Amendment SA1-SSA1-AB133

AB133-SSA1-SA1,296,6 4. Multiple years of data elements are added to protect identity.

AB133-SSA1-SA1, s. 2280g Section 2280g. 153.45 (6) of the statutes is created to read:

AB133-SSA1-SA1,296,11 153.45 (6) The department may not sell or distribute data bases of information, from health care providers who are not hospitals or ambulatory surgery centers, that are able to be linked with public use data files, unless first approved by the independent review board.

AB133-SSA1-SA1, s. 2280ge Section 2280ge. 153.50 (1) (a) of the statutes is renumbered 153.01 (2m).

AB133-SSA1-SA1, s. 2280gg Section 2280gg. 153.50 (1) (b) of the statutes is renumbered 153.50 (1) (b) 1., and 153.50 (1) (b) 1. (intro.), as renumbered, is amended to read:

AB133-SSA1-SA1,296,17 153.50 (1) (b) 1. (intro.) "Patient-identifiable data", for information submitted by hospitals and ambulatory surgery centers, means all of the following data elements:

AB133-SSA1-SA1, s. 2280gm Section 2280gm. 153.50 (1) (b) 2. of the statutes is created to read:

AB133-SSA1-SA1,296,21 153.50 (1) (b) 2. "Patient-identifiable data", for information submitted by health care providers who are not hospitals or ambulatory surgery centers, means all of the following data elements:

AB133-SSA1-SA1,296,22 a. Data elements specified in subd. 1. a. to g., L. and m.

AB133-SSA1-SA1,296,24 b. Whether the patient's condition is related to employment, and occurrence and place of an auto accident or other accident.

AB133-SSA1-SA1,297,2 c. Date of first symptom of current illness, of current injury or of current pregnancy.

AB133-SSA1-SA1,297,3 d. First date of patient's same or similar illness, if any.

AB133-SSA1-SA1,297,5 e. Dates that the patient has been unable to work in his or her current occupation.

AB133-SSA1-SA1,297,6 f. Dates of receipt by patient of medical service.

AB133-SSA1-SA1,297,7 g. The patient's city, town or village.

AB133-SSA1-SA1, s. 2280h Section 2280h. 153.50 (2) of the statutes is repealed.

AB133-SSA1-SA1, s. 2280i Section 2280i. 153.50 (3) (b) 7. of the statutes is created to read:

AB133-SSA1-SA1,297,11 153.50 (3) (b) 7. The patient's account number, after use only as verification of data by the department.

AB133-SSA1-SA1, s. 2280j Section 2280j. 153.50 (3) (c) of the statutes is created to read:

AB133-SSA1-SA1,297,16 153.50 (3) (c) Develop, for use by purchasers of data under this chapter, a data use agreement that specifies data use restrictions, appropriate uses of data and penalties for misuse of data, and notify prospective and current purchasers of data of the appropriate uses.

AB133-SSA1-SA1, s. 2280k Section 2280k. 153.50 (3) (d) of the statutes is created to read:

AB133-SSA1-SA1,297,19 153.50 (3) (d) Require that a purchaser of data under this chapter sign and have notarized the data use agreement of the department specified in par. (c).

AB133-SSA1-SA1, s. 2280km Section 2280km. 153.50 (3m) of the statutes is created to read:

AB133-SSA1-SA1,297,25 153.50 (3m) Healthcare provider measures to ensure patient identity protection. A health care provider that is not a hospital or ambulatory surgery center shall, before submitting information required by the department under this chapter, convert to a payer category code as specified by the department any names of an insured's payer or other insured's payer.

AB133-SSA1-SA1, s. 2280kp Section 2280kp. 153.50 (4) (intro.) of the statutes is renumbered 153.50 (4) (a) (intro.) and amended to read:

AB133-SSA1-SA1,298,5 153.50 (4) (a) (intro.) Under Except as specified in par. (b), under the procedures specified in sub. (5), release of patient-identifiable data may be made only to any of the following:

AB133-SSA1-SA1, s. 2280kq Section 2280kq. 153.50 (4) (a) of the statutes is repealed.

AB133-SSA1-SA1, s. 2280kr Section 2280kr. 153.50 (4) (b) to (e) of the statutes are renumbered 153.50 (4) (a) 1. to 4.

AB133-SSA1-SA1, s. 2280ks Section 2280ks. 153.50 (4) (b) of the statutes is created to read:

AB133-SSA1-SA1,298,13 153.50 (4) (b) Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, patient-identifiable data that contains a patient's date of birth may be released under par. (a) only under circumstances as specified by rule by the department.

AB133-SSA1-SA1, s. 2280ku Section 2280ku. 153.50 (5) (a) (intro.) of the statutes is amended to read:

AB133-SSA1-SA1,298,18 153.50 (5) (a) (intro.) The department may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a) , (c), (d) or (e) unless the authorized person requests the department, in writing, to release the patient-identifiable data. The request shall include all of the following:

AB133-SSA1-SA1, s. 2280kv Section 2280kv. 153.50 (5) (a) 3. of the statutes is amended to read:

AB133-SSA1-SA1,298,22 153.50 (5) (a) 3. For a person who is authorized under sub. (4) (a), (c) or (d) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.

AB133-SSA1-SA1, s. 2280kw Section 2280kw. 153.50 (5) (a) 4. (intro.) of the statutes is amended to read:

AB133-SSA1-SA1,299,3 153.50 (5) (a) 4. (intro.) For an entity that is authorized under sub. (4) (e) (a) 4. to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:

AB133-SSA1-SA1, s. 2280kx Section 2280kx. 153.50 (5) (b) 3. of the statutes is amended to read:

AB133-SSA1-SA1,299,6 153.50 (5) (b) 3. For a person who believes that he or she is authorized under sub. (4) (a), the action provided under s. 19.37.".

AB133-SSA1-SA1,299,7 959. Page 1170, line 22: after that line insert:

AB133-SSA1-SA1,299,8 " Section 2280p. 153.50 (6) of the statutes is renumbered 153.50 (6) (a).

AB133-SSA1-SA1, s. 2280q Section 2280q. 153.50 (6) (b), (c), (d) and (e) of the statutes are created to read:

AB133-SSA1-SA1,299,12 153.50 (6) (b) The department may not require under this chapter a health care provider that is a hospital or ambulatory surgery center to submit uniform patient billing forms.

AB133-SSA1-SA1,299,15 (c) A health care provider that is not a hospital or ambulatory surgery center may not submit any of the following to the department under the requirements of this chapter:

AB133-SSA1-SA1,299,16 1. The data elements specified under sub. (3) (b).

AB133-SSA1-SA1,299,17 2. The patient's telephone number.

AB133-SSA1-SA1,299,18 3. The insured's employer's name or school name.

AB133-SSA1-SA1,299,20 4. Data regarding insureds other than the patient, other than the payer category code under sub. (3m).

AB133-SSA1-SA1,299,21 5. The patient's employer's name or school name.

AB133-SSA1-SA1,299,22 6. The patient's relationship to the insured.

AB133-SSA1-SA1,299,23 7. The insured's identification number.

AB133-SSA1-SA1,299,24 8. The insured's policy or group number.

AB133-SSA1-SA1,300,1 9. The insured's date of birth or sex.

AB133-SSA1-SA1,300,2 10. The patient's marital, employment or student status.

AB133-SSA1-SA1,300,6 (d) If a health care provider that is not a hospital or ambulatory surgery center submits a data element that is specified in par. (c) 1. to 10., the department shall immediately return this information to the health care provider or, if discovered later, shall remove and destroy the information.

AB133-SSA1-SA1,300,8 (e) A health care provider may not submit information that uses any of the following as a patient account number:

AB133-SSA1-SA1,300,10 1. The patient's social security number or any substantial portion of the patient's social security number.

AB133-SSA1-SA1,300,11 2. A number that is related to another patient identifying number.

AB133-SSA1-SA1, s. 2280r Section 2280r. 153.55 of the statutes is amended to read:

AB133-SSA1-SA1,300,15 153.55 Protection of health care provider confidentiality. Health care provider-identifiable data Data obtained under this chapter is not subject to inspection, copying or receipt under s. 19.35 (1).".

AB133-SSA1-SA1,300,16 960. Page 1172, line 14: after that line insert:

AB133-SSA1-SA1,300,17 " Section 2283g. 153.67 of the statutes is created to read:

AB133-SSA1-SA1,300,23 153.67 Independent review board. The independent review board shall review any request under s. 153.45 (1) (c) for data elements other than those available for public use data files under s. 153.45 (1) (b). Unless the independent review board approves such a request or unless independent review board approval is not required under rules of the department promulgated under s. 153.45 (1) (c) (intro.), the data elements requested may not be released.

AB133-SSA1-SA1, s. 2283h Section 2283h. 153.76 of the statutes is created to read:

AB133-SSA1-SA1,301,4 153.76 Rule-making by the independent review board. Notwithstanding s. 15.01 (1r), the independent review board may promulgate only those rules that are first reviewed and approved by the board on health care information.

AB133-SSA1-SA1, s. 2283i Section 2283i. 153.85 of the statutes is amended to read:

AB133-SSA1-SA1,301,9 153.85 Civil liability. Any Except as provided in s. 153.86, any person violating s. 153.50 or rules promulgated under s. 153.75 (1) (a) is liable to the patient for actual damages and costs, plus exemplary damages of up to $1,000 for a negligent violation and up to $5,000 for an intentional violation.

AB133-SSA1-SA1, s. 2283j Section 2283j. 153.86 of the statutes is created to read:

AB133-SSA1-SA1,301,16 153.86 Immunity from liability. A health care provider that submits information to the department under this chapter is immune from civil liability for any act or omission of an employe, official or agent of the health care provider that results in the release of a prohibited data element while submitting data to the department of health and family services. The immunity provided under this section does not apply to intentional, wilful or reckless acts or omissions.

AB133-SSA1-SA1, s. 2283k Section 2283k. 153.90 (1) of the statutes is amended to read:

AB133-SSA1-SA1,301,20 153.90 (1) Whoever intentionally violates s. 153.45 (5) or 153.50 or rules promulgated under s. 153.75 (1) (a) may be fined not more than $10,000 $15,000 or imprisoned for not more than 9 months one year or both.".

AB133-SSA1-SA1,301,21 961. Page 1174, line 2: after that line insert:

AB133-SSA1-SA1,301,22 " Section 2286e. 165.25 (2m) of the statutes is created to read:

AB133-SSA1-SA1,301,24 165.25 (2m) Prosecution services. Provide general program operations related to ch. 978.

AB133-SSA1-SA1, s. 2286f Section 2286f. 165.25 (3g) of the statutes is created to read:

AB133-SSA1-SA1,302,6 165.25 (3g) Unfunded prior service for assistant district attorneys. Beginning in the 1999-2000 fiscal year and ending in the 2003-04 fiscal year, pay $80,000 in each fiscal year from the appropriation account under s. 20.475 (1) (d) toward the unfunded prior service liability under the Wisconsin retirement system that results from granting the creditable service under s. 40.02 (17) (gm).".

AB133-SSA1-SA1,302,7 962. Page 1174, line 2: after that line insert:

AB133-SSA1-SA1,302,8 " Section 2287g. 165.06 of the statutes is created to read:

AB133-SSA1-SA1,302,23 165.06 Assistant attorney general — consumer privacy advocate. (1) The attorney general shall designate an assistant attorney general on the attorney general's staff as the consumer privacy advocate. The consumer privacy advocate shall represent the consumers' interests in issues concerning consumer privacy, including the purchase of products on the Internet and the prevention of theft of the consumer's personal identifying information. The secretary of administration shall give the consumer privacy advocate written notices of all proceedings under subch. VII of ch. 16. The prosecutor of any action under s. 943.201, 943.392, 943.41 or 943.70 shall give the consumer privacy advocate written notices of all proceedings under those sections. The consumer privacy advocate shall be provided the minutes, reports, recommendations and any documents provided by or to the joint committee on information policy and the standing committees of the assembly and senate dealing with privacy matters. Annually, the consumer privacy advocate shall report to the appropriate standing committees of the assembly and senate on the status of consumer privacy in this state.

AB133-SSA1-SA1,303,6 (2) The consumer privacy advocate may, on his or her own initiative or upon request of any committee of the legislature, formally intervene in all civil proceedings described in sub. (1) whenever such intervention is needed for the protection of consumers' rights to privacy, including the restriction of access to the consumer's personal identifying information and the prevention of fraudulent use of the consumer's personal identifying information on the Internet.

AB133-SSA1-SA1,303,18 (3) Personnel of the department of administration shall, upon the request of the consumer privacy advocate, make such investigations, studies and reports as the advocate may request in connection with proceedings described in sub. (1), either before or after formal intervention. Personnel of state agencies shall, at the consumer privacy advocate's request, provide information, serve as witnesses in civil proceedings described in sub. (1) and otherwise cooperate in the carrying out of the consumer privacy advocate's functions. Formal intervention shall be by filing a statement to that effect with the examiner or other person immediately in charge of the proceeding. Upon filing the statement, the consumer privacy advocate shall be considered a party in interest with full power to present evidence, subpoena and cross-examine witnesses, submit proof, file briefs or do any other acts appropriate for a party to the proceedings.

AB133-SSA1-SA1,303,23 (4) The consumer privacy advocate may appeal from administrative rulings to the courts. In all administrative proceedings and judicial review proceedings the consumer privacy advocate shall be identified as "consumer privacy advocate". This section does not preclude or prevent any division of any department or independent agency from appearing by its staff as a party in those proceedings.

AB133-SSA1-SA1, s. 2287j Section 2287j. 165.061 of the statutes is created to read:

AB133-SSA1-SA1,304,5 165.061 Assistant attorney general; consumer privacy advocate; authority. In carrying out his or her duty to protect the consumers' right to privacy, the consumer privacy advocate has the authority to initiate actions and proceedings before any agency or court related to consumer privacy, including issues concerning constitutionality, to present evidence and testimony and to make arguments.

AB133-SSA1-SA1, s. 2287m Section 2287m. 165.062 of the statutes is created to read:

AB133-SSA1-SA1,304,16 165.062 Assistant attorney general; consumer privacy advocate; advisory committee. The attorney general shall appoint a consumer privacy advisory committee under s. 15.04 (1) (c). The consumer privacy advisory committee shall consist of not less than 7 nor more than 9 members. The members shall have backgrounds in or demonstrated experience or records relating to privacy protection, record security or information technology. The consumer privacy advisory committee shall advise the consumer privacy advocate consistent with his or her duty to protect the consumers' right to privacy. The consumer privacy advisory committee shall conduct meetings consistent with subch. V of ch. 19 and shall permit public participation and public comment on consumer privacy advocate activities.".

AB133-SSA1-SA1,304,17 963. Page 1174, line 2: after that line insert:

AB133-SSA1-SA1,304,18 " Section 2286k. 165.07 of the statutes is created to read:

AB133-SSA1-SA1,305,2 165.07 Assistant attorney general — public intervenor. (1) The attorney general shall designate an assistant attorney general on the attorney general's staff as public intervenor. Written notices of all proceedings under chs. 30, 31, 281 to 285 and 289 to 299, except s. 281.48, shall be given to the public intervenor and to the administrators of divisions primarily assigned the departmental functions under chs. 29, 281, 285 and 289 to 299, except s. 281.48, by the agency head responsible for such proceedings. A copy of such notice shall also be given to the natural areas preservation council.

AB133-SSA1-SA1,305,10 (2) The public intervenor shall formally intervene in proceedings described in sub. (1) when requested to do so by an administrator of a division primarily assigned the departmental functions under chs. 29, 281, 285 or 289 to 299, except s. 281.48. The public intervenor may, on the public intervenor's own initiative or upon request of any committee of the legislature, formally intervene in all proceedings described in sub. (1) whenever such intervention is needed for the protection of "public rights" in water and other natural resources, as provided in chs. 30 and 31 and defined by the supreme court.