|
House Engrossed |
|
State of Arizona House of Representatives Fiftieth Legislature Second Regular Session 2012
|
|
HOUSE BILL 2369 |
|
|
|
|
AN ACT
Amending sections 12-2293, 12-2294, 36-470, 36-2525, 36-3295, 36-3801 and 36‑3804, Arizona Revised Statutes; relating to health information.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Section 12-2293, Arizona Revised Statutes, is amended to read:
12-2293. Release of medical records and payment records to patients and health care decision makers; definition
A. Except as provided in subsections B and C of this section, on the written request of a patient or the patient's health care decision maker for access to or copies of the patient's medical records and payment records, the health care provider in possession of the record shall provide access to or copies of the records to the patient or the patient's health care decision maker.
B. A health care provider may deny a request for access to or copies of medical records or payment records if a health professional determines that either:
1. Access by the patient or the patient's health care decision maker is reasonably likely to endanger the life or physical safety of the patient or another person.
2. The records make reference to a person other than a health professional and access by the patient or the patient's health care decision maker is reasonably likely to cause substantial harm to that other person.
3. Access by the patient's health care decision maker is reasonably likely to cause substantial harm to the patient or another person.
4. Access by the patient or the patient's health care decision maker would reveal information obtained under a promise of confidentiality with someone other than a health professional and access would be reasonably likely to reveal the source of the information.
C. A health care provider may deny a request for access to or copies of medical records or payment records if the health care provider determines that either:
1. The information was created or obtained in the course of clinical research and the patient or the patient's health care decision maker agreed to the denial of access when consenting to participate in the research and was informed that the right of access will be reinstated on completion of the research.
2. A health care provider is a correctional institution or is acting under the direction of a correctional institution and access by a patient who is an inmate in the correctional institution would jeopardize the health, safety, security, custody or rehabilitation of the patient or other inmates or the safety of any officer, employee or other person at the correctional institution or of a person who is responsible for transporting the inmate.
D. If the health care provider denies a request for access to or copies of the medical records or payment records, the health care provider must note this determination in the patient's records and provide to the patient or the patient's health care decision maker a written explanation of the reason for the denial of access. The health care provider must release the medical records or payment records information for which there is not a basis to deny access under subsection B of this section.
E. For the purposes of this section, "health professional" has the same meaning prescribed in section 32‑3201.
Sec. 2. Section 12-2294, Arizona Revised Statutes, is amended to read:
12-2294. Release of medical records and payment records to third parties
A. A health care provider shall disclose medical records or payment records, or the information contained in medical records or payment records, without the patient's written authorization as otherwise required by law or when ordered by a court or tribunal of competent jurisdiction.
B. A health care provider may disclose medical records or payment records, or the information contained in medical records or payment records, pursuant to written authorization signed by the patient or the patient's health care decision maker.
C. A health care provider may disclose medical records or payment records or the information contained in medical records or payment records and a clinical laboratory may disclose clinical laboratory results without the written authorization of the patient or the patient's health care decision maker as otherwise authorized by state or federal law, including the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E), or as follows:
1. To health care providers who are currently providing health care to the patient for the purpose of diagnosis or treatment of the patient.
2. To health care providers who have previously provided treatment to the patient, to the extent that the records pertain to the provided treatment.
3. To ambulance attendants as defined in section 36‑2201 for the purpose of providing care to or transferring the patient whose records are requested.
4. To a private agency that accredits health care providers and with whom the health care provider has an agreement requiring the agency to protect the confidentiality of patient information.
5. To a health profession regulatory board as defined in section 32‑3201.
6. To health care providers for the purpose of conducting utilization review, peer review and quality assurance pursuant to section 36‑441, 36‑445, 36‑2402 or 36‑2917.
7. To a person or entity that provides services to the patient's health care providers or clinical laboratories and with whom the health care provider or clinical laboratory has an agreement requiring the person or entity to protect the confidentiality of patient information and as required by the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 164, subpart E.
8. To the legal representative of a health care provider in possession of the medical records or payment records for the purpose of securing legal advice.
9. To the patient's third party payor or the payor's contractor.
10. To the industrial commission of Arizona or parties to an industrial commission claim pursuant to title 23, chapter 6.
D. A health care provider may disclose a deceased patient's medical records or payment records or the information contained in medical records or payment records to the patient's health care decision maker at the time of the patient's death. A health care provider also may disclose a deceased patient's medical records or payment records or the information contained in medical records or payment records to the personal representative or administrator of the estate of a deceased patient, or if a personal representative or administrator has not been appointed, to the following persons in the following order of priority, unless the deceased patient during the deceased patient's lifetime or a person in a higher order of priority has notified the health care provider in writing that the deceased patient opposed the release of the medical records or payment records:
1. The deceased patient's spouse, unless the patient and the patient's spouse were legally separated at the time of the patient's death.
2. The acting trustee of a trust created by the deceased patient either alone or with the deceased patient's spouse if the trust was a revocable inter vivos trust during the deceased patient's lifetime and the deceased patient was a beneficiary of the trust during the deceased patient's lifetime.
3. An adult child of the deceased patient.
4. A parent of the deceased patient.
5. An adult brother or sister of the deceased patient.
6. A guardian or conservator of the deceased patient at the time of the patient's death.
E. A person who receives medical records or payment records pursuant to this section shall not disclose those records without the written authorization of the patient or the patient's health care decision maker, unless otherwise authorized by law.
F. If a health care provider releases a patient's medical records or payment records to a contractor for the purpose of duplicating or disclosing the records on behalf of the health care provider, the contractor shall not disclose any part or all of a patient's medical records or payment records in its custody except as provided in this article. After duplicating or disclosing a patient's medical records or payment records on behalf of a health care provider, a contractor must return the records to the health care provider who released the medical records or payment records to the contractor.
Sec. 3. Section 36-470, Arizona Revised Statutes, is amended to read:
36-470. Examination of specimens; written requests; reports of results; retention of test records
A. Except as otherwise provided, a clinical laboratory shall examine specimens at the authorization of any person licensed pursuant to title 32, chapter 7, 8, 13, 14, 17 or 29 or title 32, chapter 11, article 2, a person licensed to practice medicine or surgery in another state or a person authorized by law or department rules.
B. The result of a test shall be reported to the person who authorized it. A report of results issued from a clinical laboratory shall provide information required by the department by rule. A clinical interpretation, diagnosis or prognosis or suggested treatment other than normal values shall not appear on the laboratory report form, except that a report made by a physician licensed to practice medicine and surgery in this state or another state may include this information.
C. The result of a test may be reported to a health care provider, as defined in section 12‑2291, that has a treatment relationship with a patient, or to a person or entity that provides services to the health care provider and with whom the health care provider or the clinical laboratory has a business associate agreement that requires the person or entity to protect the confidentiality of patient information as required by the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 164, subpart E or to the patient or the patient's health care decision maker.
D. All specimens accepted by a laboratory for specified tests shall be tested on its premises, except that specimens, other than those for proficiency testing purposes, may be forwarded for examination to another laboratory licensed under this article or exempted by section 36‑461, paragraph 1.
E. When the laboratory performing the examination is other than the laboratory accepting the specimen, the report submitted shall include information required by the department by rule.
F. Records involving laboratory services and copies of reports of laboratory tests shall be kept in a manner as prescribed by the department by rule.
G. A person authorized to request clinical laboratory examinations pursuant to this section may direct that a clinical laboratory examine a person's specimens at that person's request if the authorization is given pursuant to department rules and specifies:
1. The name of the person authorized to request an examination and to receive the results of that examination.
2. The type of examinations to be performed by the laboratory.
3. The total number of examinations the authorized person may request.
4. The beginning and expiration dates of the authorization.
5. The identification of the person giving the authorization.
H. The laboratory shall report test results ordered pursuant to subsection G of this section to the person who authorized the test and to the person who requested it.
Sec. 4. Section 36-2525, Arizona Revised Statutes, is amended to read:
36-2525. Prescription orders; labels
A. In addition to requirements in section 32‑1968, pertaining to prescription orders for prescription‑only drugs, the prescription order for a controlled substance shall bear the name, address and federal registration number of the prescriber. A prescription order for a schedule II controlled substance drug other than a hospital drug order for a hospital inpatient shall contain only one drug order per prescription blank. If authorized verbally by the prescriber, the pharmacist may make changes to correct errors or omissions made by the prescriber on the following parts of a written schedule II controlled substance prescription order:
1. The date issued.
2. The strength, dosage form or quantity of drug.
3. The directions for its use.
B. The pharmacist must document on the original prescription order the changes that were made pursuant to the verbal authorization and record the time and date the authorization was granted.
C. A person registered to dispense controlled substances under this chapter must keep and maintain prescription orders for controlled substances as follows:
1. Prescription orders for controlled substances listed in schedules I and II must be maintained in a separate prescription file for controlled substances listed in schedules I and II only.
2. Prescription orders for controlled substances listed in schedules III, IV and V must be maintained either in a separate prescription file for controlled substances listed in schedules III, IV and V only or in a form that allows them to be readily retrievable from the other prescription records of the registrant. For the purposes of this paragraph, "readily retrievable" means that when the prescription is initially filed, the face of the prescription is stamped in red ink in the lower right corner with the letter "C" in a font that is not less than one inch high and that the prescription is filed in the usual consecutively numbered prescription file for noncontrolled substance prescriptions. The requirement to stamp the hard copy prescription with a red "C" is waived if a registrant employs an electronic data processing system or other electronic record keeping system for prescriptions that permits identification by prescription number and retrieval of original documents by prescriber's name, patient's name, drug dispensed and date filled.
D. Except in emergency situations in conformity with subsection E of this section, under the conditions specified in subsections F and G of this section or when dispensed directly by a medical practitioner to an ultimate user, a controlled substance in schedule II shall not be dispensed without either the written prescription order in ink or indelible pencil or typewritten and manually signed by the medical practitioner or an electronic prescription order as prescribed by federal law or regulation. A prescription order for a schedule II substance shall not be dispensed more than ninety days after the date on which the prescription order was issued. A prescription order for a schedule II substance shall not be refilled.
E. In emergency situations, emergency quantities of schedule II substances may be dispensed on an oral prescription order of a medical practitioner. Such an emergency prescription order shall be immediately reduced to writing by the pharmacist and shall contain all the information required for schedule II drugs except for the manual signing of the order by the medical practitioner. Within seven days after authorizing an emergency oral prescription order, the prescribing medical practitioner shall cause a written prescription order manually signed for the emergency quantity prescribed to be delivered to the dispensing pharmacist or an electronic prescription order to be transmitted to the pharmacist. In addition to conforming to other requirements for prescription orders for schedule II substances, it shall indicate electronically or have written on its face "authorization for emergency dispensing" and the date of the oral order. If the prescribing medical practitioner fails to deliver such an emergency prescription order within seven days in conformance with board rules, the pharmacist shall notify the board. Failure of the pharmacist to notify the board shall void the authority conferred by this subsection to dispense without a written, manually‑signed prescription order of a medical practitioner.
F. The following may be transmitted to a pharmacy by facsimile by a patient's medical practitioner or the medical practitioner's agent:
1. A prescription order written for a schedule II controlled substance to be compounded for the direct administration to a patient by parenteral, intravenous, intramuscular, subcutaneous or intraspinal infusion.
2. A prescription order written for any schedule II controlled substance for a resident of a long-term care facility.
3. A prescription order written for a schedule II controlled substance for a patient enrolled in a hospice care program certified or paid for by medicare under title XVIII or a hospice program that is licensed by this state. The medical practitioner or the medical practitioner's agent must note on the prescription that the patient is a hospice patient.
G. A facsimile transmitted pursuant to subsection F of this section is the original written prescription order for purposes of this section and must be maintained as required by subsection C of this section.
H. Except when dispensed directly by a medical practitioner to an ultimate user, a controlled substance included in schedule III or IV that requires a prescription order as determined under state or federal laws shall not be dispensed without a written or oral prescription order of a medical practitioner or an electronic prescription order as prescribed by federal law or regulation. The prescription order shall not be filled or refilled more than six months after the date on which the prescription order was issued. A prescription order authorized to be refilled shall not be refilled more than five times. Additional quantities may only be authorized by the prescribing medical practitioner through issuance of a new prescription order that shall be treated by the pharmacist as a new and separate prescription order.
I. Except when dispensed directly by a medical practitioner to an ultimate user, a controlled substance that is included in schedule V and that requires a prescription order as determined under state or federal laws shall not be dispensed without a written or oral prescription order of a medical practitioner. The prescription order may be refilled as authorized by the prescribing medical practitioner but shall not be filled or refilled more than one year after the date of issuance.
J. A controlled substance that is listed in schedule III, IV or V and that does not require a prescription order as determined under state or federal laws may be dispensed at retail by a pharmacist, a pharmacy intern or a graduate intern under the pharmacist's supervision without a prescription order to a purchaser who is at least eighteen years of age if all of the following are true:
1. It is for a legitimate medical purpose.
2. Not more than two hundred forty cubic centimeters (eight ounces) of any such controlled substance containing opium, nor more than one hundred twenty cubic centimeters (four ounces) of any other such controlled substance, nor more than forty‑eight dosage units of any such controlled substance containing opium, nor more than twenty‑four dosage units of any other controlled substance may be dispensed at retail to the same purchaser in any given forty‑eight hour period.
3. No more than one hundred dosage units of any single active ingredient ephedrine preparation may be sold, offered for sale, bartered, or given away to any one person in any one thirty‑day period.
4. The pharmacist, pharmacy intern or graduate intern requires every purchaser of a controlled substance under this subsection not known to that person to furnish suitable identification, including proof of age where appropriate.
5. A bound record book for dispensing controlled substances under this subsection is maintained by the pharmacist and contains the name and address of the purchaser, the name and quantity of the controlled substance purchased, the date of each purchase and the name or initials of the pharmacist, pharmacy intern or graduate intern who dispensed the substance to the purchaser. Such book shall be maintained in conformity with the record keeping requirements of section 36‑2523.
K. In the absence of a law requiring a prescription for a schedule V controlled substance, the board, by rules, may require, or remove the requirement of, a prescription order for a schedule V controlled substance.
L. The label on a container of a controlled substance directly dispensed by a medical practitioner or pharmacist, not for the immediate administration to the ultimate user, such as a bed patient in a hospital, shall bear the name and address of the dispensing medical practitioner or pharmacist, the serial number, date of dispensing, name of prescriber, name of patient or, if an animal, the name of the owner of the animal and the species of the animal, directions for use and cautionary statements, if any, contained in the prescription order or required by law. If the controlled substance is included in schedule II, III or IV the label shall bear a transfer warning to the effect: "Caution: federal law prohibits the transfer of this drug to any person other than the patient for whom it was prescribed".
M. Controlled substances in schedules II, III, IV and V may be dispensed as electronically transmitted prescriptions if the prescribing medical practitioner is all of the following:
1. Properly registered by the United States drug enforcement administration.
2. Licensed in good standing in the United States jurisdiction in which the medical practitioner practices.
3. Authorized to issue such prescriptions in the jurisdiction in which the medical practitioner is licensed.
M. N. The board, by rule, may provide additional requirements for prescribing and dispensing controlled substances.
Sec. 5. Section 36-3295, Arizona Revised Statutes, is amended to read:
36-3295. Registry information; confidentiality; transfer of information
A. The registry established pursuant to this article is accessible only by entering the file number and password on the internet web site.
B. A. Registrations, file numbers, passwords and any other information maintained by the secretary of state pursuant to this article are confidential and shall not be disclosed to any person other than the person who submitted the document or the person's personal representative or as permitted in subsection B of this section.
C. B. Notwithstanding subsection B, A health care provider, or a person or entity that provides services to a patient's health care provider and with whom the health care provider has a business associate agreement that requires the person or entity to protect the confidentiality of patient information as required by the health insurance portability and accountability act privacy standards, may access the registry and receive a patient's health care directive documents for the provision of health care services by submitting the patient's file number and password.
D. C. The secretary of state shall use information contained in the registry only for purposes prescribed in this article.
E. D. At the request of a person who submitted the document, the secretary of state may transmit the information received regarding the health care directive to the registry system of another jurisdiction as identified by the person.
Sec. 6. Section 36-3801, Arizona Revised Statutes, is amended to read:
36-3801. Definitions
In this chapter, unless the context otherwise requires:
1. "Breach" has the same meaning prescribed in 45 Code of Federal Regulations, part 164, subpart D.
2. "Clinical laboratory" has the same meaning prescribed in section 36‑451.
3. "Health care decision maker" has the same meaning prescribed in section 12‑2291.
4. "Health care provider" has the same meaning prescribed in section 12‑2291.
5. "Health information organization" means an organization that oversees and governs the exchange of individually identifiable health information among organizations according to nationally recognized standards. Health information organization does not include:
(a) A health care provider or an electronic health record maintained by or on behalf of a health care provider and does not include.
(b) Entities that are subject to title 20 or that are health plans as defined in 45 Code of Federal Regulations section 160.103.
(c) The exchange of individually identifiable health information directly between health care providers without a separate organization governing that exchange.
6. "Individual":
(a) Means the person who is the subject of the individually identifiable health information.
(b) Does not include an inmate as defined under the health insurance portability and accountability act privacy standards prescribed in 45 code of federal regulations section 164.501.
7. "Individually identifiable health information" has the same meaning prescribed in the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 160 and part 164, subpart E.
8. "Medical records" has the same meaning prescribed in section 12‑2291.
9. "Opt out" means an individual's written decision that the individual's individually identifiable health information cannot be shared through a health information organization.
10. "Person" has the same meaning prescribed in section 1-215.
11. "Treatment" has the same meaning prescribed in the health insurance portability and accountability act privacy standards, 45 Code of Federal Regulations part 160 and part 164, subpart E.
12. "Written" means in handwriting or through an electronic transaction that meets the requirements of title 44, chapter 26.
Sec. 7. Section 36-3804, Arizona Revised Statutes, is amended to read:
36-3804. Notice of health information practices
A. A health information organization must maintain a written notice of health information practices describing the following:
1. Individually identifiable health information that the health information organization collects about individuals.
2. The categories of persons who have access to information, including individually identifiable health information, through the health information organization.
3. The purposes for which access to the information, including individually identifiable health information, is provided through the health information organization.
4. The individual's right to opt out of participating in the health information organization.
5. An explanation as to how an individual opts out of participating in the health information organization.
B. The notice shall include a statement informing the patient of the right not to choose to keep share the patient's personal individually identifiable health information out of through the health information organization and that this right is protected by article XXVII, section 2, Constitution of Arizona.
C. A health information organization must post its current notice of health information practices on its website in a conspicuous manner.
D. Notwithstanding any other requirement in this section, a health information organization must provide an individual with a copy of the notice of health information practices within thirty days after receiving a written request for that information.
E. A health care provider participating in a health information organization must provide the health information organization's notice of health information practices in at least twelve-point type to the provider's patients before or at the provider's first encounter with a patient, beginning on the first day of the provider's participation in the health information organization. A health care provider must document that it has provided the health information organization's notice of health information practices to a patient and that the patient has received and read and understands the notice. Documentation must be in the form of a signature by the patient indicating the patient has received and read and understands the notice of health information practices and whether the patient chooses to opt out. As technology develops and electronic methods of receiving documentation from the patient exist, the health information organization is permitted to utilize such electronic documentation.
F. If the patient chooses to opt out of the health information organization, the patient's personal individually identifiable health information shall not be accessible through the health information organization no later than thirty days after the patient opts out.
G. If there is a material change to a health information organization's notice of health information practices, a health care provider must redistribute the notice of health information practices at the next point of contact with the patient or in the same manner and within the same time period as is required by 45 Code of Federal Regulations section 164.528 in relation to the health care provider's notice of privacy practices, whichever comes first.