PRINTER'S NO. 930
No. 811 Session of 1985
INTRODUCED BY KUKOVICH, ITKIN, NOYE, OLIVER, REBER, AFFLERBACH,
STABACK, DURHAM, GREENWOOD, TIGUE, WOZNIAK, FOX, TRELLO,
MICHLOVIC, DeLUCA, KASUNIC, DeWEESE, PETRONE, BELARDI,
BELFANTI, DEAL, PISTELLA, GAMBLE, GRUPPO, DISTLER, MAIALE,
PRATT, DALEY, FLICK, JOSEPHS, RICHARDSON, FREEMAN AND COHEN,
APRIL 10, 1985
REFERRED TO COMMITTEE ON HEALTH AND WELFARE, APRIL 10, 1985
AN ACT
1 Providing for confidentiality of health information in the
2 possession or custody of individual health care providers.
3 The General Assembly of the Commonwealth of Pennsylvania
4 hereby enacts as follows:
5 Section 1. Short title.
6 This act shall be known and may be cited as the
7 Confidentiality of Health Information Act.
8 Section 2. Declaration of policy.
9 This act has four principal purposes:
10 (1) To fill the legal void that presently exists in
11 Pennsylvania where applicable statutes and regulations do
12 not, as a general matter, apply to health information in the
13 possession of the health care provider who is not affiliated
14 with a hospital or public institution.
15 (2) To provide patients and clients with notice of a
16 health care provider's information practices.
1 (3) To protect the confidentiality of patient or client
2 health information by prohibiting the disclosure of such
3 information by health care providers to third parties, except
4 where the patient consents or where the public interest in
5 disclosure outweighs the patient's privacy interest and the
6 nonconsensual disclosure has been specifically authorized in
7 this act.
8 (4) To provide a remedy in damages and for reasonable
9 attorney fees for violations of this act.
10 In order to protect an individual's privacy, a privacy
11 protection statute must give the subject the right to approve or
12 disapprove disclosure and redisclosure to third parties, with
13 narrow, specifically identified exceptions.
14 Section 3. Definitions.
15 The following words and phrases when used in this act shall
16 have the meanings given to them in this section unless the
17 context clearly indicates otherwise:
18 "Audit." An assessment, evaluation, determination or
19 investigation of a health care provider relating to:
20 (1) compliance with statutory, regulatory, fiscal,
21 medical or scientific standards;
22 (2) compliance with a private or public program of
23 payments to a health care provider;
24 (3) the licensing, accreditation or certification of
25 health care facilities or health care providers; or
26 (4) a peer review conducted by a committee of a state or
27 local professional medical society; by a medical staff of a
28 licensed hospital, nursing home or other health care
29 facility, if the medical staff operates pursuant to written
30 bylaws that have been approved by the governing board of the
19850H0811B0930 - 2 -
1 hospital, nursing home or other health care facility; or by
2 another organization of physicians formed pursuant to State
3 or Federal law and authorized to evaluate medical and health
4 care services.
5 "Health care provider." A person who is licensed, certified
6 or otherwise authorized by law to administer health care in the
7 ordinary course of business or practice of a profession. The
8 term includes physicians, psychiatrists, psychologists and other
9 health care providers such as social workers, rape counselors
10 and family planning counselors.
11 "Health information." Any information contained in a medical
12 record or any information pertaining to the medical and health
13 care services performed by or at the direction of a health care
14 provider which identifies the patient or client, or from whom
15 the identity of the patient or client can reasonably be
16 determined.
17 "Medical record." The written or graphic documentation,
18 sound record, video tape, phonograph or computer record of
19 services pertaining to medical or health care performed at the
20 direction of a physician, licensed health care provider or
21 health care practitioner on behalf of a patient or client by
22 physicians, dentists, nurses, technicians or other health care
23 personnel. The term includes diagnostic documentation such as X-
24 rays, electrocardiograms, electroencephalograms and test
25 results.
26 "Proper authorization." A written authorization signed by
27 the patient, client or a duly designated representative which
28 shall contain:
29 (1) The name of an individual or organization who is to
30 make the disclosure.
19850H0811B0930 - 3 -
1 (2) Sufficient information to adequately identify the
2 patient or client.
3 (3) A time limit on its validity which shows starting
4 and ending dates.
5 (4) Identification of the agency or person to whom the
6 records are to be released.
7 (5) A statement of the specific purposes for which the
8 released records are to be used.
9 (6) A statement identifying the specific relevant and
10 timely information to be released.
11 (7) A place for the signature of the person who has
12 authority to sign, and his parent, guardian or personal
13 representative, and the date, following a statement that the
14 person understands the nature of his release.
15 (8) A place to record an oral consent to the release of
16 information given by a person physically unable to provide a
17 signature and a place for the signatures of two responsible
18 persons who witnessed that the person understood the nature
19 of the release and freely gave the oral consent.
20 (9) An indication that the consent is revocable at the
21 request of the person giving consent.
22 An authorization under this act remains valid for one year from
23 the effective date unless revoked pursuant to this section and
24 such an authorization is otherwise subject to the terms of this
25 act.
26 Section 4. Confidentiality of health information.
27 (a) Disclosure prohibited; exceptions.--All health
28 information in the possession or custody of health care
29 providers shall be kept confidential and may not be released or
30 its contents disclosed to anyone without proper authorization
19850H0811B0930 - 4 -
1 except:
2 (1) To those employees or staff of the health care
3 provider where access to the information is required for
4 proper performance of their duties.
5 (2) To prevent death or severe illness in an emergency
6 where disclosure of health information is necessary for
7 treatment of the patient or client.
8 (3) Pursuant to an order of a court of common pleas
9 after application showing good cause with proper notice and
10 an opportunity to be heard. In determining whether there is
11 good cause for disclosure, the court shall weigh the need for
12 the information sought to be disclosed against the possible
13 harm of disclosure to the person to whom the information
14 pertains. The court shall consider the physician-patient or
15 professional-client relationship and treatment services and
16 may condition disclosure of the information upon any
17 appropriate safeguards.
18 (4) To persons, including students, employed or
19 affiliated with that health care provider who are providing
20 health care to the patient or require the information for
21 financial auditing or preparation of bills and submission of
22 claims for payment of charges for services to the patient or
23 for recordkeeping purposes.
24 (5) For purposes of an audit, if the person who obtains
25 information pursuant to this section agrees, in writing, to
26 remove or destroy, before copying wherever possible, and in
27 any event, at the earliest opportunity, consistent with the
28 purpose of the audit, information that would enable patients
29 to be identified.
30 (b) Notice to accompany disclosure.--Whenever a written
19850H0811B0930 - 5 -
1 disclosure is made under authority of this section, the
2 disclosure shall be accompanied by a written statement
3 substantially as follows:
4 This information has been disclosed to you from records
5 whose confidentiality is protected by State law. You are
6 prohibited from making any further disclosure of it
7 without the specific written consent of the person to
8 whom it pertains, or as otherwise permitted by this act.
9 A general authorization for the release of medical or
10 other information is not sufficient for this purpose.
11 An oral disclosure may be accompanied or followed by the notice.
12 (c) Consent required for redisclosure.--A person who
13 receives health information from patient records and has been
14 notified substantially is prohibited from making any disclosure
15 of the information except with the specific written consent of
16 the person to whom it pertains.
17 (d) Standing.--For the purposes of this act, any patient or
18 client who is legally capable of consenting to treatment shall
19 have standing to assert rights under the provisions of this act.
20 With respect to patients or clients who are not legally capable
21 of consenting to treatment, their parents, guardians or personal
22 representatives shall have standing to assert rights under this
23 act.
24 (e) Rights prescribed.--Nothing in this act is intended to
25 alter rights on limitations upon disclosure or release of
26 confidential information that are defined and prescribed in
27 applicable State law.
28 (f) Disclosure by the health care providers.--A health care
29 provider shall maintain, as a permanent part of the patient's
30 health care information, a record of all disclosures of health
19850H0811B0930 - 6 -
1 care information during the preceding three years to any person
2 not employed by or affiliated with the health care provider. The
3 disclosure record must include the name and address of each
4 person receiving the disclosure the date of the disclosure, and
5 a description of the information disclosed.
6 Section 5. Civil action.
7 (a) Action may be brought.--Any person aggrieved by
8 violation of this act may bring an action for relief as provided
9 in this section. That person assumes the burden of proof unless
10 otherwise indicated.
11 (b) Damages.--In any action brought under this section in
12 which the court determines that a health care provider or other
13 person has willfully violated any provision of this act, the
14 patient or client is entitled to recover from any such person:
15 (1) actual damages, but not less than liquidated
16 damages, computed at the rate of $1,000 for each violation;
17 (2) punitive damages; and
18 (3) reasonable attorney fees and other litigation costs
19 reasonably incurred.
20 Section 6. Effective date.
21 This act shall take effect in 60 days.
C5L35RAW/19850H0811B0930 - 7 -