Prohibits any person from disclosing health care information or personal information to a person who engages in the business of accessing and compiling information for commercial purposes or whose use of such information will be in connection with the marketing of a product or service without the explicit written authorization of the data subject.
NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A1263
SPONSOR: Ortiz (MS) TITLE OF BILL: An act to amend the public health law, in relation to
restricting the disclosure of health care information
PURPOSE OR GENERAL IDEA OF BILL: To ensure the confidentiality of
health care information.
SUMMARY OF SPECIFIC PROVISIONS: No person shall disclose health care
information or personal information to a person who engages in the busi-
ness of accessing and compiling information for commercial purposes
(e.g. information brokers or information processing organizations) or
whose use of such information will be in connection with the marketing
of a product or service without the explicit written authorization of
the data subject. Such authorization shall be written in plain language;
dated; specify the person to whom the information shall be disclosed;
specify the purpose for the information; specify the length of time such
authorization shall remain valid; and, shall advise the subject that
he/she is entitled to receive a copy of the authorization.
Any agreement to waive these provisions is prohibited. Any person who
knowingly and willfully obtains the records under false pretenses shall
be fined not more than $1000 or imprisoned not more than one year or
both. In addition to or in lieu of any criminal proceeding, whenever
there is a violation, an application may be made by the Attorney General
to secure an injunction to enjoin and restrain the continuance of such
violation. Whenever the court shall determine that a violation has
occurred, the court may impose a civil penalty of not more than $1000
for each violation.
Finally, in addition to the right of action granted to the Attorney
General, any person injured may bring an action to recover his/her own
damages or one hundred dollars, whichever is greater. The court may in
its discretion, increase the damages to an amount not to exceed three
times the actual damages, up to one thousand dollars, if the court finds
the defendant, willingly or knowingly violated the provisions of this
act. Additionally, the court shall award reasonable attorney's fees to a
prevailing plaintiff.
EFFECTS OF PRESENT LAW WHICH THIS BILL WOULD ALTER: The Public Health
Law is amended by adding a new section 18-b.
JUSTIFICATION: Health care information is sensitive and often commer-
cially valuable. With medical data including prescription drug records
becoming universally computerized, the information is being accessed and
sold without the knowledge and consent of the data subject or patient.
These records, which New Yorkers expect to be confidential, can be easi-
ly matched and manipulated with other records and listings by informa-
tion brokers to gain addresses and phone numbers and other data for
direct solicitation and for other purposes. The Office of Technology
Assessment of the u.S. Congress recently raised such issues in a report
entitled "Protecting Privacy in Computerized Medical Information."
THE WALL STREET JOURNAL published a series of articles which describe
abuses of patient prescription drug records. "Certain data-collectors,"
the article underscored, "that pledge total confidentiality sell drug
companies the age, sex--and an ID number--for individual patients."
American consumers should not be held hostage to the promises of certain
disreputable data brokers. Private medical records should remain
private--not sold to the highest bidder for profit.
In addition to data collectors or information brokers, some mail-order
prescription drug companies, third-party automated insurance operations
and computerized office management firms take advantage of their access
to medical information by selling prescription and patient records. This
is a breach of a patient's confidentiality.
Additionally, the AMA, THE WALL STREET JOURNAL and USA TODAY have
described data collectors and market researchers who have provided
computerized programs to health care providers in return for access to
their patient records. The potential for abuse exists.
Patients have divulged information to their health care provider only
for the purpose of diagnosis and treatment. If other uses are to be made
of this data, patients should be accorded the right to provide authori-
zation after being fully informed about the purpose of such disclosure.
Furthermore, it is not uncommon for hospital and other health insti-
tutions to use identifiable patient information to compile mailing lists
for the purpose of selling services through the mail.
As demonstrated in a recent survey conducted by Louis Harris for Equifax
on health information, most people are deeply concerned about the possi-
ble misuse of confidential medical records. Nearly two-thirds of all
those surveyed were concerned that their personal medical information is
currently being seen by many organizations other than those providing
health care. Similarly, 6 out of 10 "leaders" in the health care field,
government and in human resources, believe the lack of medical record
confidentiality is very serious. They believe strong laws are required
to prevent abuse. The majority of the people do not find it acceptable
to have their medical records used without their consent for direct mail
related to medications, medical research or hospital fund raising. Fully
60% said it would be unacceptable to use their medical records for
direct mail by pharmaceutical companies and an even larger 66% said it
would be unacceptable for hospitals to use patient records to solicit
donations.
Enactment of this bill would guarantee to patients the privacy
protections which have been accorded to consumers who rent video rental
and subscribe to cable-tv.
PRIOR LEGISLATIVE HISTORY:
1996 - A.159 Referred to Health
1997/98 - A.66/S.1687 - Referred to Health
1999/00 - A.2163 - Referred to Health
2001/02 - A.5664 - Referred to Health
2003/04 - A.3131 - Referred to Health
2005/06 - A.4217 - Referred to Health
2007/08 - A2136A - Referred to Health
2009/10 - A6407 - Referred to Health
EFFECTIVE DATE: This act shall take effect on the ninetieth day after
it shall have become law.
STATE OF NEW YORK
________________________________________________________________________
1263
2011-2012 Regular Sessions
IN ASSEMBLY(Prefiled)
January 5, 2011
___________
Introduced by M. of A. ORTIZ, DINOWITZ, SCARBOROUGH, COOK, BING --
Multi-Sponsored by -- M. of A. BRENNAN, GALEF, GOTTFRIED, HIKIND,
HOOPER, JACOBS, J. RIVERA, ROBINSON, TOWNS -- read once and referred
to the Committee on Health
AN ACT to amend the public health law, in relation to restricting the
disclosure of health care information
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The public health law is amended by adding a new section
2 18-b to read as follows:
3 § 18-b. Disclosure of health care information. 1. As used in this
4 section:
5 (a) "Subject" means an individual concerning whom health care informa-
6 tion is maintained or possessed.
7 (b) "Health care" means any preventive, diagnostic, therapeutic, reha-
8 bilitative, maintenance or palliative care, counseling, service or
9 procedure provided by a medical professional or medical care facility
10 with respect to a subject's physical or mental condition or affecting
11 the structure or function of the human body or any part thereof, includ-
12 ing but not limited to, banking of blood, sperm, organs or other tissue;
13 and any sale or dispensing of any drug, substance, device, equipment or
14 other item to a subject or for a subject's use, pursuant to a
15 prescription.
16 (c) "Health care information" means any data or information, whether
17 oral or recorded in any form or medium that identifies or can readily be
18 associated with the identity of the subject and relates to the subject's
19 health care; or is obtained in the course of a subject's health care
20 from a medical professional or medical care facility, from the subject,
21 from a member of the subject's family including spouse, parent or legal
22 guardian or an individual with whom the subject has a relationship or
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD03638-01-1
A. 1263 2
1 any patient information as defined in paragraph (e) of subdivision one
2 of section eighteen of this title.
3 (d) "Medical professional" means any person licensed or certified to
4 provide health care services including but not limited to physicians,
5 dentists, clinical psychologists, podiatrists, chiropractors, nurses,
6 optometrists, pharmacists, clinical dietitians, ophthalmologists, phys-
7 ical or occupational therapists, certified social workers or speech
8 therapists.
9 (e) "Medical care facility" means any institution that is licensed to
10 provide health care services including but not limited to hospitals,
11 skilled nursing home facilities, home health agencies, medical clinics,
12 laboratories, rehabilitation agencies, public health agencies or health
13 maintenance organizations.
14 (f) "Personal information" means any individually identifiable infor-
15 mation gathered in connection with health care from which judgments can
16 be made about a subject's character, habits, mode of living, avocations,
17 finances, occupation, general reputation, credit, health condition or
18 other personal characteristics. Personal information includes a
19 subject's name, address and telephone number and "medical care informa-
20 tion".
21 (g) "Person" means any natural person, corporation, association, part-
22 nership or other legal entity.
23 (h) "Commercial purpose" means any purpose which has financial gain as
24 a major objective.
25 2. No person shall disclose health care information or personal infor-
26 mation to a person who engages in the business of accessing and compil-
27 ing information for commercial purpose or whose use of such information
28 will be in connection with the marketing of a product or service without
29 the explicit written authorization of the subject. Such authorization
30 shall be written in plain language; dated; specify the person to whom
31 the health care information or personal information shall be disclosed;
32 specify the purpose for which the health care information or personal
33 information is to be used; specify the length of time such authorization
34 shall remain valid; and shall advise the subject that such person is
35 entitled to receive a copy of the authorization form.
36 3. Any agreement purporting to waive the provisions of this section is
37 hereby prohibited and declared null and void and against public policy.
38 4. In addition to or in lieu of any criminal proceeding available
39 under this section, whenever there shall be a violation of this section,
40 application may be made by the attorney general in the name of the
41 people of the state of New York to a court or justice having jurisdic-
42 tion by a special proceeding to issue an injunction, and upon notice to
43 the defendant of not less than five days, to enjoin and restrain the
44 continuance of such violations; and if it shall appear to the satisfac-
45 tion of the court or justice that the defendant has, in fact, violated
46 this section, an injunction may be issued by such court or justice,
47 enjoining and restraining any further violation, without requiring proof
48 that any person has, in fact, been injured or damaged thereby. In any
49 such proceeding, the court may make allowances to the attorney general
50 as provided in paragraph six of subdivision (a) of section eighty-three
51 hundred three of the civil practice law and rules, and direct restitu-
52 tion. Whenever the court shall determine that a violation of this
53 section has occurred, the court may impose a civil penalty of not more
54 than one thousand dollars for each violation. In connection with any
55 such proposed application, the attorney general is authorized to take
A. 1263 3
1 proof and make a determination of the relevant facts and to issue
2 subpoenas in accordance with the civil practice law and rules.
3 5. Any person who knowingly and willfully obtains health care informa-
4 tion concerning a subject under false pretenses shall, upon conviction,
5 be fined not more than one thousand dollars or imprisoned not more than
6 one year, or both.
7 6. In addition to the right of action granted to the attorney general
8 pursuant to this section, any person who has been injured by a violation
9 of this section may bring an action in his or her name to recover his or
10 her actual damages or one hundred dollars, whichever is greater. The
11 court, may in its discretion, increase the award of damages to an amount
12 not to exceed three times the actual damages, up to one thousand
13 dollars, if the court finds the defendant, willingly or knowingly
14 violated this section.
15 7. The court shall award reasonable attorney's fees to a prevailing
16 plaintiff.
17 8. Nothing in this section shall be construed to prohibit care manage-
18 ment educational communications provided to a patient about the
19 patient's health condition, adherence to a prescribed course of therapy
20 or other information about the drug being dispensed.
21 § 2. This act shall take effect on the ninetieth day after it shall
22 have become a law.
