Texas 2011 - 82nd Regular

Texas Senate Bill SB622 Compare Versions

The same version is selected twice. Please select two different versions to compare.

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	82R29891 SJM-D
2	2	By: Nelson S.B. No. 622
3	3	(Kolkhorst, Naishtat, Truitt)
4	4	Substitute the following for S.B. No. 622: No.
5	5
6	6
7	7	A BILL TO BE ENTITLED
8	8	AN ACT
9	9	relating to the privacy of protected health information; providing
10	10	administrative and civil penalties.
11	11	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
12	12	SECTION 1. Section 181.001(b), Health and Safety Code, is
13	13	amended by amending Subdivisions (1) and (3) and adding
14	14	Subdivisions (2-a) and (2-b) to read as follows:
15	15	(1) "Commission" ["Commissioner"] means the Health
16	16	and Human Services Commission [commissioner of health and human
17	17	services].
18	18	(2-a) "Disclose" means to release, transfer, provide
19	19	access to, or otherwise divulge information outside the entity
20	20	holding the information.
21	21	(2-b) "Executive commissioner" means the executive
22	22	commissioner of the Health and Human Services Commission.
23	23	(3) "Health Insurance Portability and Accountability
24	24	Act and Privacy Standards" means the privacy requirements in
25	25	existence on September 1, 2011 [August 14, 2002], of the
26	26	Administrative Simplification subtitle of the Health Insurance
27	27	Portability and Accountability Act of 1996 (Pub. L. No. 104-191)
28	28	contained in 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A
29	29	and E.
30	30	SECTION 2. Subchapter A, Chapter 181, Health and Safety
31	31	Code, is amended by adding Section 181.004 to read as follows:
32	32	Sec. 181.004. APPLICABILITY OF STATE AND FEDERAL LAW. (a)
33	33	A covered entity, as that term is defined by 45 C.F.R. Section
34	34	160.103, shall comply with the Health Insurance Portability and
35	35	Accountability Act and Privacy Standards.
36	36	(b) Subject to Section 181.051, a covered entity, as that
37	37	term is defined by Section 181.001, shall comply with this chapter.
38	38	SECTION 3. Section 181.005, Health and Safety Code, is
39	39	amended to read as follows:
40	40	Sec. 181.005. DUTIES OF THE EXECUTIVE COMMISSIONER. (a)
41	41	The executive commissioner shall administer this chapter and may
42	42	adopt rules consistent with the Health Insurance Portability and
43	43	Accountability Act and Privacy Standards to administer this
44	44	chapter.
45	45	(b) The executive commissioner shall review amendments to
46	46	the definitions in 45 C.F.R. Parts 160 and 164 that occur after
47	47	September 1, 2011 [August 14, 2002], and determine whether it is in
48	48	the best interest of the state to adopt the amended federal
49	49	regulations. If the executive commissioner determines that it is
50	50	in the best interest of the state to adopt the amended federal
51	51	regulations, the amended regulations shall apply as required by
52	52	this chapter.
53	53	(c) In making a determination under this section, the
54	54	executive commissioner must consider, in addition to other factors
55	55	affecting the public interest, the beneficial and adverse effects
56	56	the amendments would have on:
57	57	(1) the lives of individuals in this state and their
58	58	expectations of privacy; and
59	59	(2) governmental entities, institutions of higher
60	60	education, state-owned teaching hospitals, private businesses, and
61	61	commerce in this state.
62	62	(d) The executive commissioner shall prepare a report of the
63	63	executive commissioner's determination made under this section and
64	64	shall file the report with the presiding officer of each house of
65	65	the legislature before the 30th day after the date the
66	66	determination is made. The report must include an explanation of
67	67	the reasons for the determination.
68	68	SECTION 4. Subchapter D, Chapter 181, Health and Safety
69	69	Code, is amended by adding Sections 181.153 and 181.154 to read as
70	70	follows:
71	71	Sec. 181.153. SALE OF PROTECTED HEALTH INFORMATION
72	72	PROHIBITED; EXCEPTIONS. (a) A covered entity may not disclose an
73	73	individual's protected health information to any other person in
74	74	exchange for direct or indirect remuneration, except that a covered
75	75	entity may disclose an individual's protected health information:
76	76	(1) to another covered entity, as that term is defined
77	77	by Section 181.001, or to a covered entity, as that term is defined
78	78	by Section 602.001, Insurance Code, for the purpose of:
79	79	(A) treatment;
80	80	(B) payment;
81	81	(C) health care operations; or
82	82	(D) performing an insurance or health
83	83	maintenance organization function described by Section 602.053,
84	84	Insurance Code; or
85	85	(2) as otherwise authorized or required by state or
86	86	federal law.
87	87	(b) The direct or indirect remuneration a covered entity
88	88	receives for making a disclosure of protected health information
89	89	authorized by Subsection (a)(1)(D) may not exceed the covered
90	90	entity's reasonable costs of preparing or transmitting the
91	91	protected health information.
92	92	Sec. 181.154. NOTICE AND AUTHORIZATION REQUIRED FOR
93	93	ELECTRONIC DISCLOSURE OF PROTECTED HEALTH INFORMATION; EXCEPTIONS.
94	94	(a) A covered entity shall provide notice to an individual for whom
95	95	the covered entity creates or receives protected health information
96	96	if the individual's protected health information is subject to
97	97	electronic disclosure. A covered entity may provide general notice
98	98	by:
99	99	(1) posting a written notice in the covered entity's
100	100	place of business;
101	101	(2) posting a notice on the covered entity's Internet
102	102	website; or
103	103	(3) posting a notice in any other place where
104	104	individuals whose protected health information is subject to
105	105	electronic disclosure are likely to see the notice.
106	106	(b) Except as provided by Subsection (c), a covered entity
107	107	may not electronically disclose an individual's protected health
108	108	information to any person without a separate authorization from the
109	109	individual or the individual's legally authorized representative
110	110	for each disclosure. An authorization for disclosure under this
111	111	subsection may be made in written or electronic form or in oral form
112	112	if it is documented in writing by the covered entity.
113	113	(c) The authorization for electronic disclosure of
114	114	protected health information described by Subsection (b) is not
115	115	required if the disclosure is made:
116	116	(1) to another covered entity, as that term is defined
117	117	by Section 181.001, or to a covered entity, as that term is defined
118	118	by Section 602.001, Insurance Code, for the purpose of:
119	119	(A) treatment;
120	120	(B) payment;
121	121	(C) health care operations; or
122	122	(D) performance of an insurance or health
123	123	maintenance organization function described by Section 602.053,
124	124	Insurance Code; or
125	125	(2) as authorized or required by state or federal law.
126	126	(d) The attorney general by rule shall adopt a standard
127	127	authorization form for use in complying with this section. The form
128	128	must comply with the Health Insurance Portability and
129	129	Accountability Act and Privacy Standards and this chapter.
130	130	(e) This section does not apply to a covered entity, as
131	131	defined by Section 602.001, Insurance Code, if that entity is not a
132	132	covered entity as defined by 45 C.F.R. Section 160.103.
133	133	SECTION 5. Section 181.201, Health and Safety Code, is
134	134	amended by amending Subsections (b) and (c) and adding Subsections
135	135	(d), (e), and (f) to read as follows:
136	136	(b) In addition to the injunctive relief provided by
137	137	Subsection (a), the attorney general may institute an action for
138	138	civil penalties against a covered entity for a violation of this
139	139	chapter. A civil penalty assessed under this section may not exceed
140	140	$3,000 for each violation. The total amount of a penalty assessed
141	141	against a covered entity under this section in relation to a
142	142	violation or violations of Section 181.154 may not exceed $250,000
143	143	if the court finds that:
144	144	(1) the disclosure was made only to another covered
145	145	entity and only for a purpose described by Section 181.154(c);
146	146	(2) the protected health information disclosed was
147	147	encrypted or transmitted using encryption technology designed to
148	148	protect against improper disclosure;
149	149	(3) the recipient of the protected health information
150	150	did not use or release the protected health information; and
151	151	(4) at the time of the disclosure of the protected
152	152	health information, the covered entity had developed, implemented,
153	153	and maintained security policies, including the education and
154	154	training of employees responsible for the security of protected
155	155	health information.
156	156	(c) If the court in which an action under Subsection (b) is
157	157	pending finds that the violations have occurred with a frequency as
158	158	to constitute a pattern or practice, the court may assess a civil
159	159	penalty not to exceed $1.5 million annually [$250,000].
160	160	(d) In determining the amount of a penalty imposed under
161	161	Subsection (b), the court shall consider:
162	162	(1) the seriousness of the violation, including the
163	163	nature, circumstances, extent, and gravity of the disclosure;
164	164	(2) the covered entity's compliance history;
165	165	(3) whether the violation poses a significant risk of
166	166	financial, reputational, or other harm to an individual whose
167	167	protected health information is involved in the violation;
168	168	(4) whether the covered entity was certified at the
169	169	time of the violation as described by Section 182.108;
170	170	(5) the amount necessary to deter a future violation;
171	171	and
172	172	(6) the covered entity's efforts to correct the
173	173	violation.
174	174	(e) The attorney general may institute an action against a
175	175	covered entity that is licensed by a licensing agency of this state
176	176	for a civil penalty under this section only if the licensing agency
177	177	refers the violation to the attorney general under Section
178	178	181.202(2).
179	179	(f) The office of the attorney general may retain a
180	180	reasonable portion of a civil penalty recovered under this section,
181	181	not to exceed amounts specified in the General Appropriations Act,
182	182	for the enforcement of this subchapter.
183	183	SECTION 6. Section 181.202, Health and Safety Code, is
184	184	amended to read as follows:
185	185	Sec. 181.202. DISCIPLINARY ACTION. In addition to the
186	186	penalties prescribed by this chapter, a violation of this chapter
187	187	by a covered entity [an individual or facility] that is licensed by
188	188	an agency of this state is subject to investigation and
189	189	disciplinary proceedings, including probation or suspension by the
190	190	licensing agency. If there is evidence that the violations of this
191	191	chapter are egregious and constitute a pattern or practice, the
192	192	agency may:
193	193	(1) revoke the covered entity's [individual's or
194	194	facility's] license; or
195	195	(2) refer the covered entity's case to the attorney
196	196	general for the institution of an action for civil penalties under
197	197	Section 181.201(b).
198	198	SECTION 7. Subchapter E, Chapter 181, Health and Safety
199	199	Code, is amended by adding Section 181.204 to read as follows:
200	200	Sec. 181.204. ADMINISTRATIVE PENALTY. (a) The executive
201	201	commissioner may impose an administrative penalty on a covered
202	202	entity that is not licensed by a licensing agency of this state and
203	203	that violates this chapter or a rule adopted under this chapter.
204	204	(b) The amount of the penalty may not exceed $3,000 for each
205	205	violation, and each day a violation continues or occurs is a
206	206	separate violation for the purpose of imposing a penalty. The total
207	207	amount of the penalties for all violations that occur in a year may
208	208	not exceed $1.5 million. The amount shall be based on:
209	209	(1) the seriousness of the violation, including the
210	210	nature, circumstances, extent, and gravity of the disclosure;
211	211	(2) the covered entity's compliance history;
212	212	(3) whether the violation poses a significant risk of
213	213	financial, reputational, or other harm to an individual whose
214	214	protected health information is involved in the violation;
215	215	(4) whether the covered entity was certified at the
216	216	time of the violation as described by Section 182.108;
217	217	(5) the amount necessary to deter a future violation;
218	218	and
219	219	(6) the covered entity's efforts to correct the
220	220	violation.
221	221	(c) The enforcement of the penalty may be stayed during the
222	222	time the order is under judicial review if the covered entity pays
223	223	the penalty to the clerk of the court or files a supersedeas bond
224	224	with the court in the amount of the penalty. A covered entity that
225	225	cannot afford to pay the penalty or file the bond may stay the
226	226	enforcement by filing an affidavit in the manner required by the
227	227	Texas Rules of Civil Procedure for a party who cannot afford to file
228	228	security for costs, subject to the right of the executive
229	229	commissioner to contest the affidavit as provided by those rules.
230	230	(d) The attorney general may sue to collect the penalty.
231	231	(e) A proceeding to impose the penalty is a contested case
232	232	under Chapter 2001, Government Code.
233	233	SECTION 8. Section 181.205, Health and Safety Code, is
234	234	amended by amending Subsection (b) and adding Subsection (c) to
235	235	read as follows:
236	236	(b) In determining the amount of a penalty imposed under
237	237	other law in accordance with Section 181.202, a court or state
238	238	agency shall consider the following factors:
239	239	(1) the seriousness of the violation, including the
240	240	nature, circumstances, extent, and gravity of the disclosure;
241	241	(2) the covered entity's compliance history;
242	242	(3) whether the violation poses a significant risk of
243	243	financial, reputational, or other harm to an individual whose
244	244	protected health information is involved in the violation;
245	245	(4) whether the covered entity was certified at the
246	246	time of the violation as described by Section 182.108;
247	247	(5) the amount necessary to deter a future violation;
248	248	and
249	249	(6) the covered entity's efforts to correct the
250	250	violation.
251	251	(c) On receipt of evidence under Subsections [Subsection]
252	252	(a) and (b), a court or state agency shall consider the evidence and
253	253	mitigate imposition of an administrative penalty or assessment of a
254	254	civil penalty accordingly.
255	255	SECTION 9. Subchapter E, Chapter 181, Health and Safety
256	256	Code, is amended by adding Sections 181.206, 181.207, 181.208,
257	257	181.209, and 181.210 to read as follows:
258	258	Sec. 181.206. RULES. The attorney general may adopt rules
259	259	as necessary to enforce this chapter.
260	260	Sec. 181.207. AUDITS OF COVERED ENTITIES. (a) The
261	261	commission, in coordination with the attorney general, the Texas
262	262	Health Services Authority, and the Texas Department of Insurance:
263	263	(1) may request that the United States secretary of
264	264	health and human services conduct an audit of a covered entity in
265	265	this state to determine compliance with the Health Insurance
266	266	Portability and Accountability Act and Privacy Standards; and
267	267	(2) shall periodically monitor and review the results
268	268	of audits of covered entities in this state conducted by the United
269	269	States secretary of health and human services.
270	270	(b) If the commission has evidence that a covered entity has
271	271	committed violations of this chapter that are egregious and
272	272	constitute a pattern or practice, the commission may:
273	273	(1) require the covered entity to submit to the
274	274	commission the results of a risk analysis conducted by the covered
275	275	entity as described by 45 C.F.R. Section 164.308(a)(1)(ii)(A); or
276	276	(2) if the covered entity is licensed by a licensing
277	277	agency of this state, request that the licensing agency conduct an
278	278	audit of the covered entity's system to determine compliance with
279	279	the provisions of this chapter.
280	280	Sec. 181.208. REVIEW OF COMPLAINT BY COMMISSION. (a) The
281	281	commission shall review a complaint received from an individual or
282	282	an individual's legally authorized representative alleging that a
283	283	covered entity violated this chapter with respect to the
284	284	individual's protected health information.
285	285	(b) The commission shall refer a complaint reviewed under
286	286	Subsection (a) to the appropriate licensing agency or the attorney
287	287	general, as applicable.
288	288	Sec. 181.209. AUDIT AND COMPLAINT REPORT BY COMMISSION.
289	289	(a) The commission annually shall submit to the appropriate
290	290	standing committees of the senate and the house of representatives
291	291	a report that includes:
292	292	(1) the number and types of complaints received by the
293	293	commission regarding violations of this chapter;
294	294	(2) enforcement action taken by the commission, a
295	295	licensing agency, or the office of the attorney general under this
296	296	chapter; and
297	297	(3) the number of federal audits of covered entities
298	298	in this state conducted and the number of audits required under
299	299	Section 181.207(b).
300	300	(b) The commission and the Texas Health Services Authority
301	301	shall each publish the report required by Subsection (a) on the
302	302	agency's Internet website.
303	303	Sec. 181.210. FUNDING. The commission and the Texas
304	304	Department of Insurance, in consultation with the Texas Health
305	305	Services Authority, shall apply for and actively pursue available
306	306	federal funding for enforcement of this chapter.
307	307	SECTION 10. Section 182.002, Health and Safety Code, is
308	308	amended by adding Subdivisions (2-a), (3-a), and (3-b) to read as
309	309	follows:
310	310	(2-a) "Covered entity" has the meaning assigned by
311	311	Section 181.001.
312	312	(3-a) "Disclose" has the meaning assigned by Section
313	313	181.001.
314	314	(3-b) "Health Insurance Portability and
315	315	Accountability Act and Privacy Standards" has the meaning assigned
316	316	by Section 181.001.
317	317	SECTION 11. Subchapter C, Chapter 182, Health and Safety
318	318	Code, is amended by adding Section 182.108 to read as follows:
319	319	Sec. 182.108. STANDARDS FOR ELECTRONIC SHARING OF PROTECTED
320	320	HEALTH INFORMATION; COVERED ENTITY CERTIFICATION. (a) The
321	321	corporation shall develop and submit to the commission for
322	322	ratification privacy and security standards for the electronic
323	323	sharing of protected health information.
324	324	(b) The commission shall review and by rule adopt acceptable
325	325	standards submitted for ratification under Subsection (a).
326	326	(c) Standards adopted under Subsection (b) must be designed
327	327	to:
328	328	(1) comply with the Health Insurance Portability and
329	329	Accountability Act and Privacy Standards and Chapter 181;
330	330	(2) comply with any other state and federal law
331	331	relating to the security and confidentiality of information
332	332	electronically maintained or disclosed by a covered entity;
333	333	(3) ensure the secure maintenance and disclosure of
334	334	personally identifiable health information;
335	335	(4) include strategies and procedures for disclosing
336	336	personally identifiable health information; and
337	337	(5) support a level of system interoperability with
338	338	existing health record databases in this state that is consistent
339	339	with emerging standards.
340	340	(d) The corporation shall establish a process by which a
341	341	covered entity may apply for certification by the corporation of a
342	342	covered entity's past compliance with standards adopted under
343	343	Subsection (b).
344	344	(e) The corporation shall publish the standards adopted
345	345	under Subsection (b) on the corporation's Internet website.
346	346	SECTION 12. Subchapter B, Chapter 602, Insurance Code, is
347	347	amended by adding Section 602.054 to read as follows:
348	348	Sec. 602.054. COMPLIANCE WITH OTHER LAW. A covered entity
349	349	shall comply with:
350	350	(1) Subchapter D, Chapter 181, Health and Safety Code,
351	351	except as otherwise provided by that subchapter; and
352	352	(2) the standards adopted under Section 182.108,
353	353	Health and Safety Code.
354	354	SECTION 13. (a) In this section, "unsustainable covered
355	355	entity" means a covered entity, as defined by Section 181.001,
356	356	Health and Safety Code, that ceases to operate.
357	357	(b) The Health and Human Services Commission, in
358	358	consultation with the Texas Health Services Authority and the Texas
359	359	Medical Board, shall review issues regarding the security and
360	360	accessibility of protected health information maintained by an
361	361	unsustainable covered entity.
362	362	(c) Not later than December 1, 2012, the Health and Human
363	363	Services Commission shall submit to the appropriate standing
364	364	committees of the senate and the house of representatives
365	365	recommendations for:
366	366	(1) the state agency to which the protected health
367	367	information maintained by an unsustainable covered entity should be
368	368	transferred for storage;
369	369	(2) ensuring the security of protected health
370	370	information maintained by unsustainable covered entities in this
371	371	state, including secure transfer methods from the covered entity to
372	372	the state;
373	373	(3) the method and period of time for which protected
374	374	health information should be maintained by the state after transfer
375	375	from an unsustainable covered entity;
376	376	(4) methods and processes by which an individual
377	377	should be able to access the individual's protected health
378	378	information after transfer to the state; and
379	379	(5) funding for the storage of protected health
380	380	information after transfer to the state.
381	381	(d) This section expires January 1, 2013.
382	382	SECTION 14. (a) A task force on health information
383	383	technology is created.
384	384	(b) The task force is composed of:
385	385	(1) 11 members appointed by the attorney general with
386	386	the advice of the chairs of the standing committees of the senate
387	387	and house of representatives having primary jurisdiction over
388	388	health information technology issues, including:
389	389	(A) at least two physicians;
390	390	(B) at least two individuals who represent
391	391	hospitals; and
392	392	(C) at least one private citizen who represents
393	393	patient and parental rights; and
394	394	(2) the following ex officio members:
395	395	(A) the executive commissioner of the Health and
396	396	Human Services Commission or an employee of the commission
397	397	designated by the executive commissioner;
398	398	(B) the commissioner of the Department of State
399	399	Health Services or an employee of the department designated by the
400	400	commissioner; and
401	401	(C) the presiding officer of the Texas Health
402	402	Services Authority or an employee of the authority designated by
403	403	the presiding officer.
404	404	(c) Not later than December 1, 2012, the attorney general
405	405	shall appoint the members of the task force and appoint a chair of
406	406	the task force from among its membership. The chair of the task
407	407	force must have expertise in:
408	408	(1) state and federal health information privacy law;
409	409	(2) patient rights; and
410	410	(3) electronic signatures and other consent tools.
411	411	(d) The task force shall develop recommendations regarding:
412	412	(1) the improvement of informed consent protocols for
413	413	the electronic exchange of protected health information, as that
414	414	term is defined by the Health Insurance Portability and
415	415	Accountability Act and Privacy Standards, as defined by Section
416	416	181.001, Health and Safety Code, as amended by this Act;
417	417	(2) the improvement of patient access to and use of
418	418	electronically maintained and disclosed protected health
419	419	information for the purpose of personal health and coordination of
420	420	health care services; and
421	421	(3) any other critical issues, as determined by the
422	422	task force, related to the exchange of protected health
423	423	information.
424	424	(e) Not later than January 1, 2014, the task force shall
425	425	submit to the standing committees of the senate and house of
426	426	representatives having primary jurisdiction over health
427	427	information technology issues and the Texas Health Services
428	428	Authority a report including the task force's recommendations under
429	429	Subsection (d).
430	430	(f) The Texas Health Services Authority shall publish the
431	431	report submitted under Subsection (e) on the authority's Internet
432	432	website.
433	433	(g) This section expires February 1, 2014.
434	434	SECTION 15. Not later than January 1, 2013:
435	435	(1) the attorney general shall adopt the form required
436	436	by Section 181.154, Health and Safety Code, as added by this Act;
437	437	and
438	438	(2) the Health and Human Services Commission shall
439	439	adopt the standards required by Section 182.108, Health and Safety
440	440	Code, as added by this Act.
441	441	SECTION 16. The change in law made by Section 181.154,
442	442	Health and Safety Code, as added by this Act, applies only to an
443	443	electronic disclosure of protected health information made on or
444	444	after the effective date of this Act. An electronic disclosure of
445	445	protected health information made before the effective date of this
446	446	Act is governed by the law in effect at the time the disclosure was
447	447	made, and the former law is continued in effect for that purpose.
448	448	SECTION 17. This Act takes effect September 1, 2012.