SB249: Bill Text

Lastly, the bill increases the penalty for intentional violation of certain limitations on release of health care information and protections of patient confidentiality.

For further information see the state and local fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB249, s. 1 Section 1. 15.195 (6) of the statutes is amended to read:

SB249,5,6 15.195 (6) Board on health care information. There is created a board on health care information which is attached to the department of health and family services under s. 15.03. The board shall consist of 11 members, one of whom shall be a record administrator, registered by the American Medical Record Association, and; at least 2 of whom shall be employer purchasers of health care; and 5 of whom shall be or represent health care providers, including one registered nurse, licensed under s. 441.06, and 2 physicians, as defined in s. 448.01 (5), and 2 representatives of hospitals, as defined in s. 50.33 (2). The State Medical Society of Wisconsin may recommend board membership for 5 physicians, one of whom the governor shall appoint. The members shall be appointed for 4-year terms.

SB249, s. 2 Section 2. 15.195 (9) of the statutes is created to read:

SB249,5,12 15.195 (9) Independent review board. There is created an independent review board that is attached to the department of health and family services under s. 15.03. The board may not include an employe of the department of health and family services and shall consist of the commissioner of insurance or his or her designee and the following members appointed for 4-year terms:

SB249,5,13 (a) A statistician or researcher.

SB249,5,15 (b) A medical ethicist of the University of Wisconsin System or the Medical College of Wisconsin.

SB249,5,16 (c) An expert in issues relating to privacy.

SB249,5,17 (d) A purchaser of health care.

SB249, s. 3 Section 3. 146.84 (3) of the statutes is amended to read:

SB249,5,22 146.84 (3) Discipline of employes. Any person employed by the state, or any political subdivision of the state who violates s. 146.82 or 146.83 , except a health care provider that negligently violates s. 153.50 (6) (c), may be discharged or suspended without pay.

SB249, s. 4 Section 4. 153.45 (1) (b) of the statutes is renumbered 153.45 (1) (b) 1. and amended to read:

SB249,6,7 153.45 (1) (b) 1. Public For information that is submitted by hospitals or ambulatory surgery centers, public use data files which that do not permit the identification of specific patients, employers or health care providers, as defined by rules promulgated by the department. The identification of these groups patients, employers or health care providers shall be protected by all necessary means, including the deletion of patient identifiers and the use of calculated variables and aggregated variables.

SB249, s. 5 Section 5. 153.45 (1) (b) 2. of the statutes is created to read:

SB249,6,20 153.45 (1) (b) 2. For information that is submitted by health care providers other than hospitals or ambulatory surgery centers, public use data files that do not permit the identification of specific patients, employers or health care providers, as defined by rules promulgated by the department. The identification of patients, employers or health care providers shall be protected by all necessary means, including the deletion of patient identifiers; the use of calculated variables and aggregated variables; the specification of counties as to residence, rather than zip codes; the use of 5-year categories for age, rather than exact age; not releasing information concerning a patient's race or ethnicity or dates of admission, discharge, procedures or visits; and masking sensitive diagnoses and procedures by use of larger diagnostic and procedure categories. Public use data files under this subdivision may include only the following:

SB249,6,21 a. The patient's county of residence.

SB249,6,22 b. The payment source, by type.

SB249,6,24 c. The patient's age category, by 5-year intervals up to age 80 and a category of 80 years or older.

SB249,6,25 d. The patient's procedure code.

SB249,7,1 e. The patient's diagnosis code.

SB249,7,2 f. Charges assessed with respect to the procedure code.

SB249,7,4 g. The name and address of the facility in which the patient's services were rendered.

SB249,7,5 h. The patient's sex.

SB249,7,10 i. Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center, if the independent review board first reviews and approves the release or if the department promulgates rules that specify circumstances under which the independent review board need not review and approve the release.

SB249,7,13 j. Calendar quarters of service, except if the department specifies by rule that the number of data elements included in the public use data file is too small to enable protection of patient confidentiality.

SB249,7,15 k. Information other than patient-identifiable data, as defined in s. 153.50 (1) (b), as approved by the independent review board.

SB249, s. 6 Section 6. 153.45 (1) (c) of the statutes is renumbered 153.45 (1) (c) (intro.) and amended to read:

SB249,8,4 153.45 (1) (c) (intro.) Custom-designed reports containing portions of the data under par. (b). Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, requests under this paragraph for data elements other than those available for public use data files under par. (b) 2., including the patient's year of birth, require review and approval by the independent review board before the data elements may be released. Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center may be released only if the independent review board first reviews and approves the release or if the department promulgates rules that specify circumstances under which the independent review board need not review and approve the release. Reports under this paragraph may include the patient's zip code only if at least one of the following applies:

SB249, s. 7 Section 7. 153.45 (1) (c) 1. to 4. of the statutes are created to read:

SB249,8,6 153.45 (1) (c) 1. Other potentially identifying data elements are not released.

SB249,8,7 2. Population density is sufficient to mask patient identity.

SB249,8,9 3. Other potentially identifying data elements are grouped to provide population density sufficient to protect identity.

SB249,8,10 4. Multiple years of data elements are added to protect identity.

SB249, s. 8 Section 8. 153.45 (6) of the statutes is created to read:

SB249,8,15 153.45 (6) The department may not sell or distribute data bases of information, from health care providers who are not hospitals or ambulatory surgery centers, that are able to be linked with public use data files, unless first approved by the independent review board.

SB249, s. 9 Section 9. 153.50 (1) (a) of the statutes is renumbered 153.01 (2m).

SB249, s. 10 Section 10. 153.50 (1) (b) of the statutes is renumbered 153.50 (1) (b) 1., and 153.50 (1) (b) 1. (intro.), as renumbered, is amended to read:

SB249,8,21 153.50 (1) (b) 1. (intro.) "Patient-identifiable data", for information submitted by hospitals and ambulatory surgery centers, means all of the following data elements:

SB249, s. 11 Section 11. 153.50 (1) (b) 2. of the statutes is created to read:

SB249,8,25 153.50 (1) (b) 2. "Patient-identifiable data", for information submitted by health care providers who are not hospitals or ambulatory surgery centers, means all of the following data elements:

SB249,9,1 a. Data elements specified in subd. 1. a. to g., L. and m.

SB249,9,3 b. Whether the patient's condition is related to employment, and occurrence and place of an auto accident or other accident.

SB249,9,5 c. Date of first symptom of current illness, of current injury or of current pregnancy.

SB249,9,6 d. First date of patient's same or similar illness, if any.

SB249,9,8 e. Dates that the patient has been unable to work in his or her current occupation.

SB249,9,9 f. Dates of receipt by patient of medical service.

SB249,9,10 g. The patient's city, town or village.

SB249, s. 12 Section 12. 153.50 (2) of the statutes is repealed.

SB249, s. 13 Section 13. 153.50 (3) (b) 7. of the statutes is created to read:

SB249,9,14 153.50 (3) (b) 7. The patient's account number, after use only as verification of data by the department.

SB249, s. 14 Section 14. 153.50 (3) (c) of the statutes is created to read:

SB249,9,19 153.50 (3) (c) Develop, for use by purchasers of data under this chapter, a data use agreement that specifies data use restrictions, appropriate uses of data and penalties for misuse of data, and notify prospective and current purchasers of data of the appropriate uses.

SB249, s. 15 Section 15. 153.50 (3) (d) of the statutes is created to read:

SB249,9,22 153.50 (3) (d) Require that a purchaser of data under this chapter sign and have notarized the data use agreement of the department specified in par. (c).

SB249, s. 16 Section 16. 153.50 (3m) of the statutes is created to read:

SB249,9,25 153.50 (3m) Health care provider measures to ensure patient identity protection. A health care provider that is not a hospital or ambulatory surgery center shall, before submitting information required by the department under this chapter, convert to a payer category code as specified by the department any names of an insured's payer or other insured's payer.

SB249, s. 17 Section 17. 153.50 (4) (intro.) of the statutes is renumbered 153.50 (4) (am) (intro.) and amended to read:

SB249,10,8 153.50 (4) (am) (intro.) Under Except as specified in par. (bm), under the procedures specified in sub. (5), release of patient-identifiable data may be made only to any of the following:

SB249, s. 18 Section 18. 153.50 (4) (a) of the statutes is repealed.

SB249, s. 19 Section 19. 153.50 (4) (b) to (e) of the statutes are renumbered 153.50 (4) (am) 1. to 4.

SB249, s. 20 Section 20. 153.50 (4) (bm) of the statutes is created to read:

SB249,10,16 153.50 (4) (bm) Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, patient-identifiable data that contains a patient's date of birth may be released under par. (am) only under circumstances as specified by rule by the department.

SB249, s. 21 Section 21. 153.50 (5) (a) (intro.) of the statutes is amended to read:

SB249,10,21 153.50 (5) (a) (intro.) The department may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a), (c), (d) or (e) (am) unless the authorized person requests the department, in writing, to release the patient-identifiable data. The request shall include all of the following:

SB249, s. 22 Section 22. 153.50 (5) (a) 3. of the statutes is amended to read:

SB249,10,25 153.50 (5) (a) 3. For a person who is authorized under sub. (4) (a), (c) or (d) (am) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.

SB249, s. 23 Section 23. 153.50 (5) (a) 4. (intro.) of the statutes is amended to read:

SB249,11,4 153.50 (5) (a) 4. (intro.) For an entity that is authorized under sub. (4) (e) (am) 4. to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:

SB249, s. 24 Section 24. 153.50 (5) (b) 3. of the statutes is amended to read:

SB249,11,7 153.50 (5) (b) 3. For a person who believes that he or she is authorized under sub. (4) (am), the action provided under s. 19.37.

SB249, s. 25 Section 25. 153.50 (6) of the statutes is renumbered 153.50 (6) (a).

SB249, s. 26 Section 26. 153.50 (6) (b), (c), (d) and (e) of the statutes are created to read:

SB249,11,12 153.50 (6) (b) The department may not require under this chapter a health care provider that is not a hospital or ambulatory surgery center to submit uniform patient billing forms.

SB249,11,15 (c) A health care provider that is not a hospital or ambulatory surgery center may not submit any of the following to the department under the requirements of this chapter:

SB249,11,16 1. The data elements specified under sub. (3) (b).

SB249,11,17 2. The patient's telephone number.

SB249,11,18 3. The insured's employer's name or school name.

SB249,11,20 4. Data regarding insureds other than the patient, other than the payer category code under sub. (3m).

SB249,11,21 5. The patient's employer's name or school name.

SB249,11,22 6. The patient's relationship to the insured.

SB249,11,23 7. The insured's identification number.

SB249,11,24 8. The insured's policy or group number.

SB249,11,25 9. The insured's date of birth or sex.

SB249,12,1 10. The patient's marital, employment or student status.

SB249,12,5 (d) If a health care provider that is not a hospital or ambulatory surgery center submits a data element that is specified in par. (c) 1. to 10., the department shall immediately return this information to the health care provider or, if discovered later, shall remove and destroy the information.

SB249,12,7 (e) A health care provider may not submit information that uses any of the following as a patient account number: