(a) Is otherwise authorized by the individual, or by a person who is authorized to consent on behalf of an individual who lacks the capacity to consent.
(b) Is reasonably related to the protection of the insurer's interests in the assessment of causation, fault or liability or in the detection or prevention of criminal activity, fraud, material misrepresentation or material nondisclosure.
(c) Is made to an insurance regulatory authority or in response to an administrative or judicial order, including a search warrant or subpoena, that is valid on its face.
(d) Is otherwise permitted by law.
(e) Is made for purposes of pursuing a contribution or subrogation claim.
(f) Is made to a professional peer review organization, bill review organization, health care provider or medical consultant or reviewer for the purpose of reviewing the services, fees, treatment or conduct of a medical care institution or health care provider.
(g) Is made to a medical care institution or health care provider for any of the following purposes:
1. Verifying insurance coverage or benefits.
2. Conducting an operations or services audit to verify the individuals treated by the health care provider or at the medical care institution.
(h) Is made to a network plan that is offered by an insurer in order to make arrangements for coordinated health care in which personal medical information concerning an individual is available for providing treatment, making payment for health care under the plan and undertaking such plan operations as are necessary to fulfill the contract for provision of coordinated health care.
(i) Is made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurer's operations or services. Disclosure may be made under this paragraph only if the disclosure is reasonably necessary for the group policyholder to conduct the review or audit.
(j) Is made for purposes of enabling business decisions to be made regarding the purchase, transfer, merger, reinsurance or sale of all or part of an insurance business.
(k) Is made for purposes of actuarial or research studies or for accreditation or auditing. With respect to a disclosure made under this paragraph, any materials that allow for the identification of an individual must be returned to the insurer or destroyed as soon as reasonably practicable, and no individual may be identified in any actuarial, research, accreditation or auditing report.
(L) Is made to the insurer's legal representative for purposes of claims review or legal advice or defense.
(6) Immunity. (a) A person is not liable to any person for any of the following:
1. Disclosing personal medical information in accordance with this section.
2. Furnishing personal medical information to an insurer or insurance support organization in accordance with this section.
(b) Paragraph (a) does not apply to the disclosure or furnishing of false information with malice or intent to injure any person.
(7) Obtaining information under false pretenses. Any person who knowingly and wilfully obtains information about an individual from an insurer or insurance support organization under false pretenses may be fined not more than $10,000 or imprisoned for not more than one year in the county jail or both.
231,62
Section
62. 895.505 of the statutes is created to read:
895.505 Storage and disposal of records containing personal information. (1) Definitions. In this section:
(a) “Business" means an organization or enterprise, whether or not operated for profit, including a sole proprietorship, partnership, firm, business trust, joint venture, syndicate, corporation, limited liability company or association.
(b) “Destruction" means, with respect to a record, permanently rendering the personal information contained in the record incapable of being read.
(c) “Disposal" means, with respect to a record, ceasing to have control over access to the record.
(d) “Personal information" means personally identifiable data about the medical or financial condition of a state resident that is not generally considered to be public knowledge, including the individual's social security number.
(e) “Personally identifiable" means capable of being associated with a particular individual through one or more identifiers or other information or circumstances.
(f) “Record" means any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.
(2) Storage of records containing personal information. Prior to the disposal of a record under sub. (3), a business shall take all actions that it reasonably believes to be necessary to prevent unauthorized persons from obtaining access to personal information contained in the record.
(3) Disposal of records containing personal information. A business may not dispose of a record containing personal information unless it does at least one of the following:
(a) Prior to the disposal of the record, the business shreds, erases or otherwise modifies the record to make the personal information unreadable.
(b) The business takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record's disposal and the record's destruction.
(4) Cause of action. A business that violates sub. (2) or (3) is liable to any person damaged by the violation for the amount of pecuniary damages.
231,63
Section 63
. 943.30 (5) of the statutes is created to read:
943.30 (5) (a) In this subsection, “patient health care records" has the meaning given in s. 146.81 (4).
(b) Whoever, orally or by any written or printed communication, maliciously uses, or threatens to use, the patient health care records of another person, with intent thereby to extort money or any pecuniary advantage, or with intent to compel the person so threatened to do any act against the person's will or omit to do any lawful act, is guilty of a Class D felony.
231,64
Section 64
.
Nonstatutory provisions; administration.
(1) Interagency coordinating council member. Notwithstanding the length of terms of members specified in section 15.107 (7) (intro.) of the statutes, the member appointed to the interagency coordinating council under section 15.107 (7) (g) of the statutes, as created by this act, shall serve for an initial term that expires on July 1, 2003.
231,65
Section 65
.
Nonstatutory provisions; health and family services.
(1) Report and plan on charity care and bad debt services. The department of health and family services shall prepare a report on the feasibility of requiring major health care providers, other than hospitals, to report annually on the services provided as either charity care or bad debt services and to file an annual plan on projected services that will be provided as either charity care or bad debt services, in the same manner as the annual report and plan by hospitals under section 153.20 of the statutes, as affected by this act. By the first day of the 7th month after publication of this act, the department shall submit the report to the legislature in the manner provided under section 13.172 (2) of the statutes, to the board on health care information and to the governor.
(2) Board on health care information members. Notwithstanding the length of terms specified for the members of the board on health care information under section 15.195 (6) of the statutes, as affected by this act, the 10th and 11th initial members appointed under that subsection shall be appointed for a term expiring on May 1, 2002.
(3) Plan for correction of erroneous data. The department of health and family services shall develop a plan for the correction of erroneous data collected under section 153.05 (1), (5) and (8) of the statutes, as affected by this act. The department of health and family services may not implement procedures under the plan unless the plan is approved by the board on health care information. The department of health and family services shall implement the procedures under the plan at the time data is first collected from health care providers under section 153.05 (1), (5) and (8) of the statutes, as affected by this act.
(3t) Report on information collected from a medical school faculty member. The department of health and family services shall report on whether health care information that is collected under chapter 153 of the statutes, as affected by this act, from a physician who is a member of the faculty of a medical school should be adjusted to reflect services rendered by residents or fellows in medical education who are under the supervision of the physician. The department shall submit the report by July 1, 1999, to the legislature in the manner provided under section 13.172 (2) of the statutes, and to the governor.
231,65m
Section 65m.0
Appropriation changes; health and family services.
(1) Report on information collected from a medical school faculty member. In the schedule under section 20.005 (3) of the statutes for the appropriation to the department of health and family services under section 20.435 (6) (a) of the statutes, as affected by the acts of 1997, the dollar amount is increased by $5,200 for fiscal year 1998-99 to increase funding to contract
with the Medical College of Wisconsin for the preparation of the report under Section 65 (3t) of this act.
231,66
Section 66
.
Initial applicability.
(1) Board on health care information. The treatment of section 15.07 (1) (b) 21. of the statutes first applies to persons appointed to the board on health care information on the effective date of this subsection.
(2) Disclosure by insurers of personal medical information. If a contract that is affected by section 610.70 of the statutes, as created by this act, that is in effect on the first day of the 13th month beginning after publication and that was not issued or renewed after the effective date of this subsection contains terms or provisions that are inconsistent with the requirements under section 610.70 of the statutes, as created by this act, the treatment of sections 51.30 (4) (a), 146.82 (2) (b) and 610.70 of the statutes first applies to that contract upon renewal.
231,67
Section 67
.
Effective dates. This act takes effect on the day after publication, except as follows:
(1) The treatment of sections 51.30 (4) (a), 146.82 (2) (b) and 610.70 of the statutes takes effect on the first day of the 13th month beginning after publication.
(2) The treatment of section 895.505 of the statutes takes effect on the first day of the 4th month beginning after publication.
