Bill > H1900

This bill, titled "Ensuring patient privacy and control with regard to health information exchanges," aims to strengthen patient privacy by establishing clear rules for the disclosure of health care information. It defines key terms like "authorized representative," "health care information," and "third party" to ensure consistent understanding. The bill mandates that health care practitioners and facilities must obtain written or oral authorization from an individual before disclosing their health care information, with specific requirements for what this authorization must contain, including the right to revoke it. It also outlines circumstances where disclosure is permitted without authorization, such as for treatment purposes, public health reporting, or legal requirements, while strictly prohibiting disclosure for marketing or sales without explicit consent. A significant portion of the bill addresses participation in state-designated statewide health information exchanges, requiring these exchanges to provide patients with mechanisms to opt-out of sharing their information, inform them about the benefits and risks of participation, and maintain secure systems for accessing and managing their data, all while ensuring that non-participation does not lead to denial of treatment or insurance benefits. The bill also establishes enforcement mechanisms, including civil penalties for intentional violations and the right for individuals to pursue legal action if their privacy is violated.