2003 Chapter 153

153.46(2) (2) The entity under contract under s. 153.05 (2m) (a) shall provide to the department and to any other organization or agency the data necessary to fulfill the department's, organization's, or agency's statutory mandates for epidemiological purposes.

153.46(3) (3) The entity under contract under s. 153.05 (2m) (a) may, but is not required to, release hospital-specific, ambulatory surgery center-specific, and hospital or ambulatory surgery center employer-specific data, except in public use data files as specified under sub. (1) (b).

153.46(4) (4) The entity under contract under s. 153.05 (2m) (a) shall, as limited by this section and s. 153.50, provide equal access to the data collected and reports generated by the entity to all requesters that pay the fees under s. 153.65 (2).

153.46(5) (5) The entity under contract under s. 153.05 (2m) (a) shall provide to the department, without charge, claims and provider survey information that is requested by or required to be provided to the department.

153.46(6) (6) No person who purchases a data compilation or report under s. 153.65 (2) may release or sell the data sets so purchased.

153.46 History History: 2003 a. 33 ss. 2094r, 2094x.

153.50 153.50  Protection of patient confidentiality.

153.50(1) (1)  Definitions. In this section:

153.50(1)(b) (b)

153.50(1)(b)1. 1. "Patient-identifiable data", for information submitted by hospitals and ambulatory surgery centers, means all of the following data elements:

153.50(1)(b)1.a. a. Patient medical record or chart number.

153.50(1)(b)1.b. b. Patient control number.

153.50(1)(b)1.c. c. Patient date of birth.

153.50(1)(b)1.d. d. Date of patient admission.

153.50(1)(b)1.e. e. Date of patient discharge.

153.50(1)(b)1.f. f. Date of patient's principal procedure.

153.50(1)(b)1.g. g. Encrypted case identifier.

153.50(1)(b)1.h. h. Insured's policy number.

153.50(1)(b)1.i. i. Patient's employer's name.

153.50(1)(b)1.j. j. Insured's date of birth.

153.50(1)(b)1.k. k. Insured's identification number.

153.50(1)(b)1.L. L. Medicaid resubmission code.

153.50(1)(b)1.m. m. Medicaid prior authorization number.

153.50(1)(b)2. 2. "Patient-identifiable data", for information submitted by health care providers who are not hospitals or ambulatory surgery centers, means all of the following data elements:

153.50(1)(b)2.a. a. Data elements specified in subd. 1. a. to g., L. and m.

153.50(1)(b)2.b. b. Whether the patient's condition is related to employment, and occurrence and place of an auto accident or other accident.

153.50(1)(b)2.c. c. Date of first symptom of current illness, of current injury or of current pregnancy.

153.50(1)(b)2.d. d. First date of the patient's same or similar illness, if any.

153.50(1)(b)2.e. e. Dates that the patient has been unable to work in his or her current occupation.

153.50(1)(b)2.f. f. Dates of receipt by the patient of medical service.

153.50(1)(b)2.g. g. The patient's city, town or village.

153.50(1)(c) (c) "Small number" means a number that is insufficiently large to be statistically significant, as determined by the department.

153.50(3) (3) Measures to ensure protection of patient identity. To ensure that the identity of patients is protected when information obtained by the department or by the entity under contract under s. 153.05 (2m) (a) is disseminated, the department and the entity shall do all of the following:

153.50(3)(a) (a) Aggregate any data element category containing small numbers. The department, in so doing, shall use procedures that are developed by the department and approved by the board and that follow commonly accepted statistical methodology.

153.50(3)(b) (b) Remove and destroy all of the following data elements on the uniform patient billing forms that are received by the department or by the entity under the requirements of this chapter:

153.50(3)(b)1. 1. The patient's name and street address.

153.50(3)(b)2. 2. The insured's name, address and telephone number.

153.50(3)(b)3. 3. Any other insured's name, employer name and date of birth.

153.50(3)(b)4. 4. The signature of the patient or other authorized signature.

153.50(3)(b)5. 5. The signature of the insured or other authorized signature.

153.50(3)(b)6. 6. The signature of the physician.

153.50(3)(b)7. 7. The patient's account number, after use only as verification of data by the department or by the entity.

153.50(3)(c) (c) Develop, for use by purchasers of data under this chapter, a data use agreement that specifies data use restrictions, appropriate uses of data and penalties for misuse of data, and notify prospective and current purchasers of data of the appropriate uses.

153.50(3)(d) (d) Require that a purchaser of data under this chapter sign and have notarized the data use agreement of the department or of the entity specified in par. (c).

153.50(3m) (3m) Health care provider measures to ensure patient identity protection. A health care provider that is not a hospital or ambulatory surgery center shall, before submitting information required by the department under this chapter, convert to a payer category code as specified by the department any names of an insured's payer or other insured's payer.

153.50(4) (4) Release of patient-identifiable data.

153.50(4)(a) (a) Except as specified in par. (b), under the procedures specified in sub. (5), release of patient-identifiable data may be made only to any of the following:

153.50(4)(a)1. 1.

153.50(4)(a)1.a. a. An agent of the department who is responsible for the patient-identifiable data in the department, in order to store the data and ensure the accuracy of the information in the database of the department.

153.50(4)(a)1.b. b. An agent of the entity under contract under s. 153.05 (2m) (a) who is responsible for the patient-identifiable data of the entity, in order to store the data and ensure the accuracy of the information in the database of the entity.

153.50(4)(a)2. 2. A health care provider that is not a hospital or ambulatory surgery center or the agent of such a health care provider, to ensure the accuracy of the information in the database of the department, or a health care provider that is a hospital or ambulatory surgery center or the agent of such a health care provider, to ensure the accuracy of the information in the database of the entity under contract under s. 153.05 (2m) (a).

153.50(4)(a)3. 3. The department, for purposes of epidemiological investigation or, with respect to information from health care providers that are not hospitals or ambulatory surgery centers, to eliminate the need for duplicative databases.

153.50(4)(a)4. 4. An agency or organization that is required by federal or state statute to obtain patient-identifiable data for purposes of epidemiological investigation or to eliminate the need for duplicative databases.

153.50(4)(b) (b) Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, patient-identifiable data that contain a patient's date of birth may be released under par. (a) only under circumstances as specified by rule by the department.

153.50(5) (5) Procedures for release of patient-identifiable data.

153.50(5)(a) (a) The department or an entity that is under contract under s. 153.05 (2m) (a) may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a) unless the authorized person requests the department or entity, in writing, to release the patient-identifiable data. The request shall include all of the following:

153.50(5)(a)1. 1. The requester's name and address.

153.50(5)(a)2. 2. The reason for the request.

153.50(5)(a)3. 3. For a person who is authorized under sub. (4) (a) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.

153.50(5)(a)4. 4. For an agency or organization that is authorized under sub. (4) (a) 4. to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:

153.50(5)(a)4.a. a. The federal or state statutory requirement to obtain the patient-identifiable data.

153.50(5)(a)4.b. b. Any federal or state statutory requirement to uphold the patient confidentiality provisions of this chapter or patient confidentiality provisions that are more restrictive than those of this chapter; or, if the latter evidence is inapplicable, an agreement, in writing, to uphold the patient confidentiality provisions of this chapter.

153.50(5)(b) (b) Upon receipt of a request under par. (a), the department or entity under contract under s. 153.05 (2m) (a), whichever is appropriate, shall, as soon as practicable, comply with the request or notify the requester, in writing, of all of the following:

153.50(5)(b)1. 1. That the department or entity is denying the request in whole or in part.

153.50(5)(b)2. 2. The reason for the denial.

153.50(5)(b)3. 3. For a person who believes that he or she is authorized under sub. (4) (a), the action provided under s. 19.37.

153.50(5m) (5m) Employers not to request patient-identifiable data. Notwithstanding subs. (4) and (5) no employer may request the release of or access to patient-identifiable data of an employee of the employer.

153.50(6) (6) Information submitted.

153.50(6)(a) (a) The department or entity under contract under s. 153.05 (2m) (a) may not require a health care provider submitting health care information under this chapter to include the patient's name, street address or social security number.

153.50(6)(b) (b) The department may not require under this chapter a health care provider that is not a hospital or ambulatory surgery center to submit uniform patient billing forms.

153.50(6)(c) (c) A health care provider that is not a hospital or ambulatory surgery center may not submit any of the following to the department under the requirements of this chapter:

153.50(6)(c)1. 1. The data elements specified under sub. (3) (b).

153.50(6)(c)2. 2. The patient's telephone number.

153.50(6)(c)3. 3. The insured's employer's name or school name.

153.50(6)(c)4. 4. Data regarding insureds other than the patient, other than the payer category code under sub. (3m).

153.50(6)(c)5. 5. The patient's employer's name or school name.

153.50(6)(c)6. 6. The patient's relationship to the insured.

153.50(6)(c)7. 7. The insured's identification number.

153.50(6)(c)8. 8. The insured's policy or group number.

153.50(6)(c)9. 9. The insured's date of birth or sex.

153.50(6)(c)10. 10. The patient's marital, employment or student status.

153.50(6)(d) (d) If a health care provider that is not a hospital or ambulatory surgery center submits a data element that is specified in par. (c) 1. to 10., the department shall immediately return this information to the health care provider or, if discovered later, shall remove and destroy the information.

153.50(6)(e) (e) A health care provider may not submit information that uses any of the following as a patient account number:

153.50(6)(e)1. 1. The patient's social security number or any substantial portion of the patient's social security number.

153.50(6)(e)2. 2. A number that is related to another patient identifying number.

153.50 History History: 1987 a. 399; 1989 a. 18; 1993 a. 16; 1995 a. 27 s. 9126 (19); 1997 a. 27, 231; 1999 a. 9, 185; 2003 a. 33.

153.55 153.55  Protection of confidentiality. Data obtained under this chapter is not subject to inspection, copying or receipt under s. 19.35 (1).

153.55 History History: 1997 a. 231; 1999 a. 9.

153.60 153.60  Assessments to fund operations of department and board.