i. Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center, if the independent review board first reviews and approves the release or if the department promulgates rules that specify circumstances under which the independent review board need not review and approve the release.
j. Calendar quarters of service, except if the department specifies by rule that the number of data elements included in the public use data file is too small to enable protection of patient confidentiality.
k. Information other than patient-identifiable data, as defined in s. 153.50 (1) (b), as approved by the independent review board.
9,2280e
Section 2280e. 153.45 (1) (c) of the statutes is renumbered 153.45 (1) (c) (intro.) and amended to read:
153.45 (1) (c) (intro.) Custom-designed reports containing portions of the data under par. (b). Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, requests under this paragraph for data elements other than those available for public use data files under par. (b) 2., including the patient's month and year of birth, require review and approval by the independent review board before the data elements may be released. Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center may be released only if the independent review board first reviews and approves the release or if the department promulgates rules that specify circumstances under which the independent review board need not review and approve the release. Reports under this paragraph may include the patient's zip code only if at least one of the following applies:
9,2280f
Section 2280f. 153.45 (1) (c) 1. to 4. of the statutes are created to read:
153.45 (1) (c) 1. Other potentially identifying data elements are not released.
2. Population density is sufficient to mask patient identity.
3. Other potentially identifying data elements are grouped to provide population density sufficient to protect identity.
4. Multiple years of data elements are added to protect identity.
9,2280g
Section 2280g. 153.45 (6) of the statutes is created to read:
153.45 (6) The department may not sell or distribute data bases of information, from health care providers who are not hospitals or ambulatory surgery centers, that are able to be linked with public use data files, unless first approved by the independent review board.
9,2280ge
Section 2280ge. 153.50 (1) (a) of the statutes is renumbered 153.01 (2m).
9,2280gg
Section 2280gg. 153.50 (1) (b) of the statutes is renumbered 153.50 (1) (b) 1., and 153.50 (1) (b) 1. (intro.), as renumbered, is amended to read:
153.50 (1) (b) 1. (intro.) "Patient-identifiable data", for information submitted by hospitals and ambulatory surgery centers, means all of the following data elements:
9,2280gm
Section 2280gm. 153.50 (1) (b) 2. of the statutes is created to read:
153.50 (1) (b) 2. "Patient-identifiable data", for information submitted by health care providers who are not hospitals or ambulatory surgery centers, means all of the following data elements:
a. Data elements specified in subd. 1. a. to g., L. and m.
b. Whether the patient's condition is related to employment, and occurrence and place of an auto accident or other accident.
c. Date of first symptom of current illness, of current injury or of current pregnancy.
d. First date of patient's same or similar illness, if any.
e. Dates that the patient has been unable to work in his or her current occupation.
f. Dates of receipt by patient of medical service.
g. The patient's city, town or village.
9,2280h
Section 2280h. 153.50 (2) of the statutes is repealed.
9,2280i
Section 2280i. 153.50 (3) (b) 7. of the statutes is created to read:
153.50 (3) (b) 7. The patient's account number, after use only as verification of data by the department.
9,2280j
Section 2280j. 153.50 (3) (c) of the statutes is created to read:
153.50 (3) (c) Develop, for use by purchasers of data under this chapter, a data use agreement that specifies data use restrictions, appropriate uses of data and penalties for misuse of data, and notify prospective and current purchasers of data of the appropriate uses.
9,2280k
Section 2280k. 153.50 (3) (d) of the statutes is created to read:
153.50 (3) (d) Require that a purchaser of data under this chapter sign and have notarized the data use agreement of the department specified in par. (c).
9,2280km
Section 2280km. 153.50 (3m) of the statutes is created to read:
153.50 (3m) Health care provider measures to ensure patient identity protection. A health care provider that is not a hospital or ambulatory surgery center shall, before submitting information required by the department under this chapter, convert to a payer category code as specified by the department any names of an insured's payer or other insured's payer.
9,2280kp
Section 2280kp. 153.50 (4) (intro.) of the statutes is renumbered 153.50 (4) (a) (intro.) and amended to read:
153.50 (4) (a) (intro.) Under Except as specified in par. (b), under the procedures specified in sub. (5), release of patient-identifiable data may be made only to any of the following:
9,2280kq
Section 2280kq. 153.50 (4) (a) of the statutes is repealed.
9,2280kr
Section 2280kr. 153.50 (4) (b) to (e) of the statutes are renumbered 153.50 (4) (a) 1. to 4.
9,2280ks
Section 2280ks. 153.50 (4) (b) of the statutes is created to read:
153.50 (4) (b) Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, patient-identifiable data that contain a patient's date of birth may be released under par. (a) only under circumstances as specified by rule by the department.
9,2280ku
Section 2280ku. 153.50 (5) (a) (intro.) of the statutes is amended to read:
153.50 (5) (a) (intro.) The department may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a), (c), (d) or (e) unless the authorized person requests the department, in writing, to release the patient-identifiable data. The request shall include all of the following:
9,2280kv
Section 2280kv. 153.50 (5) (a) 3. of the statutes is amended to read:
153.50 (5) (a) 3. For a person who is authorized under sub. (4) (a), (c) or (d) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.
9,2280kw
Section 2280kw. 153.50 (5) (a) 4. (intro.) of the statutes is amended to read:
153.50 (5) (a) 4. (intro.) For an entity that is authorized under sub. (4) (e) (a) 4. to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:
9,2280kx
Section 2280kx. 153.50 (5) (b) 3. of the statutes is amended to read:
153.50 (5) (b) 3. For a person who believes that he or she is authorized under sub. (4) (a), the action provided under s. 19.37.
9,2280n
Section 2280n. 153.50 (5m) of the statutes is created to read:
153.50 (5m) Employers not to request patient-identifiable data. Notwithstanding subs. (4) and (5) no employer may request the release of or access to patient-identifiable data of an employe of the employer.
9,2280p
Section 2280p. 153.50 (6) of the statutes is renumbered 153.50 (6) (a).
9,2280q
Section 2280q. 153.50 (6) (b), (c), (d) and (e) of the statutes are created to read:
153.50 (6) (b) The department may not require under this chapter a health care provider that is not a hospital or ambulatory surgery center to submit uniform patient billing forms.
(c) A health care provider that is not a hospital or ambulatory surgery center may not submit any of the following to the department under the requirements of this chapter:
1. The data elements specified under sub. (3) (b).
2. The patient's telephone number.
3. The insured's employer's name or school name.
4. Data regarding insureds other than the patient, other than the payer category code under sub. (3m).
5. The patient's employer's name or school name.
6. The patient's relationship to the insured.
7. The insured's identification number.
8. The insured's policy or group number.
9. The insured's date of birth or sex.
10. The patient's marital, employment or student status.
(d) If a health care provider that is not a hospital or ambulatory surgery center submits a data element that is specified in par. (c) 1. to 10., the department shall immediately return this information to the health care provider or, if discovered later, shall remove and destroy the information.
(e) A health care provider may not submit information that uses any of the following as a patient account number:
1. The patient's social security number or any substantial portion of the patient's social security number.
2. A number that is related to another patient identifying number.
9,2280r
Section 2280r. 153.55 of the statutes is amended to read:
153.55 Protection of health care provider confidentiality. Health care provider-identifiable data Data obtained under this chapter is not subject to inspection, copying or receipt under s. 19.35 (1).
9,2281
Section
2281. 153.60 (1) of the statutes is amended to read:
153.60 (1) The department shall, by the first October 1 after the commencement of each fiscal year, estimate the total amount of expenditures under this chapter for the department and the board for that fiscal year for data collection, data base development and maintenance, generation of data files and standard reports, orientation and training provided under s. 153.05 (9) and maintaining the board. The department shall assess the estimated total amount for that fiscal year less the estimated total amount to be received for purposes of administration of this chapter under s. 20.435 (1) (4) (hi) during the fiscal year, the unencumbered balance of the amount received for purposes of administration of this chapter under s. 20.435 (1) (4) (hi) from the prior fiscal year and the amount in the appropriation account under s. 20.435 (1) (dg) for the fiscal year, to health care providers who are in a class of health care providers from whom the department collects data under this chapter in a manner specified by the department by rule. The department shall obtain approval from the board for the amounts of assessments for health care providers other than hospitals and ambulatory surgery centers. The department shall work together with the department of regulation and licensing to develop a mechanism for collecting assessments from health care providers other than hospitals and ambulatory surgery centers. No health care provider that is not a facility may be assessed under this subsection an amount that exceeds $75 per fiscal year. Each hospital shall pay the assessment on or before December 1. All payments of assessments shall be deposited in the appropriation under s. 20.435 (1) (4) (hg).
9,2282
Section
2282. 153.60 (3) of the statutes is amended to read:
153.60 (3) The department shall, by the first October 1 after the commencement of each fiscal year, estimate the total amount of expenditures required for the collection, database development and maintenance and generation of public data files and standard reports for health care plans that voluntarily agree to supply health care data under s. 153.05 (6r). The department shall assess the estimated total amount for that fiscal year to health care plans in a manner specified by the department by rule and may enter into an agreement with the office of the commissioner of insurance for collection of the assessments. Each health plan that voluntarily agrees to supply this information shall pay the assessments on or before December 1. All payments of assessments shall be deposited in the appropriation under s. 20.435 (1)
(4) (hg) and may be used solely for the purposes of s. 153.05 (6r).
9,2283
Section
2283. 153.65 of the statutes is amended to read:
153.65 Provision of special information; user fees. The department may, but is not required to, provide, upon request from a person, a data compilation or a special report based on the information collected by the department. The department shall establish user fees for the provision of these compilations or reports, payable by the requester, which shall be sufficient to fund the actual necessary and direct cost of the compilation or report. All moneys collected under this section shall be credited to the appropriation under s. 20.435 (1) (4) (hi).
9,2283g
Section 2283g. 153.67 of the statutes is created to read:
153.67 Independent review board. The independent review board shall review any request under s. 153.45 (1) (c) for data elements other than those available for public use data files under s. 153.45 (1) (b). Unless the independent review board approves such a request or unless independent review board approval is not required under rules of the department promulgated under s. 153.45 (1) (c) (intro.), the data elements requested may not be released.
9,2283h
Section 2283h. 153.76 of the statutes is created to read:
153.76 Rule-making by the independent review board. Notwithstanding s. 15.01 (1r), the independent review board may promulgate only those rules that are first reviewed and approved by the board on health care information.
9,2283i
Section 2283i. 153.85 of the statutes is amended to read:
153.85 Civil liability. Any Except as provided in s. 153.86, any person violating s. 153.50 or rules promulgated under s. 153.75 (1) (a) is liable to the patient for actual damages and costs, plus exemplary damages of up to $1,000 for a negligent violation and up to $5,000 for an intentional violation.
9,2283j
Section 2283j. 153.86 of the statutes is created to read:
153.86 Immunity from liability. (1) A health care provider that submits information to the department under this chapter is immune from civil liability for all of the following:
(a) Any act or omission of an employe, official or agent of the health care provider that results in the release of a prohibited data element while submitting data to the department.
(b) Any act or omission of the department that results in the release of data.
(2) The immunity provided under this section does not apply to intentional, wilful or reckless acts or omissions by health care providers.
9,2283k
Section 2283k. 153.90 (1) of the statutes is amended to read:
153.90 (1) Whoever intentionally violates s. 153.45 (5) or 153.50 or rules promulgated under s. 153.75 (1) (a) may be fined not more than $10,000 $15,000 or imprisoned for not more than 9 months one year in the county jail or both.
9,2283m
Section 2283m. 154.17 (1) of the statutes is amended to read:
