SENATE BILL NO. 97 January 26, 1999, Introduced by Senator A. SMITH and referred to the Committee on Health Policy. A bill to regulate access to certain health information about individuals. THE PEOPLE OF THE STATE OF MICHIGAN ENACT: 1 Sec. 1. This act shall be known and may be cited as the 2 "health information privacy act". 3 Sec. 2. As used in this act: 4 (a) "Anonymous health information" means protected health 5 information that is modified to exclude any personal identifiers 6 of the individual who provided data or specimens related to the 7 information. 8 (b) "Individual" means a natural person. 9 (c) "Person" means an individual, partnership, corporation, 10 association, governmental entity, or other legal entity. 11 (d) "Protected health information" means oral, written, or 12 recorded data about an individual, in any form or medium, that 00437'99 * DMS 2 1 identifies the individual or his or her family and is both of the 2 following: 3 (i) Created as a result of the individual's request for or 4 receipt of a health care service or as a result of a payment or 5 request for payment for a health care service to the individual. 6 (ii) Is created or received by any of the following: 7 (A) A health care provider. 8 (B) An insurer. 9 (C) A health care corporation, as that term is defined in 10 section 105 of the nonprofit health care corporation reform act, 11 1980 PA 350, MCL 550.1105. 12 (D) A health maintenance organization, as that term is 13 defined in section 20106 of the public health code, 1978 PA 368, 14 MCL 333.20106. 15 (E) An employer of the individual. 16 (F) A school district, local act school district, or inter- 17 mediate school district, as those terms are defined in the 18 revised school code, 1976 PA 451, MCL 380.1 to 380.1852, or a 19 public school academy established under the revised school code, 20 1976 PA 451, MCL 380.1 to 380.1852. 21 (G) An institution of higher education or trade or voca- 22 tional school. 23 (H) The department of community health or a local public 24 health department. 25 (I) Any other public body, as that term is defined in sec- 26 tion 2 of the freedom of information act, 1976 PA 442, 27 MCL 15.232. 00437'99 * 3 1 (iii) Is not anonymous health information. 2 Sec. 3. (1) Protected health information about an individ- 3 ual is private. A person other than the individual shall not 4 obtain the individual's protected health information without the 5 express written consent of the individual unless the protected 6 health information is required for 1 or more of the following 7 purposes: 8 (a) To establish the identity of an individual by a law 9 enforcement agency engaged in a criminal investigation or by a 10 court in a juvenile or criminal adjudication or proceeding. 11 (b) To establish the identity or medical condition of an 12 individual if the acquisition of the protected health information 13 is authorized by federal or state law. 14 (c) To comply with newborn screening requirements estab- 15 lished by federal or state law. 16 (d) To determine paternity in accordance with the paternity 17 act, 1956 PA 205, MCL 722.711 to 722.730. 18 (e) To determine the identity of a deceased individual. 19 (f) To conduct research in which the identity of the indi- 20 vidual remains anonymous, or to conduct research in which the 21 procedure for obtaining informed, written consent and using the 22 information complies with national standards for protecting par- 23 ticipants involved in research projects. As used in this subdi- 24 vision, "national standards" includes guidelines issued by the 25 United States office for the protection from research risks and 26 the United States food and drug administration in accordance with 27 21 C.F.R. part 50 and 45 C.F.R. part 46. 00437'99 * 4 1 (2) A person who violates this section is guilty of a 2 misdemeanor punishable by a fine of $1,000.00 or imprisonment for 3 not more than 6 months, or both. 4 Sec. 4. (1) A person who obtains possession of an 5 individual's protected health information shall not retain that 6 protected health information unless 1 of the following conditions 7 is met: 8 (a) The protected health information has been converted into 9 anonymous health information by the removal of all personal iden- 10 tifiers of the individual. 11 (b) The retention of the protected health information is 12 required to achieve 1 or more of the purposes described in sec- 13 tion 3. 14 (c) The retention is required by a state or federal law, 15 rule, or regulation, or by order of a court having jurisdiction. 16 (2) The person who retains an individual's protected health 17 information under subsection (1)(b) or (c) shall not retain the 18 protected health information after the retention is no longer 19 required under subsection (1)(b) or (c), unless the individual 20 about whom the protected health information relates expressly 21 consents in writing to the retention. 22 (3) A person who violates this section is guilty of a misde- 23 meanor punishable by a fine of $1,000.00 or imprisonment for not 24 more than 6 months, or both. 25 Sec. 5. An individual or his or her representative may, 26 within 10 days after making a written request, inspect or obtain 27 a copy of a record of protected health information about the 00437'99 * 5 1 individual. If a copy of a record is requested, the individual 2 or his or her representative may be charged the actual cost of 3 copying the record. 4 Sec. 6. The prohibitions in this act apply only to pro- 5 tected health information that can be identified with a particu- 6 lar individual or family. This act does not affect any law, con- 7 tract, or other arrangement that determines a person's right to 8 compensation for substances or data derived from an individual's 9 protected health information. 10 Sec. 7. (1) Subject to subsection (2), a person shall not 11 disclose, or be compelled to disclose by subpoena or any other 12 means, protected health information about an individual that per- 13 mits identification of the individual. 14 (2) The prohibition described in subsection (1) does not 15 apply if 1 or more of the following conditions exist: 16 (a) The individual who provides protected health information 17 expressly consents in writing to the disclosure. 18 (b) The disclosure is required to meet a purpose described 19 in section 3. 20 (c) A court having jurisdiction orders the disclosure. 21 (d) The disclosure is required to furnish protected health 22 information relating to a decedent for medical diagnosis of blood 23 relatives of the decedent. 24 (e) The disclosure is to an insurer, health care corpora- 25 tion, or health maintenance organization under contract to pay 26 all or a portion of the costs of obtaining the protected health 27 information, and the disclosure is both of the following: 00437'99 * 6 1 (i) Limited to identification of the individual and the cost 2 of obtaining protected health information from, or providing pro- 3 tected health information to, the individual. 4 (ii) Conditioned upon the insurer, health care corporation, 5 or health maintenance organization not using the protected health 6 information to determine the individual's eligibility for a serv- 7 ice or benefit or to set a fee to provide that individual with a 8 service or benefit. As used in this subparagraph, "service or 9 benefit" means a third party payment of a medical care cost 10 incurred for the provision of a health service to the 11 individual. 12 (f) If the individual is an unemancipated minor, the disclo- 13 sure is to a custodial parent or guardian of the individual. 14 (3) A person who violates this section is guilty of a felony 15 punishable by a fine of $5,000.00 or imprisonment for not more 16 than 1 year, or both. 17 Sec. 8. The requirements imposed under this act for acquir- 18 ing, retaining, or disclosing protected health information about 19 an individual apply to each acquisition, retention, or disclosure 20 of protected health information about the individual. 21 Sec. 9. A person who violates this act is liable for all 22 actual damages, or $50,000.00, whichever is greater, including 23 damages for economic or noneconomic injury, established in a 24 civil action to have been proximately caused by the violation, 25 plus reasonable attorney fees and costs. 00437'99 * Final page. DMS