Hawaii 2025 Regular Session

Hawaii Senate Bill SCR45 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	THE SENATE S.C.R. NO. 45 THIRTY-THIRD LEGISLATURE, 2025 STATE OF HAWAII SENATE CONCURRENT RESOLUTION strongly supporting and recommending the implementation of the revised 2025 hawaii patient bill of rights.
2	2
3	3	THE SENATE S.C.R. NO. 45
4	4	THIRTY-THIRD LEGISLATURE, 2025
5	5	STATE OF HAWAII
6	6
7	7	THE SENATE
8	8
9	9	S.C.R. NO.
10	10
11	11	45
12	12
13	13	THIRTY-THIRD LEGISLATURE, 2025
14	14
15	15
16	16
17	17	STATE OF HAWAII
18	18
19	19
20	20
21	21
22	22
23	23
24	24
25	25
26	26
27	27
28	28
29	29	SENATE CONCURRENT
30	30
31	31	RESOLUTION
32	32
33	33
34	34
35	35
36	36
37	37	strongly supporting and recommending the implementation of the revised 2025 hawaii patient bill of rights.
38	38
39	39
40	40
41	41
42	42
43	43
44	44
45	45	WHEREAS, Hawaii pioneered employer-supported health insurance through the Prepaid Health Care Act of 1974; however, the State continues to face severe physician, nurse, and dentist shortages, with over thirty-five percent of the population residing in federally designated Health Professional Shortage Areas--the highest percentage in the nation; and WHEREAS, the University of Hawaii Health Research Center found that forty-two percent of surveyed physicians reported patient harm or serious adverse events attributable to prior authorization delays or denials, emphasizing a need for streamlined insurance processes; and WHEREAS, recent increases in claims denials, particularly those driven by automated or artificial intelligence (AI)-based systems, underscore the necessity for greater transparency, specialist review, and patient-friendly appeals mechanisms; and WHEREAS, the original Hawaii Patient Bill of Rights, enacted over twenty-five years ago, now requires substantial updates to address modern challenges, such as AI-driven denials, telehealth accessibility, data-offshoring risks, and persistent network inadequacies on the neighbor islands and in rural areas; and WHEREAS, patients, health care providers, and cybersecurity experts cite the need for robust data protection measures that accommodate legitimate offshoring services while maintaining Health Insurance Portability and Accountability Act-equivalent safeguards, timely breach notifications, and strong enforcement; and WHEREAS, the Insurance Commissioner's office needs expanded authority, resources, and reporting mechanisms to effectively audit, investigate, and sanction noncompliant insurers or billing entities, ensuring consistent and accountable enforcement of patients' rights; and WHEREAS, the Revised 2025 Hawaii Patient Bill of Rights is an essential modernization step that prioritizes patient autonomy, transparent healthcare, timely access, robust data protection, AI accountability, and real enforcement--all while recognizing the practical realities of insurers, providers, and patients in a rapidly evolving healthcare landscape; now, therefore, BE IT RESOLVED by the Senate of the Thirty-third Legislature of the State of Hawaii, Regular Session of 2025, the House of Representatives concurring, that this body strongly supports and recommends the implementation of the following Revised 2025 Hawaii Patient Bill of Rights: Foreword and Definitions 1. Purpose: This Bill of Rights modernizes patient protections to address AI-based coverage decisions, data security risks, and ongoing provider shortages in Hawaii. 2. Definitions: o AI or Automated Decision System: Any algorithmic or software-based platform that can autonomously generate or recommend coverage determinations without direct human supervision. o HIPAA-equivalent Security: A standard of data protection meeting or exceeding requirements set forth in 45 C.F.R. Parts 160 and 164 (HIPAA Privacy and Security Rules). o Urgent vs. Non-Urgent: Urgent requests are those where delays could seriously jeopardize a patient's health, life, or overall well-being; non-urgent requests include all other prior authorizations not qualifying as urgent. 1. Clear Information Patients must receive clear, written (and, if necessary, translated) explanations from their health insurance plan regarding covered and non-covered services, presented at a reading level understandable to the average enrollee. 2. Provider Directory All insurers must maintain and publicly post an up-to-date, accurate, and easily accessible directory of in-network providers, updated at least quarterly, listing each provider's specialty, languages spoken, telehealth availability, and current patient capacity. 3. Specialist Referrals All patients must be able to obtain timely specialist referrals without undue administrative barriers or delays. Insurers shall clearly communicate referral steps and expedite such referrals in urgent or complex cases. 4. Emergency Care No insurer may deny coverage for legitimate emergency services based on retrospective review. If a patient believes in good faith that their life or health is endangered, they have the right to seek immediate emergency care without facing post-service coverage denials. 5. Explanation of Illness, Options, and Patient Autonomy 5.1 Right to Understand Care: Patients are entitled to a clear explanation of their diagnosis, treatment options (including the option to decline treatment), and potential outcomes or risks from their healthcare provider, ensuring fully informed consent. 5.2 Right to Accept or Decline Treatment: Every mentally competent patient (or as decided by their legal health care proxy) has the right to accept, receive, reject, or discontinue any legal medical care, treatment, or prescribed medication from any legally licensed medical provider, and the right to not have that decision denied, prevented, restricted, or impeded by other persons. 6. Appeals and External Review 6.1 Notice and Forms: Whenever coverage is denied, insurers must provide a universal external review request form and a step-by-step guide (in print or digital form) explaining how to appeal. 6.2 Online FAQ and Hotline: Insurers shall maintain an online FAQ regarding appeals, alongside a toll-free hotline to assist patients. 6.3 Enforcement: The Insurance Commissioner may impose financial penalties or other administrative measures on insurers failing to publicize or comply with state and federal appeals requirements. 7. Network Adequacy, Telehealth, and Rural Access 7.1 Coverage in Shortage Areas: Patients in federally designated Health Professional Shortage Areas must have timely access to primary and specialty care. 7.2 Reporting Requirements: Insurers shall submit quarterly reports detailing provider-to-patient ratios, average wait times, and referral outcomesdisaggregated by region or island. 7.3 Telehealth Provisions: Telehealth services, if legally permissible within a provider's scope of practice, shall be covered at parity with in-person services to mitigate access barriers. 7.4. Prohibition of Burdensome Prior Authorization: Prior authorization procedures in shortage areas must not unduly limit provider productivity or delay critical patient care. 8. Transparent and Timely Prior Authorization 8.1 Turnaround Times: o Urgent Requests: One business day for a decision. o Non-Urgent Requests: Three business days for a decision. 8.2 AI Oversight: o If AI or an automated decision system initiates a denial, that denial must be reviewed and co-signed by a board-certified specialist in the relevant field before being finalized. o Patients and providers shall be notified in writing when AI is used at any stage of the coverage determination. 8.3 Data Tracking: Insurers must compile and submit monthly data on prior authorization approval/denial rates, average processing times, and the percentage of AI-based denials overturned on appeal. 9. Data Protection and Privacy 9.1 HIPAA-equivalent Safeguards: All accredited health plans or billing entities, whether located onshore or offshore, must uphold HIPAA-level security measures when storing or transmitting personally identifiable patient data (including Social Security numbers, medical ID numbers, etc.). 9.2 Offshoring Accountability: o Prior to offshoring data, an entity must file an attestation with the Insurance Commissioner confirming that any overseas subcontractors adhere to encryption, breach notification, audit logging, and confidentiality protocols. o Entities shall undergo random audits or produce security certifications upon request. 9.3 Breach Notification and Penalties: In the event of a suspected or actual data breach, the entity must notify affected patients and the Insurance Commissioner within 72 hours, implementing a corrective action plan. Repeated or willful violations may result in fines, revocation of accreditation, or other sanctions. 10. Enforcement and Oversight 10.1 Authority of the Insurance Commissioner: o Empowered to audit, investigate, and enforce all provisions of this Bill of Rights. o May impose fines, clawbacks, revocation of accreditation, and other appropriate remedies for noncompliance. 10.2 Annual Public Report: o The Insurance Commissioner shall publish an annual report detailing enforcement actions, complaint data, AI usage rates, denial statistics, and any data breaches or security infractions. o The report shall include trend analyses (e.g., median time-to-decision for prior authorizations, telehealth adoption rates, network adequacy improvements). 10.3 Multidisciplinary Advisory Group: o Composed of physicians, cybersecurity experts, patient advocates, telehealth specialists, and others. o Convenes periodically to review compliance, recommend updates, and study emerging issues (e.g., advanced AI, new data-security threats). 11. Anti-Retaliation and Support for Providers 11.1 Anti-Retaliation: Insurers, health plans, or affiliated entities shall not retaliate against providers (e.g., network exclusion or contract termination) for filing formal complaints, submitting testimony, or participating in external reviews concerning the insurer's compliance with this Bill of Rights. 11.2 Technical Assistance: The Insurance Commissioner, in collaboration with the Department of Health, shall explore or establish technical support programs to help smaller or rural practices adopt secure data systems, comply with prior authorization reporting, and integrate telehealth services effectively. 12. Phased Implementation 12.1 Immediate Effect: Provisions related to patient communications (Items 1 to 6), emergency care, and urgent prior authorizations (Item 8.1) shall take effect immediately upon enactment. 12.2 Data Offshoring and AI Protocols: Insurers may have six to twelve months from the date of enactment to fully implement or certify AI oversight processes and offshore data security compliance (excluding Social Security numbers and medical ID numbers, which must be protected immediately). 12.3 Follow-up Review: Within one year of implementation, the Insurance Commissioner shall submit a progress report to the Legislature with recommendations for any further legislative refinements.; and BE IT FURTHER RESOLVED that all insurers, health care providers, and billing entities are strongly encouraged to begin voluntary compliance with these updated patient protections prior to any mandatory deadlines in order to foster a collaborative and smooth transition; and BE IT FURTHER RESOLVED that ongoing stakeholder input will be sought to address outstanding issues, such as payment parity, facility fees, and self-insured plan coverage, which may require additional state or federal action; and BE IT FURTHER RESOLVED that certified copies of this Concurrent Resolution be transmitted to the Governor, Director of Health, Director of Commerce and Consumer Affairs, and Insurance Commissioner. OFFERED BY: _____________________________
46	46
47	47	WHEREAS, Hawaii pioneered employer-supported health insurance through the Prepaid Health Care Act of 1974; however, the State continues to face severe physician, nurse, and dentist shortages, with over thirty-five percent of the population residing in federally designated Health Professional Shortage Areas--the highest percentage in the nation; and
48	48
49	49
50	50
51	51	WHEREAS, the University of Hawaii Health Research Center found that forty-two percent of surveyed physicians reported patient harm or serious adverse events attributable to prior authorization delays or denials, emphasizing a need for streamlined insurance processes; and
52	52
53	53
54	54
55	55	WHEREAS, recent increases in claims denials, particularly those driven by automated or artificial intelligence (AI)-based systems, underscore the necessity for greater transparency, specialist review, and patient-friendly appeals mechanisms; and
56	56
57	57
58	58
59	59	WHEREAS, the original Hawaii Patient Bill of Rights, enacted over twenty-five years ago, now requires substantial updates to address modern challenges, such as AI-driven denials, telehealth accessibility, data-offshoring risks, and persistent network inadequacies on the neighbor islands and in rural areas; and
60	60
61	61
62	62
63	63	WHEREAS, patients, health care providers, and cybersecurity experts cite the need for robust data protection measures that accommodate legitimate offshoring services while maintaining Health Insurance Portability and Accountability Act-equivalent safeguards, timely breach notifications, and strong enforcement; and
64	64
65	65
66	66
67	67	WHEREAS, the Insurance Commissioner's office needs expanded authority, resources, and reporting mechanisms to effectively audit, investigate, and sanction noncompliant insurers or billing entities, ensuring consistent and accountable enforcement of patients' rights; and
68	68
69	69
70	70
71	71	WHEREAS, the Revised 2025 Hawaii Patient Bill of Rights is an essential modernization step that prioritizes patient autonomy, transparent healthcare, timely access, robust data protection, AI accountability, and real enforcement--all while recognizing the practical realities of insurers, providers, and patients in a rapidly evolving healthcare landscape; now, therefore,
72	72
73	73
74	74
75	75	BE IT RESOLVED by the Senate of the Thirty-third Legislature of the State of Hawaii, Regular Session of 2025, the House of Representatives concurring, that this body strongly supports and recommends the implementation of the following Revised 2025 Hawaii Patient Bill of Rights:
76	76
77	77
78	78
79	79	Foreword and Definitions
80	80
81	81
82	82
83	83	1. Purpose: This Bill of Rights modernizes patient protections to address AI-based coverage decisions, data security risks, and ongoing provider shortages in Hawaii.
84	84
85	85
86	86
87	87	2. Definitions:
88	88
89	89
90	90
91	91	o AI or Automated Decision System: Any algorithmic or software-based platform that can autonomously generate or recommend coverage determinations without direct human supervision.
92	92
93	93	o HIPAA-equivalent Security: A standard of data protection meeting or exceeding requirements set forth in 45 C.F.R. Parts 160 and 164 (HIPAA Privacy and Security Rules).
94	94
95	95	o Urgent vs. Non-Urgent: Urgent requests are those where delays could seriously jeopardize a patient's health, life, or overall well-being; non-urgent requests include all other prior authorizations not qualifying as urgent.
96	96
97	97
98	98
99	99
100	100
101	101
102	102
103	103	1. Clear Information
104	104
105	105
106	106
107	107	Patients must receive clear, written (and, if necessary, translated) explanations from their health insurance plan regarding covered and non-covered services, presented at a reading level understandable to the average enrollee.
108	108
109	109
110	110
111	111
112	112
113	113
114	114
115	115	2. Provider Directory
116	116
117	117
118	118
119	119	All insurers must maintain and publicly post an up-to-date, accurate, and easily accessible directory of in-network providers, updated at least quarterly, listing each provider's specialty, languages spoken, telehealth availability, and current patient capacity.
120	120
121	121
122	122
123	123
124	124
125	125
126	126
127	127	3. Specialist Referrals
128	128
129	129
130	130
131	131	All patients must be able to obtain timely specialist referrals without undue administrative barriers or delays. Insurers shall clearly communicate referral steps and expedite such referrals in urgent or complex cases.
132	132
133	133
134	134
135	135
136	136
137	137
138	138
139	139	4. Emergency Care
140	140
141	141
142	142
143	143	No insurer may deny coverage for legitimate emergency services based on retrospective review. If a patient believes in good faith that their life or health is endangered, they have the right to seek immediate emergency care without facing post-service coverage denials.
144	144
145	145
146	146
147	147
148	148
149	149
150	150
151	151	5. Explanation of Illness, Options, and Patient Autonomy
152	152
153	153
154	154
155	155	5.1 Right to Understand Care: Patients are entitled to a clear explanation of their diagnosis, treatment options (including the option to decline treatment), and potential outcomes or risks from their healthcare provider, ensuring fully informed consent.
156	156
157	157
158	158
159	159	5.2 Right to Accept or Decline Treatment: Every mentally competent patient (or as decided by their legal health care proxy) has the right to accept, receive, reject, or discontinue any legal medical care, treatment, or prescribed medication from any legally licensed medical provider, and the right to not have that decision denied, prevented, restricted, or impeded by other persons.
160	160
161	161
162	162
163	163
164	164
165	165
166	166
167	167	6. Appeals and External Review
168	168
169	169
170	170
171	171	6.1 Notice and Forms: Whenever coverage is denied, insurers must provide a universal external review request form and a step-by-step guide (in print or digital form) explaining how to appeal.
172	172
173	173
174	174
175	175	6.2 Online FAQ and Hotline: Insurers shall maintain an online FAQ regarding appeals, alongside a toll-free hotline to assist patients.
176	176
177	177
178	178
179	179	6.3 Enforcement: The Insurance Commissioner may impose financial penalties or other administrative measures on insurers failing to publicize or comply with state and federal appeals requirements.
180	180
181	181
182	182
183	183
184	184
185	185
186	186
187	187	7. Network Adequacy, Telehealth, and Rural Access
188	188
189	189
190	190
191	191	7.1 Coverage in Shortage Areas: Patients in federally designated Health Professional Shortage Areas must have timely access to primary and specialty care.
192	192
193	193
194	194
195	195	7.2 Reporting Requirements: Insurers shall submit quarterly reports detailing provider-to-patient ratios, average wait times, and referral outcomesdisaggregated by region or island.
196	196
197	197
198	198
199	199	7.3 Telehealth Provisions: Telehealth services, if legally permissible within a provider's scope of practice, shall be covered at parity with in-person services to mitigate access barriers.
200	200
201	201
202	202
203	203	7.4. Prohibition of Burdensome Prior Authorization: Prior authorization procedures in shortage areas must not unduly limit provider productivity or delay critical patient care.
204	204
205	205
206	206
207	207
208	208
209	209
210	210
211	211	8. Transparent and Timely Prior Authorization
212	212
213	213
214	214
215	215	8.1 Turnaround Times:
216	216
217	217
218	218
219	219	o Urgent Requests: One business day for a decision.
220	220
221	221	o Non-Urgent Requests: Three business days for a decision.
222	222
223	223
224	224
225	225	8.2 AI Oversight:
226	226
227	227
228	228
229	229	o If AI or an automated decision system initiates a denial, that denial must be reviewed and co-signed by a board-certified specialist in the relevant field before being finalized.
230	230
231	231	o Patients and providers shall be notified in writing when AI is used at any stage of the coverage determination.
232	232
233	233
234	234
235	235	8.3 Data Tracking: Insurers must compile and submit monthly data on prior authorization approval/denial rates, average processing times, and the percentage of AI-based denials overturned on appeal.
236	236
237	237
238	238
239	239
240	240
241	241
242	242
243	243	9. Data Protection and Privacy
244	244
245	245
246	246
247	247	9.1 HIPAA-equivalent Safeguards: All accredited health plans or billing entities, whether located onshore or offshore, must uphold HIPAA-level security measures when storing or transmitting personally identifiable patient data (including Social Security numbers, medical ID numbers, etc.).
248	248
249	249
250	250
251	251	9.2 Offshoring Accountability:
252	252
253	253	o Prior to offshoring data, an entity must file an attestation with the Insurance Commissioner confirming that any overseas subcontractors adhere to encryption, breach notification, audit logging, and confidentiality protocols.
254	254
255	255	o Entities shall undergo random audits or produce security certifications upon request.
256	256
257	257
258	258
259	259	9.3 Breach Notification and Penalties: In the event of a suspected or actual data breach, the entity must notify affected patients and the Insurance Commissioner within 72 hours, implementing a corrective action plan. Repeated or willful violations may result in fines, revocation of accreditation, or other sanctions.
260	260
261	261
262	262
263	263
264	264
265	265
266	266
267	267	10. Enforcement and Oversight
268	268
269	269
270	270
271	271	10.1 Authority of the Insurance Commissioner:
272	272
273	273	o Empowered to audit, investigate, and enforce all provisions of this Bill of Rights.
274	274
275	275	o May impose fines, clawbacks, revocation of accreditation, and other appropriate remedies for noncompliance.
276	276
277	277
278	278
279	279	10.2 Annual Public Report:
280	280
281	281	o The Insurance Commissioner shall publish an annual report detailing enforcement actions, complaint data, AI usage rates, denial statistics, and any data breaches or security infractions.
282	282
283	283	o The report shall include trend analyses (e.g., median time-to-decision for prior authorizations, telehealth adoption rates, network adequacy improvements).
284	284
285	285
286	286
287	287	10.3 Multidisciplinary Advisory Group:
288	288
289	289	o Composed of physicians, cybersecurity experts, patient advocates, telehealth specialists, and others.
290	290
291	291	o Convenes periodically to review compliance, recommend updates, and study emerging issues (e.g., advanced AI, new data-security threats).
292	292
293	293
294	294
295	295
296	296
297	297
298	298
299	299	11. Anti-Retaliation and Support for Providers
300	300
301	301
302	302
303	303	11.1 Anti-Retaliation: Insurers, health plans, or affiliated entities shall not retaliate against providers (e.g., network exclusion or contract termination) for filing formal complaints, submitting testimony, or participating in external reviews concerning the insurer's compliance with this Bill of Rights.
304	304
305	305
306	306
307	307	11.2 Technical Assistance: The Insurance Commissioner, in collaboration with the Department of Health, shall explore or establish technical support programs to help smaller or rural practices adopt secure data systems, comply with prior authorization reporting, and integrate telehealth services effectively.
308	308
309	309
310	310
311	311
312	312
313	313
314	314
315	315	12. Phased Implementation
316	316
317	317
318	318
319	319	12.1 Immediate Effect: Provisions related to patient communications (Items 1 to 6), emergency care, and urgent prior authorizations (Item 8.1) shall take effect immediately upon enactment.
320	320
321	321
322	322
323	323	12.2 Data Offshoring and AI Protocols: Insurers may have six to twelve months from the date of enactment to fully implement or certify AI oversight processes and offshore data security compliance (excluding Social Security numbers and medical ID numbers, which must be protected immediately).
324	324
325	325
326	326
327	327	12.3 Follow-up Review: Within one year of implementation, the Insurance Commissioner shall submit a progress report to the Legislature with recommendations for any further legislative refinements.; and
328	328
329	329
330	330
331	331	BE IT FURTHER RESOLVED that all insurers, health care providers, and billing entities are strongly encouraged to begin voluntary compliance with these updated patient protections prior to any mandatory deadlines in order to foster a collaborative and smooth transition; and
332	332
333	333
334	334
335	335	BE IT FURTHER RESOLVED that ongoing stakeholder input will be sought to address outstanding issues, such as payment parity, facility fees, and self-insured plan coverage, which may require additional state or federal action; and
336	336
337	337
338	338
339	339	BE IT FURTHER RESOLVED that certified copies of this Concurrent Resolution be transmitted to the Governor, Director of Health, Director of Commerce and Consumer Affairs, and Insurance Commissioner.
340	340
341	341
342	342
343	343
344	344
345	345
346	346
347	347	OFFERED BY: _____________________________
348	348
349	349
350	350
351	351	OFFERED BY:
352	352
353	353	_____________________________
354	354
355	355
356	356
357	357
358	358
359	359
360	360
361	361	Report Title: Revised 2025 Hawaii Patient Bill of Rights
362	362
363	363	Report Title:
364	364
365	365	Revised 2025 Hawaii Patient Bill of Rights