Florida Senate - 2014                        COMMITTEE AMENDMENT
       Bill No. SB 862
                              LEGISLATIVE ACTION                        
                    Senate             .             House              
                  Comm: RCS            .                                
                  04/02/2014           .                                

    1         Senate Amendment (with title amendment)
    3         Delete lines 360 - 427
    4  and insert:
    5         3. A law enforcement agency during active investigations of
    6  regarding potential criminal activity, fraud, or theft regarding
    7  prescribed controlled substances, in accordance with paragraph
    8  (d).
    9         4. A patient or the legal guardian or designated health
   10  care surrogate of an incapacitated patient as described in s.
   11  893.0551 who, for the purpose of verifying the accuracy of the
   12  database information, submits a written and notarized request
   13  that includes the patient’s full name, address, and date of
   14  birth, and includes the same information if the legal guardian
   15  or health care surrogate submits the request. If the patient’s
   16  legal guardian or health care surrogate is the requestor, the
   17  request shall be validated by the department to verify the
   18  identity of the patient and the legal guardian or health care
   19  surrogate, if the patient’s legal guardian or health care
   20  surrogate is the requestor. Such verification is also required
   21  for any request to change a patient’s prescription history or
   22  other information related to his or her information in the
   23  electronic database.
   24         (c) Information in or released from the prescription drug
   25  monitoring program database for the electronic prescription drug
   26  monitoring system is not discoverable or admissible in any civil
   27  or administrative action, except in an investigation and
   28  disciplinary proceeding by the department or the appropriate
   29  regulatory board. Information shared with a state attorney
   30  pursuant to s. 893.0551(3)(a) or (c) may be released only in
   31  response to a discovery demand if such information is directly
   32  related to the criminal case for which the information was
   33  requested. If additional information is shared with the state
   34  attorney which is not directly related to the criminal case, the
   35  state attorney shall inform the inquirer that such information
   36  exists. Unrelated information may not be released except upon an
   37  order of a court of competent jurisdiction.
   38         (d) The department shall adopt a user agreement by rule.
   39  Before releasing any information pursuant to subparagraph (b)3.,
   40  the department shall enter into a user agreement with the law
   41  enforcement agency requesting information from the prescription
   42  drug monitoring database. At a minimum, the user agreement must:
   43         1. Provide for access control and information security in
   44  order to ensure the confidentiality of the information.
   45         2. Contain training requirements.
   46         3. Require each agency head to submit an annual attestation
   47  to the program manager that the user agreement is being complied
   48  with and to disclose any findings and actions taken to maintain
   49  compliance. Any findings of noncompliance must be reported
   50  immediately by the agency head to the program manager.
   51         4. Require each agency that receives information from the
   52  database to electronically update the database semiannually with
   53  the status of the case for which the information was requested,
   54  in accordance with procedures established by department rule.
   55         5. Require each agency head to appoint one agency
   56  administrator to be responsible for appointing authorized users
   57  to request and receive investigative reports on behalf of the
   58  agency to ensure the agency maintains compliance with the user
   59  agreement and laws governing access, use, and dissemination of
   60  information received.
   61         6. Require each authorized user to attest that each request
   62  for confidential information from the database is predicated on
   63  and related to an active investigation.
   64         7. Require the agency to conduct annual audits of the
   65  administrator and of each authorized user to ensure the user
   66  agreement is being followed. Such audits must be conducted by an
   67  internal affairs, professional compliance, inspector general, or
   68  similarly situated unit within the agency which normally handles
   69  inspections or internal investigations for that agency. The
   70  review must include any allegations of noncompliance, potential
   71  security violations, and a report on the user’s compliance with
   72  laws, rules, and the user agreement. The agency shall also
   73  conduct routine audits on access and dissemination of records.
   74  The results of each audit shall be submitted to the program
   75  manager within 7 days after completing the audit. By October 1,
   76  2014, the department shall adopt rules to ensure that each
   77  agency is complying with the audit requirements pursuant to this
   78  subparagraph.
   79         8. Allow the program manager to restrict, suspend, or
   80  terminate an administrator’s or authorized user’s access to
   81  information in the database if the department finds that the
   82  administrator or authorized user has failed to comply with the
   83  terms of the user agreement. If an agency does not comply with
   84  the department’s rules on audit requirements, the program
   85  manager shall suspend the agency’s access to information in the
   86  database until the agency comes into compliance with such rules.
   87         (e)(d)Other than the program manager and his or her
   88  program or support staff as authorized in paragraph (f),
   89  department staff are, for the purpose of calculating performance
   90  measures pursuant to subsection (8), shall not be allowed direct
   91  access to information in the prescription drug monitoring
   92  program database but may request from the program manager and,
   93  when authorized by the program manager, the program manager’s
   94  program and support staff, information that does not contain
   95  contains no identifying information of any patient, physician,
   96  health care practitioner, prescriber, or dispenser and that is
   97  not confidential and exempt for the purpose of calculating
   98  performance measures pursuant to subsection (7).
   99         (f) The program manager and designated support staff, upon
  100  the direction of the program manager or as otherwise authorized
  101  during the program manager’s absence, may access the
  102  prescription drug monitoring program database only to manage the
  103  program or to manage the program database and systems in support
  104  of the requirements of this section or as established by the
  105  department in rule pursuant to subparagraph (2)(c)4. The program
  106  manager, designated program and support staff who act at the
  107  direction of or in the absence of the program manager, and any
  108  individual who has similar access regarding the management of
  109  the database from the prescription drug monitoring program shall
  110  submit fingerprints to the department for background screening.
  111  The department shall follow the procedure established by the
  112  Department of Law Enforcement to request a statewide criminal
  113  history record check and to request that the Department of Law
  114  Enforcement forward the fingerprints to the Federal Bureau of
  115  Investigation for a national criminal history record check.
  116         (g) If the program manager determines a pattern consistent
  117  with the rules established under subparagraph (2)(c)4., the
  118  department may provide:
  119         1. A patient advisory report to an appropriate health care
  120  practitioner; and
  121         2. Relevant information that does not contain personal
  122  identifying information to the applicable law enforcement
  123  agency. A law enforcement agency may use such information to
  124  determine whether an active investigation is warranted.
  125         (h)(e) All transmissions of data required by this section
  127  ================= T I T L E  A M E N D M E N T ================
  128  And the title is amended as follows:
  129         Delete lines 7 - 23
  130  and insert:
  131         Department of Health; providing requirements for the
  132         release of information shared with a state attorney in
  133         response to a discovery demand; providing procedures
  134         for the release of information to a law enforcement
  135         agency during an active investigation; requiring the
  136         department to adopt a user agreement by rule;
  137         requiring the department to enter into a user
  138         agreement with the law enforcement agency requesting
  139         the release of information; providing requirements for
  140         the user agreement; requiring a law enforcement agency
  141         under a user agreement to conduct annual audits;
  142         providing for the restriction, suspension, or
  143         termination of a user agreement; providing for access
  144         to the program database by the program manager and
  145         designated support staff; authorizing the department
  146         to provide a patient advisory report to the
  147         appropriate health care practitioner if the program
  148         manager determines that a specified pattern exists;
  149         authorizing the department to provide relevant
  150         information that does not contain personal identifying
  151         information to a law enforcement agency if the program
  152         manager determines that a specified pattern exists;
  153         authorizing the law enforcement agency to use such
  154         information to determine whether an active
  155         investigation is warranted; authorizing the