
8 Specifically, the certificate may be suspended or revoked by the
9 commissioner for the following reasons:
10 (k) THREE CONVICTIONS OF THE INSURANCE COMPANY, OR A TOTAL
11 OF THREE CONVICTIONS INVOLVING ONE OR MORE EMPLOYEES OF THE
12 INSURANCE COMPANY, WITHIN A TWELVE-MONTH PERIOD OF THEFT OF
13 MEDICAL RECORDS OR MEDICAL INFORMATION PURSUANT TO SECTION
14 18-4-412, C.R.S.
15 SECTION 5. 10-1-111 (2) and (4), Colorado Revised Statutes,
16 are amended to read:
17 10-1-111. Grounds and procedure for suspension or
18 revocation of certificate or license of entities. (2) If the commissioner
19 finds upon examination, hearing, or other evidence that any foreign or
20 domestic insurance company has committed any of the acts specified in
21 subsection (1) of this section, or any other act specified in this title, article
22 7 of title 12, and article 14 of title 24, C.R.S., for which the penalty is
23 suspension or revocation of the certificate of authority, the commissioner
24 may suspend or revoke such certificate of authority, if he THE
25 COMMISSIONER deems it in the best interest of the public and the
26 policyholders of the company, notwithstanding any other provision of
Page 5
1 said references; EXCEPT THAT, IF THE COMPANY HAS COMMITTED THE ACTS
2 SPECIFIED IN PARAGRAPH (k) OF SUBSECTION (1) OF THIS SECTION, THE
3 COMMISSIONER SHALL SUSPEND THE COMPANY'S LICENSE, AS PROVIDED IN
4 SECTION 18-4-412 (3) (b), C.R.S. Notice of any revocation shall be
5 published in one or more daily newspapers in Denver which THAT have
6 a general state circulation. Before suspending or revoking any certificate
7 of authority of an insurance company, the commissioner shall grant the
8 company fifteen days in which to show cause why such action should not
9 be taken, UNLESS THE COMPANY'S CERTIFICATE OF AUTHORITY IS
10 SUSPENDED PURSUANT TO PARAGRAPH (k) OF SUBSECTION (1) OF THIS
11 SECTION, IN WHICH CASE SUCH SUSPENSION SHALL BE IMMEDIATE. Any
12 final decision of the commissioner to suspend or revoke a certificate of
13 authority or license of any person or entity regulated by the division of
14 insurance shall be subject to judicial review by the court of appeals
15 pursuant to section 24-4-106 (11), C.R.S.
16 (4) If the commissioner finds upon examination or other evidence
17 that any foreign or domestic insurance company has committed any act
18 specified in subsection (1) of this section OTHER THAN THE ACTS
19 SPECIFIED IN PARAGRAPH (k) OF SUBSECTION (1) OF THIS SECTION, the
20 commissioner after notice and hearing may issue an order requiring that
21 the insurance company cease and desist committing such act. If the
22 commissioner believes an emergency exists, the commissioner may enter
23 a cease and desist order at once, and a hearing shall be held as soon as
24 practicable. Pending such hearing and decision thereon, the emergency
25 order shall stay in effect subject to the power of the commissioner on his
26 OR HER own motion or on petition to vacate such order.
Page 6
1 SECTION 6. 10-3-1104 (1), Colorado Revised Statutes, is
2 amended BY THE ADDITION OF A NEW PARAGRAPH to read:
3 10-3-1104. Unfair methods of competition and unfair or
4 deceptive acts or practices. (1) The following are defined as unfair
5 methods of competition and unfair or deceptive acts or practices in the
6 business of insurance:
7 (z) MISUSE OF MEDICAL RECORDS OR MEDICAL INFORMATION, AS
8 DEFINED IN SECTION 18-4-412 (2), C.R.S., IN THE MANNER DESCRIBED IN
9 SECTION 18-4-412, C.R.S.
10 SECTION 7. 10-3-1108, Colorado Revised Statutes, is amended
11 BY THE ADDITION OF A NEW SUBSECTION to read:
12 10-3-1108. Orders. (3) NOTWITHSTANDING THE PROVISIONS OF
13 SUBSECTION (1) OF THIS SECTION, IF, AFTER A HEARING CONDUCTED UNDER
14 SECTION 10-3-1107, THE COMMISSIONER DETERMINES THAT THE PERSON
15 CHARGED HAS ENGAGED IN THE UNFAIR OR DECEPTIVE ACT OR PRACTICE
16 OF MISUSE OF MEDICAL RECORDS OR MEDICAL INFORMATION, AS
17 DESCRIBED IN SECTION 10-3-1104 (1) (z), AND THAT THE PERSON HAS
18 COMMITTED SUCH ACT THREE TIMES WITHIN TWELVE MONTHS, OR IF A
19 TOTAL OF THREE SUCH ACTS ARE COMMITTED WITHIN TWELVE MONTHS
20 INVOLVING ONE OR MORE EMPLOYEES OF THE PERSON, THE COMMISSIONER
21 SHALL SUSPEND THE PERSON'S LICENSE FOR A MINIMUM OF SIX MONTHS, IN
22 ADDITION TO ANY OTHER PENALTY THE COMMISSIONER MAY IMPOSE
23 PURSUANT TO THIS SECTION.
24 SECTION 8. Effective date - applicability. This act shall take
25 effect upon passage, and shall apply in situations where the third offense
26 under section 18-4-412, Colorado Revised Statutes, is committed on or
Page 7
1 after said date.
2 SECTION 9. Safety clause. The general assembly hereby finds,
3 determines, and declares that this act is necessary for the immediate
4 preservation of the public peace, health, and safety.