Florida Senate - 2009 SB 876
By Senator Gaetz
4-00825-09 2009876__
1 A bill to be entitled
2 An act relating to health care information; providing
3 a short title; providing a purpose; amending s.
4 395.3025, F.S.; authorizing the release of patient
5 records to certain additional health care
6 practitioners or providers; creating part I of ch.
7 405, F.S.; providing definitions; authorizing a health
8 care provider to release or access an identifiable
9 health record without the patient's consent in an
10 emergency; providing immunity from liability for a
11 health care provider who releases or accesses a
12 patient's identifiable health record in good faith;
13 requiring the Agency for Health Care Administration to
14 develop an authorization form for the use and release
15 of an identifiable health record; providing
16 requirements for the authorization form; requiring the
17 agency to adopt rules and make the form available on
18 its website; requiring a health care provider who
19 receives an authorizing form in an electronic or paper
20 format to accept the form as a valid request to
21 release the record; providing that use of the
22 authorization form is not required; providing that use
23 of the authorization form in exchanging identifiable
24 health records creates a rebuttable presumption;
25 providing immunity for health care providers under
26 certain circumstances; providing that use of the
27 authorization form in exchanging identifiable health
28 records does not violate or waive any privilege
29 protected by law; providing for recovery by a patient
30 or health care provider of damages plus attorney's
31 fees and court costs in certain actions; amending s.
32 483.181, F.S.; authorizing the results of a clinical
33 laboratory test to be sent to certain health care
34 practitioners or providers involved in the care or
35 treatment of a patient; providing an effective date.
36
37 WHEREAS, the use of electronic health-information
38 technology has improved the quality of health care, and
39 WHEREAS, clear and concise standards for sharing privacy
40 protected medical information among authorized health care
41 providers will enable providers to have cost-effective access to
42 the medical information needed to make sound decisions about
43 health care and will enhance patient access to their personal
44 electronic health records by encouraging the adoption of
45 electronic health records, and
46 WHEREAS, maintaining the privacy and security of
47 identifiable health records is essential to the adoption and
48 sharing of electronic health records among health care providers
49 involved in the treatment of patients, NOW, THEREFORE,
50
51 Be It Enacted by the Legislature of the State of Florida:
52
53 Section 1. This act may be cited as the “Electronic Health
54 Records Exchange Act.”
55 Section 2. The purpose of this act is to provide clear and
56 concise standards for authorizing the exchange of health
57 information in compliance with federal and state law and to
58 ensure immunity from liability under state law for the exchange
59 of health information if the exchange of health information
60 complies with these standards.
61 Section 3. Subsection (4) of section 395.3025, Florida
62 Statutes, is amended to read:
63 395.3025 Patient and personnel records; copies;
64 examination.—
65 (4) Patient records are confidential and must not be
66 disclosed without the consent of the patient or the patient's
67 legal representative person to whom they pertain, but
68 appropriate disclosure may be made without such consent to:
69 (a) Licensed facility personnel, and attending physicians,
70 or other health care practitioners or providers currently
71 involved in the care or treatment of the patient for use only in
72 connection with that the treatment of the patient.
73 (b) Licensed facility personnel, only for administrative
74 purposes or risk management and quality assurance functions.
75 (c) The agency, for purposes of health care cost
76 containment.
77 (d) In any civil or criminal action, unless otherwise
78 prohibited by law, upon the issuance of a subpoena from a court
79 of competent jurisdiction and proper notice by the party seeking
80 such records to the patient or his or her legal representative.
81 (e) The agency, upon issuance of a subpoena issued pursuant
82 to s. 456.071., but the Records obtained by subpoena pursuant to
83 s. 456.071 thereby must be used solely for the purpose of the
84 agency and the appropriate professional board in its
85 investigation, prosecution, and appeal of disciplinary
86 proceedings. If the agency requests copies of the records, the
87 facility shall charge no more than its actual copying costs,
88 including reasonable staff time. The records must be sealed and
89 must not be available to the public pursuant to s. 119.07(1) or
90 any other statute providing access to records, nor may they be
91 available to the public as part of the record of investigation
92 for and prosecution in disciplinary proceedings made available
93 to the public by the agency or the appropriate regulatory board.
94 However, the agency must make available, upon written request by
95 a practitioner against whom probable cause has been found, any
96 such records that form the basis of the determination of
97 probable cause.
98 (f) The Department of Health or its agent, for the purpose
99 of establishing and maintaining a trauma registry and for the
100 purpose of ensuring that hospitals and trauma centers are in
101 compliance with the standards and rules established under ss.
102 395.401, 395.4015, 395.4025, 395.404, 395.4045, and 395.405, and
103 for the purpose of monitoring patient outcome at hospitals and
104 trauma centers that provide trauma care services.
105 (g) The Department of Children and Family Services or its
106 agent, for the purpose of investigations of cases of abuse,
107 neglect, or exploitation of children or vulnerable adults.
108 (h) The State Long-Term Care Ombudsman Council and the
109 local long-term care ombudsman councils, with respect to the
110 records of a patient who has been admitted from a nursing home
111 or long-term care facility, when the councils are conducting an
112 investigation involving the patient as authorized under part II
113 of chapter 400, upon presentation of identification as a council
114 member by the person making the request. Disclosure under this
115 paragraph shall only be made only after a competent patient or
116 the patient's representative has been advised that disclosure
117 may be made and the patient has not objected.
118 (i) A local trauma agency or a regional trauma agency that
119 performs quality assurance activities, or a panel or committee
120 assembled to assist a local trauma agency or a regional trauma
121 agency in performing quality assurance activities. Patient
122 records obtained under this paragraph are confidential and
123 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
124 Constitution.
125 (j) Organ procurement organizations, tissue banks, and eye
126 banks required to conduct death records reviews pursuant to s.
127 395.2050.
128 (k) The Medicaid Fraud Control Unit in the Department of
129 Legal Affairs pursuant to s. 409.920.
130 (l) The Department of Financial Services, or an agent,
131 employee, or independent contractor of the department who is
132 auditing for unclaimed property pursuant to chapter 717.
133 (m) A regional poison control center, for purposes of
134 evaluating the treatment of treating a poison episode under
135 evaluation, case management of poison cases, or compliance with
136 data collection and reporting requirements of s. 395.1027 and
137 the professional organization that certifies poison control
138 centers in accordance with federal law.
139 Section 4. Part I of chapter 405, Florida Statutes,
140 consisting of sections 405.001, 405.002, 405.003, and 405.004,
141 is created to read:
142 405.001 Definitions.—As used in this part, the term:
143 (1) “Agency” means Agency for Health Care Administration.
144 (2) “Electronic health record” means an electronic record
145 of patient-specific health-related information which can be
146 created, managed, and consulted by authorized clinicians and
147 staff across more than one health care organization.
148 (3) “Health record” means any information, recorded in any
149 form or medium, which relates to the past, present, or future
150 health of an individual for the primary purpose of providing
151 health care and health-related services.
152 (4) “Identifiable health record” means any health record
153 that identifies a patient or with respect to which there is a
154 reasonable basis to believe the information can be used to
155 identify the patient.
156 (5) “Patient” means a natural person who has received
157 health care services from a health care provider for treatment
158 or examination of a medical, dental, psychiatric, behavioral,
159 health, or other health-related condition. If, under applicable
160 law, a parent, guardian, or other person may act on behalf of a
161 minor, that parent, guardian, or person shall be treated as the
162 patient for purposes relating to the use and disclosure of the
163 patient’s electronic health record. If, under applicable law, a
164 person may act on behalf of an individual who is an adult or an
165 emancipated minor in making decisions related to health care,
166 that person shall be treated as acting for the patient for
167 purposes relating to the use and disclosure of the patient’s
168 electronic health record.
169 (6) “Health care provider” means a provider of services as
170 defined in 42 U.S.C. s. 1395x(u), a provider of medical or
171 health services as defined in 42 U.S.C. s. 1395x(s), or any
172 other person or organization that furnishes, bills, or is paid
173 for health care services in the normal course of business.
174 405.002 Emergency release of health records.—A health care
175 provider may release or access a patient's identifiable health
176 record without the patient's consent for use in the treatment of
177 the patient for an emergency medical condition as defined in s.
178 395.002 when the health care provider is unable to obtain the
179 patient’s consent due to the patient’s condition or the nature
180 of the situation requiring immediate medical attention. A health
181 care provider who, in good faith, releases or accesses a
182 patient's identifiable health record in any form or medium under
183 this section is immune from civil liability for accessing or
184 releasing the identifiable health record.
185 405.003 Universal patient authorization form.—
186 (1) By July 1, 2010, the agency shall develop forms in
187 paper and electronic formats which may be used by a health care
188 provider to document patient authorization for the use or
189 release, in any form or medium, of an identifiable health
190 record.
191 (2) The authorization form adopted and distributed by the
192 agency must comply with all applicable federal and state privacy
193 and privilege laws. This authorization form does not alter any
194 applicable federal and state privacy and privilege laws.
195 (3) The agency shall adopt the authorization form and
196 accompanying instructions by rule and make them available on the
197 agency’s consumer health care website created pursuant to s.
198 408.05.
199 (4) A health care provider receiving a request for the
200 release of an identifiable health record via the authorization
201 form adopted and distributed by the agency shall accept the form
202 as a valid authorization for the release of an identifiable
203 health record. A health care provider may elect to accept the
204 authorization form in electronic or paper format or both. It is
205 the responsibility of the individual or entity requesting the
206 release of an identifiable health record via the authorization
207 form distributed by the agency to ascertain the authorization
208 format that would be accepted by the health care provider.
209 (5) An individual or entity requesting an identifiable
210 health record is not required under this section to use the
211 authorization form adopted and distributed by the agency.
212 (6) The exchange of an identifiable health record using the
213 authorization form adopted and distributed by the agency, when
214 used in accordance with the instructions of the agency, creates
215 a rebuttable presumption that the release of an identifiable
216 health record was appropriate. A health care provider who
217 releases an identifiable health record in reliance on the
218 information provided in a properly completed authorization form
219 adopted and distributed by the agency is immune from liability
220 in actions based upon state privacy or privilege law which arise
221 from the exchange of an identifiable health record.
222 (7) The exchange of an identifiable health record using the
223 authorization form adopted and distributed by the agency does
224 not violate or waive any privilege protected under statutory or
225 common law of this state.
226 405.004 Disciplinary grounds.—The person presenting an
227 authorization form to a patient or health care provider who
228 releases an identifiable health record in reliance on that
229 authorization form is liable to the health care provider or the
230 patient for compensatory damages caused by the release of the
231 identifiable health record, plus court costs and reasonable
232 attorney's fees, if the person presenting the form:
233 (a) Forged a signature on the authorization form or
234 materially altered the authorization form of another person
235 without the patient's authorization; or
236 (b) Obtained an authorization form or an identifiable
237 health record of another person under false pretenses.
238 Section 5. Subsection (2) of section 483.181, Florida
239 Statutes, is amended to read:
240 483.181 Acceptance, collection, identification, and
241 examination of specimens.—
242 (2) The results of a test must be reported directly to the
243 licensed practitioner or other authorized person who requested
244 it and may be sent to other health care practitioners or
245 providers involved in the care or treatment of the patient as
246 specified in s. 456.057(7)(a). The report must include the name
247 and address of the clinical laboratory that in which the test
248 was actually performed the test, unless the test was performed
249 in a hospital laboratory and the report becomes an integral part
250 of the hospital record.
251 Section 6. This act shall take effect July 1, 2009.