ASSEMBLY, No. 1474

STATE OF NEW JERSEY

INTRODUCED FEBRUARY 5, 1996

By Assemblymen KAVANAUGH, FELICE, Assemblywomen Vandervalk and Murphy

An Act concerning health care information records and supplementing Title 26 and 45 of the Revised Statutes.

    Be It Enacted by the Senate and General Assembly of the State of New Jersey:

    1. The Legislature finds and declares that:

    a. Health care information is personal and sensitive information that, if improperly used or released, may do significant harm to a patient's interests in privacy and in health care, and may affect a patient's ability to obtain employment, education, insurance, credit and other necessities;

    b. Patients need access to their own health care information as a matter of fairness to enable them to make informed decisions about their health care and to correct inaccurate or incomplete information about themselves;

    c. Persons receiving, maintaining and distributing health care information need clear and certain rules for the handling, maintenance, dissemination and disclosure of health care information; and

    d. Health care information is obtained, used and disclosed in many different contexts and for many different purposes, and a patient's interest in the proper use and disclosure of his personal health care information continues even when the information has been initially disclosed and is held by other persons.

    2. As used in sections 1 through 10 of this act:

    "Commissioner" means the Commissioner of Health.

    "Health care" means any preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, counseling, service or procedure provided by a health care facility with respect to a patient's physical or mental condition, or affecting the structure or function of the human body or any part thereof, including, but not limited to, the banking of blood, sperm, organs or any other tissue, or a sale or dispensing of a drug, substance, device, equipment or other item to a patient or for a patient's use pursuant to a prescription.

    "Health care facility" means a health care facility regulated by the Department of Health pursuant to P.L.1971, c.136 (C.26:2H-1 et seq.).

     "Health care information" means any data or information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and relates to a patient's health care, and is obtained in the course of a patient's health care from a health care facility, the patient, a member of the patient's family, a person with whom the patient has a close personal relationship, or a patient representative.

    "Patient" means a person who receives or has received health care.

    "Patient representative" means a person legally empowered to make decisions about a patient's health care on the patient's behalf or the administrator or executor of a deceased patient's estate.

    "Record" means a patient's health care information record.

    3. A health care facility is subject to the provisions of sections 1 through 10 of this act, notwithstanding the provisions of any other law to the contrary, except as otherwise provided herein.

    4. a. A record maintained by a health care facility is confidential and shall be disclosed only for the purposes authorized by this act.

    b. A health care facility, in accordance with regulations adopted by the commissioner, shall develop and implement a written policy governing the confidentiality of records maintained by the facility. The policy shall include procedures designed to ensure the security of its records during storage, processing or transmission, either in electronic or other form, and shall stipulate that any person who is granted access to a record maintained by the facility shall have previously received and signed a form approved by the commissioner which explains the facility's written confidentiality policy and obligates the person to abide thereby.

    c. The content of a record may be disclosed in accordance with the prior written authorization of the patient or patient representative, or if the patient is legally incompetent or deceased, in accordance with section 7 of this act, only if the authorization is provided on a form and in a manner approved by the commissioner and the purpose and period of time for which disclosure is authorized are clearly stated on the authorization form.

    d. Except as otherwise provided in this act, the signing or authentication of a patient's or patient representative's authorization for disclosure shall be considered permission for disclosure only for the purposes explicitly contained in the authorization and shall not be considered a waiver of any rights a patient has under federal or State statute, court rule or common law.

    e. If the patient's or patient representative's prior written authorization is not obtained, the record shall be disclosed only under the following conditions, except that nothing in this subsection shall be construed to permit the disclosure of a record to a person, agency or other entity to whom disclosure is otherwise prohibited under State or federal law:

    (1) To the patient or the patient representative;

    (2) To a health care provider who is providing health care to the patient, except as the disclosure is limited or prohibited by the patient;

     (3) To a member of the patient's immediate family, or to another person with whom the patient is known to have a close personal relationship, if the disclosure is made in accordance with good medical or other professional practice, except as the disclosure is limited or prohibited by the patient;

    (4) To any person to the extent that person needs to know the information in the record, if the holder of the record believes that the disclosure will avoid or minimize imminent danger to the health or safety of the patient or any other person, or is necessary to alleviate emergency circumstances affecting the health or safety of any person;

    (5) To federal, State or local government authorities, to the extent that the holder of the record is required by law to report specific health care information, when needed to determine compliance with State or federal licensure, certification or registration requirements, or when needed to protect the public health, including but not limited to the reporting of child abuse or neglect, or to identify a deceased patient based upon reasonable grounds that information in the record is needed to assist in the identification;

    (6) To qualified personnel for the purpose of conducting scientific research, but a record shall be released for research only following review of the research protocol by an institutional review board constituted pursuant to federal regulation 45 C.F.R. § 46.101 et seq.; and the patient shall not be directly or indirectly identified in any report of the research and research personnel shall not disclose the person's identity in any manner;

    (7) To qualified personnel for the purpose of conducting management audits, financial audits or program evaluation; but the personnel shall not directly or indirectly identify the patient in a report of an audit or evaluation, or otherwise disclose the patient's identity in any manner, and identifying information shall not be released to the personnel unless it is vital to the audit or evaluation;

    (8) To qualified personnel involved in medical education or in the patient's diagnosis and treatment, except that disclosure is limited to personnel directly involved in medical education or in the patient's diagnosis and treatment;

    (9) To the Department of Health, the Attorney General, the Division of Consumer Affairs in the Department of Law and Public Safety, or a professional or occupational board located within that division, as required by State or federal law;

    (10) As permitted by rules and regulations adopted by the commissioner for the purposes of disease prevention and control; or

    (11) In all other instances authorized by State or federal law.

    f. A health care facility shall maintain as part of a record the following:

    (1) information regarding each external disclosure of health care information in that record, including, but not limited to: the name, address and institutional affiliation, if any, of the person to whom the health care information is disclosed; the date and purpose of the disclosure; and, to the extent practicable, a description of the information disclosed; and

    (2) authorization by a patient or patient representative for disclosure of health care information contained in the record and any revocation thereof by the patient or patient representative; or

    (3) if authorization was not obtained by a patient or patient representative for disclosure of health care information contained in the record, the authorization upon which the information was disclosed.

    g. The limits on disclosure set forth in this act shall continue to apply to a record after the patient is discharged from the health care facility.

    h. A record disclosed under this act shall be held confidential by the recipient of the record and shall not be released by the recipient unless the conditions of this act are met.

    5. A patient or patient representative has the right to:

    a. have access to health care information concerning the patient;

    b. receive a copy of health care information from the patient's record upon payment of a reasonable charge to a health care facility as determined by the commissioner;

    c. have a notation made in the patient's record, upon the request of the patient or patient representative, which reflects: any amendment to, or correction of, the information in the record, or any such change proposed by the patient or patient representative with which the health care facility disagrees in regard to the accuracy of the record; and

    d. revoke at any time the patient's or patient representative's authorization for disclosure of health care information contained in the record, unless the disclosure is required to effectuate payment for health care that has been provided to the patient, or other substantial action has been taken in reliance on that authorization.

    A patient may not maintain an action against a health care facility or a person employed by a health care facility for disclosure of health care information made in good faith reliance on the patient's or patient representative's written authorization, if the facility or employee had no notice of the revocation at the time the disclosure was made.

    6. a. A record may be disclosed by an order of a court of competent jurisdiction which is granted pursuant to an application showing good cause therefor. At a good cause hearing, the court shall weigh the public interest and need for disclosure against the injury to: the patient, the health care provider-patient relationship, or the services offered by the health care facility, and those provisions of State or federal law which are intended to assure the confidentiality of patient health care information. Upon the granting of the order, the court, in determining the extent to which a disclosure of all or any part of a record is necessary, shall impose appropriate safeguards to prevent an unauthorized disclosure.

    b. A court may authorize disclosure of a patient's record for the purpose of conducting an investigation of, or a prosecution for, a crime of which the patient or other person identified in the record is suspected only if the crime is a first degree crime and there is a reasonable likelihood that the record in question will disclose material information or evidence of substantial value in connection with the investigation or prosecution; except that nothing in this subsection shall be construed to limit the provisions of the "New Jersey Insurance Fraud Prevention Act," P.L.1983, c.320 (C.17:33A-1 et seq.), or to limit the authority of the Division of Youth and Family Services in the Department of Human Services with respect to the provisions of chapter 6 of Title 9 of the Revised Statutes.

    c. Except as provided in subsections a. and b. of this section, a record shall not be used to initiate or substantiate any criminal or civil charges against the patient or other person identified in the record or to conduct an investigation of that person.

    d. The court shall deny an application for disclosure of a record unless the court makes a specific finding that the health care facility and the patient or patient representative were afforded the opportunity to be represented at the hearing.

    e. Nothing in this section shall be construed to authorize disclosure of any confidential communication which is otherwise protected by statute, court rule or common law.

    7. a. When authorization is required for disclosure of the record of a deceased or legally incompetent patient, the authorization shall be obtained:

    (1) From an executor, administrator of the estate, or patient representative;

    (2) From the patient's spouse or primary caretaking partner or, if none, by another member of the patient's family; or

    (3) From the commissioner in the event that a deceased patient has neither an authorized representative or next-of-kin.

    b. When authorization is required for disclosure of the record of a minor, it shall be obtained from the parent, guardian, or other individual authorized under State law to act in the minor's behalf.

    8. a. If a health care facility or a person employed by a health care facility, or a person who is granted access to a record maintained by the facility, fails to comply with the provisions of this act, a patient or other person whose rights are violated may apply to the Superior Court of this State, or any other court of competent jurisdiction, for appropriate equitable relief.

    b. A health care facility or a person employed by a health care facility, or a person who is granted access to a record maintained by the facility, which discloses health care information in violation of the provisions of this act shall be liable for damages sustained by the person about whom the information relates.

    c. Each disclosure of a record made in violation of the provisions of this act is a separate and actionable offense.

    d. In an action brought pursuant to this section, the court may award the costs of the action and reasonable attorney's fees to the prevailing party.

    e. An action under this section shall be brought within two years from the date that the alleged violation is or should have been discovered.

     9. a. A person who, under false or fraudulent pretenses, requests or obtains health care information from a health care facility or a person employed by a health care facility, or requests or obtains a patient's authorization for disclosure of that information, is guilty of a crime of the fourth degree.

    b. A person who, under false or fraudulent pretenses, requests or obtains health care information from a health care facility or a person employed by a health care facility and intentionally uses, sells or transfers that information for remuneration, profit or monetary gain, is guilty of a crime of the second degree.

    c. A person who unlawfully takes health care information from a health care facility or a person employed by a health care facility and intentionally uses, sells or transfers that information for remuneration, profit or monetary gain, is guilty of a crime of the second degree.

    10. Nothing in sections 1 through 9 of this act shall be construed to limit a person's immunity from liability for civil damages in accordance with the provisions of section 1 of P.L.1983, c.248 (C.45:9-19.1).

    11. The commissioner, pursuant to the "Administrative Procedure Act," P.L. 1968, c.410 (C.52:14B-1 et seq.), shall adopt rules and regulations to effectuate the purposes of sections 1 through 10 of this act.

    12. As used in sections 12 through 21 of this act:

    "Director" means the Director of the Division of Consumer Affairs in the Department of Law and Public Safety.

    "Health care" means any preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, counseling, service or procedure provided by a health care provider with respect to a patient's physical or mental condition, or affecting the structure or function of the human body or any part thereof, including, but not limited to, the banking of blood, sperm, organs or any other tissue, or a sale or dispensing of a drug, substance, device, equipment or other item to a patient or for a patient's use pursuant to a prescription.

    "Health care information" means any data or information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient or other subject of record and relates to a patient's health care, and is obtained in the course of a patient's health care from a health care provider, the patient, a member of the patient's family, a person with whom the patient has a close personal relationship, or the patient's legal representative.

    "Health care provider" means a health care provider subject to regulation by a professional board pursuant to the provisions of Title 45 of the Revised Statutes.

    "Patient" means a person who receives or has received health care.

    "Patient representative" means a person legally empowered to make decisions about a patient's health care on the patient's behalf or the administrator or executor of a deceased patient's estate.

    "Record" means a patient's health care information record.

     13. A health care provider is subject to the provisions of sections 12 through 21 of this act, notwithstanding the provisions of any other law to the contrary, except as otherwise provided herein.

    14. a. A record maintained by a health care provider is confidential and shall be disclosed only for the purposes authorized by this act.

    b. A health care provider, in accordance with regulations adopted by the director, shall develop and implement a written policy governing the confidentiality of records maintained by the provider. The policy shall include procedures designed to ensure the security of the provider's records during storage, processing or transmission, either in electronic or other form, and shall stipulate that any person who is granted access to a record maintained by the provider shall have previously received and signed a form approved by the director which explains the provider's written confidentiality policy and obligates the person to abide thereby.

    c. The content of a record may be disclosed in accordance with the prior written authorization of the patient or patient representative, or if the patient is legally incompetent or deceased, in accordance with section 17 of this act, only if the authorization is provided on a form and in a manner approved by the director and the purpose and period of time for which disclosure is authorized are clearly stated on the authorization form.

    d. Except as otherwise provided in this act, the signing or authentication of a patient's or patient representative's authorization for disclosure shall be considered permission for disclosure only for the purposes explicitly contained in the authorization and shall not be considered a waiver of any rights a patient has under federal or State statute, court rule or common law.

    e. If the patient's or patient representative's prior written authorization is not obtained, the record shall be disclosed only under the following conditions, except that nothing in this subsection shall be construed to permit the disclosure of a record to a person, agency or other entity to whom disclosure is otherwise prohibited under State or federal law:

    (1) To the patient or the patient representative;

    (2) To another health care provider who is providing health care to the patient, except as the disclosure is limited or prohibited by the patient;

    (3) To a member of the patient's immediate family, or to another person with whom the patient is known to have a close personal relationship, if the disclosure is made in accordance with good medical or other professional practice, except as the disclosure is limited or prohibited by the patient;

    (4) To any person to the extent that person needs to know the information in the record, if the holder of the record believes that the disclosure will avoid or minimize imminent danger to the health or safety of the patient or any other person, or is necessary to alleviate emergency circumstances affecting the health or safety of any person;

     (5) To federal, State or local government authorities, to the extent that the holder of the record is required by law to report specific health care information, when needed to determine compliance with State or federal licensure, certification or registration requirements, or when needed to protect the public health, including but not limited to the reporting of child abuse or neglect, or to identify a deceased patient based upon reasonable grounds that information in the record is needed to assist in the identification;

    (6) To qualified personnel for the purpose of conducting scientific research, but a record shall be released for research only following review of the research protocol by an institutional review board constituted pursuant to federal regulation 45 C.F.R. § 46.101 et seq.; and the patient shall not be directly or indirectly identified in any report of the research and research personnel shall not disclose the person's identity in any manner;

    (7) To qualified personnel for the purpose of conducting management audits, financial audits or program evaluation; but the personnel shall not directly or indirectly identify the patient in a report of an audit or evaluation, or otherwise disclose the patient's identity in any manner, and identifying information shall not be released to the personnel unless it is vital to the audit or evaluation;

    (8) To qualified personnel involved in medical education or in the patient's diagnosis and treatment, except that disclosure is limited to personnel directly involved in medical education or in the patient's diagnosis and treatment;

    (9) To the Department of Health, the Attorney General, the Division of Consumer Affairs in the Department of Law and Public Safety, or a professional or occupational board located within that division, as required by State or federal law;

    (10) As permitted by rules and regulations adopted by the Commissioner of Health for the purposes of disease prevention and control; or

    (11) In all other instances authorized by State or federal law.

    f. A health care provider shall maintain as part of a record the following:

    (1) information regarding each external disclosure of health care information in that record, including, but not limited to: the name, address and institutional affiliation, if any, of the person to whom the health care information is disclosed; the date and purpose of the disclosure; and, to the extent practicable, a description of the information disclosed; and

    (2) authorization by a patient or patient representative for disclosure of health care information contained in the record and any revocation thereof by the patient or patient representative; or

    (3) if authorization was not obtained by a patient or patient representative for disclosure of health care information contained in the record, the authorization upon which the information was disclosed.

    g. The limits on disclosure set forth in this act shall continue to apply to a record after the patient is no longer receiving health care services from the health care provider.

     h. A record disclosed under this act shall be held confidential by the recipient of the record and shall not be released by the recipient unless the conditions of this act are met.

    15. A patient or patient representative has the right to:

    a. have access to health care information concerning the patient;

    b. receive a copy of health care information from the patient's record upon payment of a reasonable charge to a health care provider as determined by the director;

    c. have a notation made in the patient's record, upon the request of the patient or patient representative, which reflects: any amendment to, or correction of, the information in the record, or any such change proposed by the patient or patient representative with which the health care provider disagrees in regard to the accuracy of the record; and

    d. revoke at any time the patient's or patient representative's authorization for disclosure of health care information contained in the record, unless the disclosure is required to effectuate payment for health care that has been provided to the patient, or other substantial action has been taken in reliance on that authorization.

    A patient may not maintain an action against a health care provider or a person employed by a health care provider for disclosure of health care information made in good faith reliance on the patient's or patient representative's written authorization, if the provider or employee had no notice of the revocation at the time the disclosure was made.

    16. a. A record may be disclosed by an order of a court of competent jurisdiction which is granted pursuant to an application showing good cause therefor. At a good cause hearing, the court shall weigh the public interest and need for disclosure against the injury to: the patient, the health care provider-patient relationship, the services offered by the health care provider, and those provisions of State or federal law which are intended to assure the confidentiality of patient health care information. Upon the granting of the order, the court, in determining the extent to which a disclosure of all or any part of a record is necessary, shall impose appropriate safeguards to prevent an unauthorized disclosure.

    b. A court may authorize disclosure of a patient's record for the purpose of conducting an investigation of, or a prosecution for, a crime of which the patient or other person identified in the record is suspected only if the crime is a first degree crime and there is a reasonable likelihood that the record in question will disclose material information or evidence of substantial value in connection with the investigation or prosecution; except that nothing in this subsection shall be construed to limit the provisions of the "New Jersey Insurance Fraud Prevention Act," P.L.1983, c.320 (C.17:33A-1 et seq.), or to limit the authority of the Division of Youth and Family Services in the Department of Human Services with respect to the provisions of chapter 6 of Title 9 of the Revised Statutes.

     c. Except as provided in subsections a. and b. of this section, a record shall not be used to initiate or substantiate any criminal or civil charges against the patient or other person identified in the record or to conduct an investigation of that person.

    d. The court shall deny an application for disclosure of a record unless the court makes a specific finding that the health care provider and the patient or patient representative were afforded the opportunity to be represented at the hearing.

    e. Nothing in this section shall be construed to authorize disclosure of any confidential communication which is otherwise protected by statute, court rule or common law.

    17. a. When authorization is required for disclosure of the record of a deceased or legally incompetent patient, the authorization shall be obtained:

    (1) From an executor, administrator of the estate, or patient representative;

    (2) From the patient's spouse or primary caretaking partner or, if none, by another member of the patient's family; or

    (3) From the director in the event that a deceased patient has neither an authorized representative or next-of-kin.

    b. When authorization is required for disclosure of the record of a minor, it shall be obtained from the parent, guardian, or other individual authorized under State law to act in the minor's behalf.

    18. a. If a health care provider or a person employed by a health care provider, or a person who is granted access to a record maintained by the provider, fails to comply with the provisions of this act, a patient or other person whose rights are violated may apply to the Superior Court of this State, or any other court of competent jurisdiction, for appropriate equitable relief.

    b. A health care provider or a person employed by a health care provider, or a person who is granted access to a record maintained by the provider, who discloses health care information in violation of the provisions of this act shall be liable for damages sustained by the person about whom the information relates.

    c. Each disclosure of a record made in violation of the provisions of this act is a separate and actionable offense.

    d. In an action brought pursuant to this section, the court may award the costs of the action and reasonable attorney's fees to the prevailing party.

    e. An action under this section shall be brought within two years from the date that the alleged violation is or should have been discovered.

    19. a. A person who, under false or fraudulent pretenses, requests or obtains health care information from a health care provider or a person employed by a health care provider, or requests or obtains a patient's authorization for disclosure of that information, is guilty of a crime of the fourth degree.

    b. A person who, under false or fraudulent pretenses, requests or obtains health care information from a health care provider or a person employed by a health care provider and intentionally uses, sells or transfers that information for remuneration, profit or monetary gain, is guilty of a crime of the second degree.

     c. A person who unlawfully takes health care information from a health care provider or a person employed by a health care provider and intentionally uses, sells or transfers that information for remuneration, profit or monetary gain, is guilty of a crime of the second degree.

    20. Nothing in sections 12 through 19 of this act shall be construed to limit a person's immunity from liability for civil damages in accordance with the provisions of section 1 of P.L.1983, c.248 (C.45:9-19.1).

    21. The director, pursuant to the "Administrative Procedure Act," P.L. 1968, c.410 (C.52:14B-1 et seq.), shall adopt rules and regulations to effectuate the purposes of sections 12 through 20 of this act.

    22. This act shall take effect immediately.

STATEMENT

    This bill establishes uniform health care information record confidentiality, security and access requirements for all health care patients in New Jersey, whether they are receiving services in a licensed health care facility or from a health care provider regulated under Title 45 of the Revised Statutes. The bill also establishes civil and criminal penalties for violations of these requirements.

    The bill requires that health care facilities and providers implement a written confidentiality policy which includes procedures to ensure the security of their health care information records during storage, processing or transmission, either in electronic or other form.

    The bill also provides that if a patient's or patient representative's prior written authorization for disclosure of health care information is not obtained, information contained in the record shall be disclosed only under the following conditions:

    ∙     To the patient or the patient representative;

    ∙     To a health care provider who is providing health care to the patient, except as limited or prohibited by the patient;

    ∙     To a member of the patient's immediate family, or to another person with whom the patient is known to have a close personal relationship, in accordance with good medical or other professional practice, except as limited or prohibited by the patient;

    ∙     To any person in order to avoid or minimize imminent danger to the health or safety of the patient or any other person, or to alleviate emergency circumstances affecting the health or safety of any person;

    ∙     To federal, State or local government authorities, as required by law;

    ∙     To qualified personnel for the purpose of conducting scientific research;

     ∙     To qualified personnel for the purpose of conducting management audits, financial audits or program evaluation;

     ∙     To qualified personnel involved in medical education or in the patient's diagnosis and treatment;

     ∙     To the Department of Health, the Attorney General, the Division of Consumer Affairs in the Department of Law and Public Safety, or a professional or occupational board located within that division, as required by State or federal law;

      ∙    As permitted by Department of Health rules and regulations for disease prevention and control; or

     ∙     In all other instances authorized by State or federal law.

    The bill provides, however, that no provision therein shall be construed to permit the disclosure of a record to a person, agency or other entity to whom disclosure is otherwise prohibited under State or federal law.

    The bill also stipulates that a patient or patient representative has the right to: