Amendment SSA2-SB315

SB315-SSA2,18,4 1. The determination of an individual's eligibility for an insurance coverage, benefit or payment.

SB315-SSA2,18,5 2. The servicing of an insurance application, policy, contract or certificate.

SB315-SSA2,18,14 (e) "Medical care institution" means a facility, as defined in s. 647.01 (4), or any hospital, nursing home, community-based residential facility, county home, county infirmary, county hospital, county mental health center, tuberculosis sanatorium, adult family home, assisted living facility, rural medical center, hospice or other place licensed, certified or approved by the department of health and family services under s. 49.70, 49.71, 49.72, 50.02, 50.03, 50.032, 50.033, 50.034, 50.35, 50.52, 50.90, 51.04, 51.08, 51.09, 58.06, 252.073 or 252.076 or a facility under s. 45.365, 51.05, 51.06 or 252.10 or under ch. 233 or licensed or certified by a county department under s. 50.032 or 50.033.

SB315-SSA2,18,16 (f) 1. "Personal medical information" means information concerning an individual that satisfies all of the following:

SB315-SSA2,18,18 a. Relates to the individual's physical or mental health, medical history or medical treatment.

SB315-SSA2,18,20 b. Is obtained from a health care provider, a medical care institution, the individual or the individual's spouse, parent or legal guardian.

SB315-SSA2,18,24 2. "Personal medical information" does not include information that is obtained from the public records of a governmental authority and that is maintained by an insurer or its representatives for the purpose of insuring title to real property located in this state.

SB315-SSA2,19,3 (2) Disclosure authorization. (a) Any form that is used in connection with an insurance transaction and that authorizes the disclosure of personal medical information about an individual to an insurer shall comply with all of the following:

SB315-SSA2,19,5 1. All instructions and other information contained in the form are presented in plain language.

SB315-SSA2,19,6 2. The form is dated.

SB315-SSA2,19,8 3. The form specifies the types of persons that are authorized to disclose information about the individual.

SB315-SSA2,19,10 4. The form specifies the nature of the information that is authorized to be disclosed.

SB315-SSA2,19,12 5. The form names the insurer, and identifies by generic reference representatives of the insurer, to whom the information is authorized to be disclosed.

SB315-SSA2,19,13 6. The form specifies the purposes for which the information is being obtained.

SB315-SSA2,19,15 7. Subject to par. (b), the form specifies the length of time for which the authorization remains valid.

SB315-SSA2,19,17 8. The form advises that the individual, or an authorized representative of the individual, is entitled to receive a copy of the completed authorization form.

SB315-SSA2,19,22 (b) 1. For an authorization under this subsection that will be used for the purpose of obtaining information in connection with an insurance policy application, an insurance policy reinstatement or a request for a change in policy benefits, the length of time specified in par. (a) 7. may not exceed 30 months from the date on which the authorization is signed.

SB315-SSA2,20,2 2. For an authorization under this subsection that will be used for the purpose of obtaining information in connection with a claim for benefits under an insurance policy, the length of time specified in par. (a) 7. may not exceed the policy term or the pendency of a claim for benefits under the policy, whichever is longer.

SB315-SSA2,20,8 (3) Access to recorded personal medical information. (a) If, after proper identification, an individual or an authorized representative of an individual submits a written request to an insurer for access to recorded personal medical information that concerns the individual and that is in the insurer's possession, within 30 business days after receiving the request the insurer shall do all of the following:

SB315-SSA2,20,11 1. Inform the individual or authorized representative of the nature and substance of the recorded personal medical information in writing, by telephone or by any other means of communication at the discretion of the insurer.

SB315-SSA2,20,18 2. At the option of the individual or authorized representative, permit the individual or authorized representative to inspect and copy the recorded personal medical information, in person and during the insurer's normal business hours, or provide by mail to the individual or authorized representative a copy of the recorded personal medical information. If the recorded personal medical information is in coded form, the insurer shall provide to the individual or authorized representative an accurate written translation in plain language.

SB315-SSA2,20,24 3. Disclose to the individual or authorized representative the identities, if recorded, of any persons to whom the insurer has disclosed the recorded personal medical information within 2 years prior to the request. If the identities are not recorded, the insurer shall disclose to the individual or authorized representative the names of any insurance agents, insurance support organizations or other entities to whom such information is normally disclosed.

SB315-SSA2,21,4 4. Provide to the individual or authorized representative a summary of the procedures by which the individual or authorized representative may request the correction, amendment or deletion of any recorded personal medical information in the possession of the insurer.

SB315-SSA2,21,13 (b) Notwithstanding par. (a), an insurer may, in the insurer's discretion, provide a copy of any recorded personal medical information requested by an individual or authorized representative under par. (a) to a health care provider who is designated by the individual or authorized representative and who is licensed, registered, permitted or certified to provide health care services with respect to the condition to which the information relates. If the insurer chooses to provide the information to the designated health care provider under this paragraph, the insurer shall notify the individual or authorized representative, at the time of disclosure, that the information has been provided to the health care provider.

SB315-SSA2,21,17 (c) An insurer is required to comply with par. (a) or (b) only if the individual or authorized representative provides a reasonable description of the information that is the subject of the request and if the information is reasonably easy to locate and retrieve by the insurer.

SB315-SSA2,21,23 (d) If an insurer receives personal medical information from a health care provider or a medical care institution with instructions restricting disclosure of the information under s. 51.30 (4) (d) 1. to the individual to whom the information relates, the insurer may not disclose the personal medical information to the individual under this subsection, but shall disclose to the individual the identity of the health care provider or a medical care institution that provided the information.

SB315-SSA2,22,3 (e) Any copy of recorded personal medical information provided under par. (a) or (b) shall include the identity of the source of the information if the source is a health care provider or a medical care institution.

SB315-SSA2,22,6 (f) An insurer may charge the individual a reasonable fee to cover the costs incurred in providing a copy of recorded personal medical information under par. (a) or (b).

SB315-SSA2,22,9 (g) The requirements for an insurer under this subsection may be satisfied by another insurer, an insurance agent, an insurance support organization or any other entity authorized by the insurer to act on its behalf.

SB315-SSA2,22,13 (h) The requirements under this subsection do not apply to information concerning an individual that relates to, and that is collected in connection with or in reasonable anticipation of, a claim or civil or criminal proceeding involving the individual.

SB315-SSA2,22,17 (4) Correction, amendment or deletion of recorded personal medical information. (a) Within 30 business days after receiving a written request from an individual to correct, amend or delete any recorded personal medical information that is in the insurer's possession, an insurer shall do either of the following:

SB315-SSA2,22,18 1. Comply with the request.

SB315-SSA2,22,19 2. Notify the individual of all of the following:

SB315-SSA2,22,20 a. That the insurer refuses to comply with the request.

SB315-SSA2,22,21 b. The reasons for the refusal.

SB315-SSA2,22,22 c. That the individual has a right to file a statement as provided in par. (c).

SB315-SSA2,22,25 (b) An insurer that complies with a request under par. (a) shall notify the individual of that compliance in writing and furnish the correction, amendment or fact of deletion to all of the following:

SB315-SSA2,23,3 1. Any person who may have received, within the preceding 2 years, the recorded personal medical information concerning the individual and who is specifically designated by the individual.

SB315-SSA2,23,9 2. Any insurance support organization for which insurers are the primary source of personal medical information and to which the insurer, within the preceding 7 years, has systematically provided recorded personal medical information. This subdivision does not apply to an insurance support organization that does not maintain recorded personal medical information concerning the individual.

SB315-SSA2,23,11 3. Any insurance support organization that furnished to the insurer the personal medical information that has been corrected, amended or deleted.

SB315-SSA2,23,14 (c) If an insurer refuses to comply with a request under par. (a) 1., the individual making the request may file with the insurer, an insurance agent or an insurance support organization any of the following:

SB315-SSA2,23,16 1. A concise statement setting forth the information that the individual believes to be correct, relevant or fair.

SB315-SSA2,23,19 2. A concise statement setting forth the reasons why the individual disagrees with the insurer's refusal to correct, amend or delete the recorded personal medical information.

SB315-SSA2,23,21 (d) If the individual files a statement under par. (c), the insurer shall do all of the following:

SB315-SSA2,23,25 1. File any statement filed by the individual under par. (c) with the recorded personal medical information that is the subject of the request under par. (a) in such a manner that any person reviewing the recorded personal medical information will be aware of and have access to the statement.

SB315-SSA2,24,4 2. In any subsequent disclosure by the insurer of the recorded personal medical information, clearly identify any matter in dispute and provide any statement filed by the individual under par. (c) that relates to the recorded personal medical information along with the information.

SB315-SSA2,24,7 3. Furnish any statement filed by the individual under par. (c) to any person to whom the insurer would have been required to furnish a correction, amendment or fact of deletion under par. (b).

SB315-SSA2,24,11 (e) The requirements under this subsection do not apply to information concerning an individual that relates to, and that is collected in connection with or in reasonable anticipation of, a claim or civil or criminal proceeding involving the individual.

SB315-SSA2,24,15 (5) Disclosure of personal medical information by insurers. Any disclosure by an insurer of personal medical information concerning an individual shall be consistent with the individual's signed disclosure authorization form, unless the disclosure satisfies any of the following:

SB315-SSA2,24,17 (a) Is otherwise authorized by the individual, or by a person who is authorized to consent on behalf of an individual who lacks the capacity to consent.

SB315-SSA2,24,20 (b) Is reasonably related to the protection of the insurer's interests in the assessment of causation, fault or liability or in the detection or prevention of criminal activity, fraud, material misrepresentation or material nondisclosure.

SB315-SSA2,24,23 (c) Is made to an insurance regulatory authority or in response to an administrative or judicial order, including a search warrant or subpoena, that is valid on its face.

SB315-SSA2,24,24 (d) Is otherwise permitted by law.

SB315-SSA2,24,25 (e) Is made for purposes of pursuing a contribution or subrogation claim.

SB315-SSA2,25,4 (f) Is made to a professional peer review organization, bill review organization, health care provider or medical consultant or reviewer for the purpose of reviewing the services, fees, treatment or conduct of a medical care institution or health care provider.

SB315-SSA2,25,6 (g) Is made to a medical care institution or health care provider for any of the following purposes:

SB315-SSA2,25,7 1. Verifying insurance coverage or benefits.

SB315-SSA2,25,9 2. Conducting an operations or services audit to verify the individuals treated by the health care provider or at the medical care institution.

SB315-SSA2,25,14 (h) Is made to a network plan that is offered by an insurer in order to make arrangements for coordinated health care in which personal medical information concerning an individual is available for providing treatment, making payment for health care under the plan and undertaking such plan operations as are necessary to fulfill the contract for provision of coordinated health care.

SB315-SSA2,25,18 (i) Is made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurer's operations or services. Disclosure may be made under this paragraph only if the disclosure is reasonably necessary for the group policyholder to conduct the review or audit.

SB315-SSA2,25,21 (j) Is made for purposes of enabling business decisions to be made regarding the purchase, transfer, merger, reinsurance or sale of all or part of an insurance business.

SB315-SSA2,26,2 (k) Is made for purposes of actuarial or research studies or for accreditation or auditing. With respect to a disclosure made under this paragraph, any materials that allow for the identification of an individual must be returned to the insurer or destroyed as soon as reasonably practicable, and no individual may be identified in any actuarial, research, accreditation or auditing report.

SB315-SSA2,26,4 (L) Is made to the insurer's legal representative for purposes of claims review or legal advice or defense.

SB315-SSA2,26,5 (6) Immunity. (a) A person is not liable to any person for any of the following:

SB315-SSA2,26,6 1. Disclosing personal medical information in accordance with this section.

SB315-SSA2,26,8 2. Furnishing personal medical information to an insurer or insurance support organization in accordance with this section.

SB315-SSA2,26,10 (b) Paragraph (a) does not apply to the disclosure or furnishing of false information with malice or intent to injure any person.

SB315-SSA2,26,14 (7) Obtaining information under false pretenses. Any person who knowingly and wilfully obtains information about an individual from an insurer or insurance support organization under false pretenses may be fined not more than $10,000 or imprisoned for not more than one year in the county jail or both.

SB315-SSA2, s. 62 Section 62. 895.505 of the statutes is created to read:

SB315-SSA2,26,17 895.505 Storage and disposal of records containing personal information. (1) Definitions. In this section:

SB315-SSA2,26,20 (a) "Business" means an organization or enterprise, whether or not operated for profit, including a sole proprietorship, partnership, firm, business trust, joint venture, syndicate, corporation, limited liability company or association.

SB315-SSA2,26,22 (b) "Destruction" means, with respect to a record, permanently rendering the personal information contained in the record incapable of being read.

SB315-SSA2,26,24 (c) "Disposal" means, with respect to a record, ceasing to have control over access to the record.

SB315-SSA2,27,3 (d) "Personal information" means personally identifiable data about the medical or financial condition of a state resident that is not generally considered to be public knowledge, including the individual's social security number.

SB315-SSA2,27,6 (e) "Personally identifiable" means capable of being associated with a particular individual through one or more identifiers or other information or circumstances.

SB315-SSA2,27,9 (f) "Record" means any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

SB315-SSA2,27,13 (2) Storage of records containing personal information. Prior to the disposal of a record under sub. (3), a business shall take all actions that it reasonably believes to be necessary to prevent unauthorized persons from obtaining access to personal information contained in the record.

SB315-SSA2,27,16 (3) Disposal of records containing personal information. A business may not dispose of a record containing personal information unless it does at least one of the following:

SB315-SSA2,27,18 (a) Prior to the disposal of the record, the business shreds, erases or otherwise modifies the record to make the personal information unreadable.

SB315-SSA2,27,21 (b) The business takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record's disposal and the record's destruction.

SB315-SSA2,27,24 (4) Cause of action. Notwithstanding s. 814.04 (1), a business that violates sub. (2) or (3) is liable to any person damaged by the violation for the amount of damages and for reasonable attorney fees.

SB315-SSA2, s. 63 Section 63. 943.30 (5) of the statutes is created to read:

SB315-SSA2,28,2 943.30 (5) (a) In this subsection, "patient health care records" has the meaning given in s. 146.81 (4).

SB315-SSA2,28,7 (b) Whoever, orally or by any written or printed communication, maliciously uses, or threatens to use, the patient health care records of another person, with intent thereby to extort money or any pecuniary advantage, or with intent to compel the person so threatened to do any act against the person's will or omit to do any lawful act, is guilty of a Class D felony.

SB315-SSA2, s. 64 Section 64. Nonstatutory provisions; administration.

SB315-SSA2,28,13 (1) Interagency coordinating council member. Notwithstanding the length of terms of members specified in section 15.107 (7) (intro.) of the statutes, the member appointed to the interagency coordinating council under section 15.107 (7) (g) of the statutes, as created by this act, shall serve for an initial term that expires on July 1, 2003.

SB315-SSA2, s. 65 Section 65. Nonstatutory provisions; health and family services.

SB315-SSA2,28,24 (1) Report and plan on charity care and bad debt services. The department of health and family services shall prepare a report on the feasibility of requiring major health care providers, other than hospitals, to report annually on the services provided as either charity care or bad debt services and to file an annual plan on projected services that will be provided as either charity care or bad debt services, in the same manner as the annual report and plan by hospitals under section 153.20 of the statutes, as affected by this act. By the first day of the 7th month after publication of this act, the department shall submit the report to the legislature in the manner provided under section 13.172 (2) of the statutes, to the board on health care information and to the governor.

SB315-SSA2,29,5 (2) Board on health care information member. Notwithstanding the length of terms specified for the members of the board on health care information under section 15.195 (6) of the statutes, as affected by this act, the 10th initial member appointed under that subsection shall be appointed for a term expiring on May 1, 2002.