Amendment SSA2-SB315

SB315-SSA2,23,21 (d) If the individual files a statement under par. (c), the insurer shall do all of the following:

SB315-SSA2,23,25 1. File any statement filed by the individual under par. (c) with the recorded personal medical information that is the subject of the request under par. (a) in such a manner that any person reviewing the recorded personal medical information will be aware of and have access to the statement.

SB315-SSA2,24,4 2. In any subsequent disclosure by the insurer of the recorded personal medical information, clearly identify any matter in dispute and provide any statement filed by the individual under par. (c) that relates to the recorded personal medical information along with the information.

SB315-SSA2,24,7 3. Furnish any statement filed by the individual under par. (c) to any person to whom the insurer would have been required to furnish a correction, amendment or fact of deletion under par. (b).

SB315-SSA2,24,11 (e) The requirements under this subsection do not apply to information concerning an individual that relates to, and that is collected in connection with or in reasonable anticipation of, a claim or civil or criminal proceeding involving the individual.

SB315-SSA2,24,15 (5) Disclosure of personal medical information by insurers. Any disclosure by an insurer of personal medical information concerning an individual shall be consistent with the individual's signed disclosure authorization form, unless the disclosure satisfies any of the following:

SB315-SSA2,24,17 (a) Is otherwise authorized by the individual, or by a person who is authorized to consent on behalf of an individual who lacks the capacity to consent.

SB315-SSA2,24,20 (b) Is reasonably related to the protection of the insurer's interests in the assessment of causation, fault or liability or in the detection or prevention of criminal activity, fraud, material misrepresentation or material nondisclosure.

SB315-SSA2,24,23 (c) Is made to an insurance regulatory authority or in response to an administrative or judicial order, including a search warrant or subpoena, that is valid on its face.

SB315-SSA2,24,24 (d) Is otherwise permitted by law.

SB315-SSA2,24,25 (e) Is made for purposes of pursuing a contribution or subrogation claim.

SB315-SSA2,25,4 (f) Is made to a professional peer review organization, bill review organization, health care provider or medical consultant or reviewer for the purpose of reviewing the services, fees, treatment or conduct of a medical care institution or health care provider.

SB315-SSA2,25,6 (g) Is made to a medical care institution or health care provider for any of the following purposes:

SB315-SSA2,25,7 1. Verifying insurance coverage or benefits.

SB315-SSA2,25,9 2. Conducting an operations or services audit to verify the individuals treated by the health care provider or at the medical care institution.

SB315-SSA2,25,14 (h) Is made to a network plan that is offered by an insurer in order to make arrangements for coordinated health care in which personal medical information concerning an individual is available for providing treatment, making payment for health care under the plan and undertaking such plan operations as are necessary to fulfill the contract for provision of coordinated health care.

SB315-SSA2,25,18 (i) Is made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurer's operations or services. Disclosure may be made under this paragraph only if the disclosure is reasonably necessary for the group policyholder to conduct the review or audit.

SB315-SSA2,25,21 (j) Is made for purposes of enabling business decisions to be made regarding the purchase, transfer, merger, reinsurance or sale of all or part of an insurance business.

SB315-SSA2,26,2 (k) Is made for purposes of actuarial or research studies or for accreditation or auditing. With respect to a disclosure made under this paragraph, any materials that allow for the identification of an individual must be returned to the insurer or destroyed as soon as reasonably practicable, and no individual may be identified in any actuarial, research, accreditation or auditing report.

SB315-SSA2,26,4 (L) Is made to the insurer's legal representative for purposes of claims review or legal advice or defense.

SB315-SSA2,26,5 (6) Immunity. (a) A person is not liable to any person for any of the following:

SB315-SSA2,26,6 1. Disclosing personal medical information in accordance with this section.

SB315-SSA2,26,8 2. Furnishing personal medical information to an insurer or insurance support organization in accordance with this section.

SB315-SSA2,26,10 (b) Paragraph (a) does not apply to the disclosure or furnishing of false information with malice or intent to injure any person.

SB315-SSA2,26,14 (7) Obtaining information under false pretenses. Any person who knowingly and wilfully obtains information about an individual from an insurer or insurance support organization under false pretenses may be fined not more than $10,000 or imprisoned for not more than one year in the county jail or both.

SB315-SSA2, s. 62 Section 62. 895.505 of the statutes is created to read:

SB315-SSA2,26,17 895.505 Storage and disposal of records containing personal information. (1) Definitions. In this section:

SB315-SSA2,26,20 (a) "Business" means an organization or enterprise, whether or not operated for profit, including a sole proprietorship, partnership, firm, business trust, joint venture, syndicate, corporation, limited liability company or association.

SB315-SSA2,26,22 (b) "Destruction" means, with respect to a record, permanently rendering the personal information contained in the record incapable of being read.

SB315-SSA2,26,24 (c) "Disposal" means, with respect to a record, ceasing to have control over access to the record.

SB315-SSA2,27,3 (d) "Personal information" means personally identifiable data about the medical or financial condition of a state resident that is not generally considered to be public knowledge, including the individual's social security number.

SB315-SSA2,27,6 (e) "Personally identifiable" means capable of being associated with a particular individual through one or more identifiers or other information or circumstances.

SB315-SSA2,27,9 (f) "Record" means any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

SB315-SSA2,27,13 (2) Storage of records containing personal information. Prior to the disposal of a record under sub. (3), a business shall take all actions that it reasonably believes to be necessary to prevent unauthorized persons from obtaining access to personal information contained in the record.

SB315-SSA2,27,16 (3) Disposal of records containing personal information. A business may not dispose of a record containing personal information unless it does at least one of the following:

SB315-SSA2,27,18 (a) Prior to the disposal of the record, the business shreds, erases or otherwise modifies the record to make the personal information unreadable.

SB315-SSA2,27,21 (b) The business takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record's disposal and the record's destruction.

SB315-SSA2,27,24 (4) Cause of action. Notwithstanding s. 814.04 (1), a business that violates sub. (2) or (3) is liable to any person damaged by the violation for the amount of damages and for reasonable attorney fees.

SB315-SSA2, s. 63 Section 63. 943.30 (5) of the statutes is created to read:

SB315-SSA2,28,2 943.30 (5) (a) In this subsection, "patient health care records" has the meaning given in s. 146.81 (4).

SB315-SSA2,28,7 (b) Whoever, orally or by any written or printed communication, maliciously uses, or threatens to use, the patient health care records of another person, with intent thereby to extort money or any pecuniary advantage, or with intent to compel the person so threatened to do any act against the person's will or omit to do any lawful act, is guilty of a Class D felony.

SB315-SSA2, s. 64 Section 64. Nonstatutory provisions; administration.

SB315-SSA2,28,13 (1) Interagency coordinating council member. Notwithstanding the length of terms of members specified in section 15.107 (7) (intro.) of the statutes, the member appointed to the interagency coordinating council under section 15.107 (7) (g) of the statutes, as created by this act, shall serve for an initial term that expires on July 1, 2003.

SB315-SSA2, s. 65 Section 65. Nonstatutory provisions; health and family services.

SB315-SSA2,28,24 (1) Report and plan on charity care and bad debt services. The department of health and family services shall prepare a report on the feasibility of requiring major health care providers, other than hospitals, to report annually on the services provided as either charity care or bad debt services and to file an annual plan on projected services that will be provided as either charity care or bad debt services, in the same manner as the annual report and plan by hospitals under section 153.20 of the statutes, as affected by this act. By the first day of the 7th month after publication of this act, the department shall submit the report to the legislature in the manner provided under section 13.172 (2) of the statutes, to the board on health care information and to the governor.

SB315-SSA2,29,5 (2) Board on health care information member. Notwithstanding the length of terms specified for the members of the board on health care information under section 15.195 (6) of the statutes, as affected by this act, the 10th initial member appointed under that subsection shall be appointed for a term expiring on May 1, 2002.

SB315-SSA2, s. 66 Section 66. Initial applicability.

SB315-SSA2,29,9 (1) Board on health care information. The treatment of section 15.07 (1) (b) 21. of the statutes first applies to persons appointed to the board on health care information on the effective date of this subsection.

SB315-SSA2,29,16 (2) Disclosure by insurers of personal medical information. If a contract that is affected by section 610.70 of the statutes, as created by this act, that is in effect on the first day of the 13th month beginning after publication and that was not issued or renewed after the effective date of this subsection contains terms or provisions that are inconsistent with the requirements under section 610.70 of the statutes, as created by this act, the treatment of sections 51.30 (4) (a), 146.82 (2) (b) and 610.70 of the statutes first applies to that contract upon renewal.

SB315-SSA2, s. 67 Section 67. Effective dates. This act takes effect on the day after publication, except as follows:

SB315-SSA2,29,20 (1) The treatment of sections 51.30 (4) (a), 146.82 (2) (b) and 610.70 of the statutes takes effect on the first day of the 13th month beginning after publication.

SB315-SSA2,29,22 (2) The treatment of section 895.505 of the statutes takes effect on the first day of the 4th month beginning after publication.

SB315-SSA2,29,23 (End)