Amendment AA28-SB315

LRBa1951/3

DAK:kmg:ijs

1997 - 1998 LEGISLATURE

ASSEMBLY AMENDMENT 28, TO 1997 SENATE BILL 315

March 10, 1998 - Offered by Representative Underheim.

SB315-AA28,1,2 At the locations indicated, amend the bill, as shown by senate substitute amendment 2, as follows:

SB315-AA28,1,3 1. Page 2, line 3: after "records," insert "health care provider confidentiality,".

SB315-AA28,1,5 2. Page 12, line 24: after that line, delete the material inserted by assembly amendment 1.

SB315-AA28,1,8 3. Page 13, line 1: delete lines 1 to 10, as affected by assembly amendment 1, including the material inserted after page 13, line 10, by assembly amendment1, and substitute:

SB315-AA28,1,10 " Section 48m. 153.50 of the statutes, as affected by 1997 Wisconsin Act 27, is repealed and recreated to read:

SB315-AA28,1,12 153.50 Protection of patient confidentiality. (1) Definitions. In this section:

SB315-AA28,2,2 (a) "Data element" means an item of information from a uniform patient billing form.

SB315-AA28,2,3 (b) "Patient-identifiable data" means all of the following data elements:

SB315-AA28,2,4 1. Patient medical record or chart number.

SB315-AA28,2,5 2. Patient control number.

SB315-AA28,2,6 3. Patient date of birth.

SB315-AA28,2,7 4. Date of patient admission.

SB315-AA28,2,8 5. Date of patient discharge.

SB315-AA28,2,9 6. Date of patient's principal procedure.

SB315-AA28,2,10 7. Encrypted case identifier.

SB315-AA28,2,11 8. Insured's policy number.

SB315-AA28,2,12 9. Patient's employer's name.

SB315-AA28,2,13 10. Insured's date of birth.

SB315-AA28,2,14 11. Insured's identification number.

SB315-AA28,2,15 12. Medicaid resubmission code.

SB315-AA28,2,16 13. Medicaid prior authorization number.

SB315-AA28,2,18 (c) "Small number" means a number that is insufficiently large to be statistically significant, as determined by the department.

SB315-AA28,2,21 (2) Prohibition on release. Patient-identifiable data obtained under this chapter is not subject to inspection, copying or receipt under s. 19.35 (1) and may not be released by the department except as provided in sub. (4).

SB315-AA28,2,24 (3) Departmental measures to ensure protection of patient identity. To ensure that the identity of patients is protected when information obtained by the department is disseminated, the department shall do all of the following:

SB315-AA28,3,3 (a) Aggregate any data element category containing small numbers, using procedures that are developed by the department and approved by the board and that follow commonly accepted statistical methodology.

SB315-AA28,3,6 (b) Remove and destroy all of the following data elements on the uniform patient billing forms that are received by the department under the requirements of this chapter:

SB315-AA28,3,7 1. The patient's name and street address.

SB315-AA28,3,8 2. The insured's name, address and telephone number.

SB315-AA28,3,9 3. Any other insured's name, employer name and date of birth.

SB315-AA28,3,10 4. The signature of the patient or other authorized signature.

SB315-AA28,3,11 5. The signature of the insured or other authorized signature.

SB315-AA28,3,12 6. The signature of the physician.

SB315-AA28,3,14 (4) Release of patient-identifiable data. Under the procedures specified in sub. (5), release of patient-identifiable data may be made to any of the following:

SB315-AA28,3,16 (a) The patient or a person granted permission in writing by the patient for release of the patient's patient-identifiable data.

SB315-AA28,3,19 (b) An agent of the department who is responsible for the patient-identifiable data in the department, in order to store the data and ensure the accuracy of the information in the data base of the department.

SB315-AA28,3,21 (c) A health care provider or the agent of a health care provider, to ensure the accuracy of the information in the data base of the department.

SB315-AA28,3,23 (d) The department, for purposes of epidemiological investigation or to eliminate the need for duplicative data bases.

SB315-AA28,4,3 (e) An entity that is required by federal or state statute to obtain patient-identifiable data for purposes of epidemiological investigation or to eliminate the need for duplicative data bases.

SB315-AA28,4,8 (5) Procedures for release of patient-identifiable data. (a) The department may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a), (c), (d) or (e) unless the authorized person requests the department, in writing, to release the patient-identifiable data. The request shall include all of the following:

SB315-AA28,4,9 1. The requester's name and address.

SB315-AA28,4,10 2. The reason for the request.

SB315-AA28,4,13 3. For a person who is authorized under sub. (4) (a), (c) or (d) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.

SB315-AA28,4,15 4. For an entity that is authorized under sub. (4) (e) to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:

SB315-AA28,4,17 a. The federal or state statutory requirement to obtain the patient-identifiable data.

SB315-AA28,4,22 b. Any federal or state statutory requirement to uphold the patient confidentiality provisions of this chapter or patient confidentiality provisions that are more restrictive than those of this chapter; or, if the latter evidence is inapplicable, an agreement, in writing, to uphold the patient confidentiality provisions of this chapter.

SB315-AA28,4,25 (b) Upon receipt of a request under par. (a), the department shall, as soon as practicable, comply with the request or notify the requester, in writing, of all of the following: