Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 427 Second Substitute (2024GS)

Sponsor

Rep. Dunnigan, J.

Final action

Governor Signed 3/14/2024

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• imposes penalties on a health care provider or the health care provider's third-party service, if applicable, for failure to respond to a valid request for a patient's protected health information within 30 days and 60 days, respectively, of the request; and
• allows an organization of health care providers to file a statement with the Division of Professional Licensing on behalf of the individual health care providers within the organization.

Every vote on this bill

Bill text

ACCESS TO PROTECTED HEALTH INFORMATION
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: James A. Dunnigan
Senate Sponsor: 
____________
LONG TITLE
General Description:
This bill amends provisions related to a third-party's access to protected health
information.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ imposes penalties on a health care provider or the health care provider's third-party
service, if applicable, for failure to respond to a valid request for a patient's
protected health information within 30 days and 60 days, respectively, of the
request; and
▸ allows an organization of health care providers to file a statement with the Division
of Professional Licensing on behalf of the individual health care providers within
the organization. 
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
78B-5-618
, as last amended by Laws of Utah 2023, Chapters 287, 330
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
78B-5-618
 is amended to read:
78B-5-618.
Patient access to protected health information -- Third-party access to
Protected health information -- Protected health information services -- Fees -- Standard
form.
(1) As used in this section:
(a) "Force majeure event" means an event or circumstance beyond the control of the
health care provider or the health care provider's third-party service, including fires, floods,
earthquakes, acts of God, lockouts, ransomware, or strikes.
(b) "Health care provider" means the same as that term is defined in Section
78B-3-403
.
(c) "History of poor payment" means three or more invoices where payment is more
than 30 days late within a 12-month period.
(d) "Indigent individual" means an individual whose household income is at or below
100% of the federal poverty level as defined in Section 
26B-3-113
.
(e) "Inflation" means the unadjusted Consumer Price Index, as published by the Bureau
of Labor Statistics of the United States Department of Labor, that measures the average
changes in prices of goods and services purchased by urban wage earners and clerical workers.
(f) (i) "Protected health information" means the same as that term is defined in 45
C.F.R. Sec. 160.103.
(ii) "Protected health information" of a patient includes the patient's total outstanding
balance owed to a health care provider.
[
(f)
] 
(g)
 "Qualified claim or appeal" means a claim or appeal under any:
(i) provision of the Social Security Act as defined in Section 
67-11-2
; or
(ii) federal or state financial needs-based benefit program.
[
(g)
] 
(h)
 "Third-party service" means a service that has entered into a contract with a
health care provider to provide patient [
records
] 
protected health information
 on behalf of a
health care provider.
(2) Pursuant to Standards for Privacy of Individually Identifiable Health Information,
45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or
receive a copy of the patient's [
records
] 
protected health information
 from a health care
provider when that health care provider is governed by the provisions of 45 C.F.R., Parts
160 and 164.
(3) When a health care provider is not governed by Standards for Privacy of
Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a
patient's personal representative may inspect or receive a copy of the patient's [
records
]
protected health information
 unless access to the [
records
] 
information
 is restricted by law or
judicial order.
(4) A health care provider who provides a paper or electronic copy of a patient's
[
records
] 
protected health information
 to the patient or the patient's personal representative:
(a) shall provide the copy within the deadlines required by the Health Insurance
Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec.
164.524(b); and
(b) may charge a reasonable cost-based fee provided that the fee includes only the cost
of:
(i) copying, including the cost of supplies for and labor of copying; and
(ii) postage, when the patient or patient's personal representative has requested the copy
be mailed.
(5) (a) Except for [
records
] 
protected health information
 provided under Section
26B-8-411
, a health care provider or a health care provider's third-party service that provides a
copy of a patient's [
records
] 
protected health information
 to a patient's attorney, legal
representative, or other third party authorized to receive [
records
] 
protected health information
:
(i) shall provide the copy within 30 days after receipt of notice;
(ii) shall, if the health care provider or third-party service completing the request will
not provide the copy in accordance with Subsection (5)(a)(i), provide a written response that
includes:
(A) contact information for the individual who the person making the request may
contact to resolve the request; and
(B) the reason for not complying with Subsection (5)(a)(i);
[
(ii)
] 
(iii)
 may charge a reasonable fee for paper or electronic copies, but may not
exceed the following rates:
(A) $30 per request for locating a patient's [
records
] 
protected health information
;
(B) reproduction charges may not exceed 53 cents per page for the first 40 pages and
32 cents per page for each additional page;
(C) the cost of postage when the requester has requested the copy be mailed;
(D) if requested, the person fulfilling the request will certify the record as a duplicate
of the original for a fee of $20; and
(E) any sales tax owed under Title 59, Chapter 12, Sales and Use Tax Act; and
[
(iii)
] 
(iv)
 may charge an expedition fee of $20 if:
(A) the requester's notice explicitly requests an expedited response; and
(B) the person fulfilling the request postmarks or otherwise makes the [
record
]
protected health information
 available electronically within 15 days from the day the person
fulfilling the request receives notice of the request.
(b) If the person fulfilling the request fails to comply with Subsection (5)(a)(ii):
(i) within 30 days after the day on which notice is received by the health care provider
or third-party service fulfilling the request, the person fulfilling the request shall pay $200
toward the patient's total outstanding balance owed to the health care provider:
(A) fulfilling the request; or
(B) with respect to which the third-party service is providing the protected health
information.
(ii) within 60 days after the day on which notice is received by the person fulfilling the
request, the person fulfilling the request shall pay an additional $400 toward the patient's total
outstanding balance owed to the health care provider:
(A) fulfilling the request; or
(B) with respect to which the third-party service is providing the protected health
information; and
[
(b)
] 
(c)
 Notwithstanding the provisions of Subsection [
(5)(a)(ii)
] 
(5)(a)(iii)
 and subject
to Subsection [
(5)(c)
] 
(5)(d)
, in the event the requested records are not postmarked or otherwise
made available electronically by the person fulfilling the request:
(i) within 30 days after the day on which notice is received by the person fulfilling the
request, the person fulfilling the request shall waive 50% of the fee; or
(ii) within 60 days after the day on which notice is received by the person fulfilling the
request, the person fulfilling the request shall provide the requested records free of charge to
the requester.
[
(c)
] 
(d)
 Performance under Subsection [
(5)(b)
] 
(5)(c)
 shall be extended in accordance
with Subsection [
(5)(d)
] 
(5)(e)
 if the person fulfilling the request notifies the requester of:
(i) the occurrence of a force majeure event within 10 days from the day:
(A) the force majeure event occurs; or
(B) the person fulfilling the request receives notice of the request; and
(ii) the termination of the force majeure event within 10 days from the day the force
majeure event terminates.
[
(d)
] 
(e)
 In accordance with Subsection [
(5)(c)
] 
(5)(d)
, for a force majeure event:
(i) that lasts less than eight days, the person fulfilling the request shall, if the [
records
are
] 
protected health information is
 not postmarked or otherwise made available electronically
within:
(A) 30 days of the day the force majeure event ends, waive 50% of the fee for
providing the [
records
] 
protected health information
; and
(B) 60 days of the day the force majeure event ends, waive the entire fee for providing
the [
records
] 
protected health information
;
(ii) that lasts at least eight days but less than 30 days, the person fulfilling the request
shall, if the [
records are
] 
protected health information is
 not postmarked or otherwise made
available electronically within:
(A) 60 days of the day the force majeure event ends, waive 50% of the fee for
providing the [
records
] 
protected health information
; and
(B) 90 days of the day the force majeure event ends, waive the entire fee for providing
the [
records
] 
protected health information
; and
(iii) that lasts more than 30 days, the person fulfilling the request shall, if the [
records
are
] 
protected health information is
 not postmarked or otherwise made available electronically
within:
(A) 90 days of the day the force majeure event ends, waive 50% of the fee for
providing the [
records
] 
protected health information
; and
(B) 120 days of the day the force majeure event ends, waive the entire fee for providing
the [
records
] 
protected health information
.
[
(e)
] 
(f)
 (i) A third-party service may require prepayment before sending [
records
]
protected health information
 for a request under this Subsection (5) if the third-party service:
(A) determines the requester has a history of poor payment; and
(B) notifies the requester, within [
the time periods described in Subsection (5)(b)(i) and
(ii)
] 
days after receipt of notice
, that the [
records
] 
protected health information
 will be sent
as soon as the request has been prepaid.
(ii) The fee reductions described in Subsection [
(5)(d)
] 
(5)(e)
 do not apply if a
third-party service complies with Subsection [
(5)(e)(i)
] 
(5)(f)(i)
.
[
(f)
] 
(g)
 If a third-party service does not possess or have access to the data necessary to
fulfill a request, the third-party service shall notify:
(i) the requester that the request cannot be fulfilled; and
(ii) state the reasons for the third-party service's inability to fulfill the request within 30
days from the day on which the request is received by the third-party service.
[
(g)
] 
(h)
 A patient's attorney, legal representative, or other third party authorized to
receive [
records
] 
protected health information
 may request patient [
records
] 
protected health
information
 directly from a third-party service.
(6) (a) 
(i)
 [
A
] 
Subject to Subsection (6)(a)(ii), a
 health care provider that contracts with
a third-party service to fulfill the health care provider's medical record requests shall file a
statement with the Division of Professional Licensing containing:
[
(i)
] 
(A)
 the name of the third-party service;
[
(ii)
] 
(B)
 the phone number of the third-party service; and
[
(iii)
] 
(C)
 the fax number, email address, website portal address, if applicable, and
mailing address for the third-party service where medical record requests can be sent for
fulfillment.
(ii) If an individual health care provider is an employee or owner of an organization
that is a health care provider and that contracts with a third-party service to fulfill the medical
record requests for the individual health care provider, the organization may file the statement
under Subsection (6)(a)(i) on behalf of the organization's employees and owners.
(b) A health care provider described in Subsection [
(6)(a)
] 
(6)(a)(i)
 shall update the
filing described in Subsection [
(6)(a)
] 
(6)(a)(i)
 as necessary to ensure that the information is
accurate.
(c) The Division of Professional Licensing shall develop a form for a health care
provider to complete that provides the information required by Subsection [
(6)(a)
] 
(6)(a)(i)
.
(d) The Division of Professional Licensing shall:
(i) maintain an index of statements described in Subsection [
(6)(a)
] 
(6)(a)(i)
 arranged
alphabetically by entity; and
(ii) make the index available to the public electronically on the Division of
Professional Licensing's website.
(7) A health care provider or the health care provider's third-party service shall deliver
the [
medical records
] 
protected health information
 in the electronic medium customarily used
by the person fulfilling the request or in a universally readable image such as portable
document format:
(a) if the patient, patient's personal representative, or a third party authorized to receive
the [
records
] 
protected health information
 requests the [
records
] 
protected health information
be delivered in an electronic medium; and
(b) the original medical record is readily producible in an electronic medium.
(8) (a) Except as provided in Subsections (8)(b) through (d), the per page fee in
Subsections (4) and (5) applies to [
medical records
] 
protected health information
 reproduced
electronically or on paper.
(b) The per page fee for producing a copy of [
records
] 
protected health information
 in
an electronic medium shall be 50% of the per page fee otherwise provided in this section,
regardless of whether the original medical [
records are
] 
protected health information is
 stored
in electronic format.
(c) (i) A health care provider or a health care provider's third-party service shall deliver
the [
medical records
] 
protected health information
 in the electronic medium customarily used
by the health care provider or the health care provider's third-party service or in a universally
readable image, such as portable document format, if the patient, patient's personal
representative, patient's attorney, legal representative, or a third party authorized to receive the
[
records
] 
protected health information
, requests the [
records
] 
protected health information
 be
delivered in an electronic medium.
(ii) A person fulfilling the request under Subsection (8)(c)(i):
(A) shall provide the requested information within 30 days; and
(B) may not charge a fee for the electronic copy that exceeds $150 regardless of the
number of pages and regardless of whether the original [
medical records are
] 
protected health
information is
 stored in electronic format.
(d) Subject to Subsection (8)(e), in the event the requested [
records
] 
protected health
information
 under Subsection (8)(c)(i) [
are
] 
is
 not postmarked or otherwise made available
electronically by the person fulfilling the request:
(i) within 30 days after the day notice is received by the person fulfilling the request,
the person fulfilling the request may not charge a fee for the electronic copy that exceeds $75
regardless of the number of pages and regardless of whether the original [
medical records are
]
protected health information is
 stored in electronic format; or
(ii) within 60 days after the day notice is received by the person fulfilling the request,
the person fulfilling the request shall provide the requested [
records
] 
protected health
information
 free of charge to the requester.
(e) Performance under Subsection (8)(d) shall be extended in accordance with
Subsection (8)(f) if the person fulfilling the request notifies the requester of:
(i) the occurrence of a force majeure event within 10 days from the day:
(A) the force majeure event occurs; or
(B) the person fulfilling the request receives notice of the request; and
(ii) the termination of the force majeure event within 10 days from the day the force
majeure event terminates.
(f) In accordance with Subsection (8)(e), for a force majeure event:
(i) that lasts less than eight days, the person fulfilling the request, if the [
records are
]
protected health information is
 not postmarked or otherwise made available electronically
within:
(A) 30 days of the day the force majeure event ends, may not charge a fee for an
electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
the original [
medical records are
] 
protected health information is
 stored in electronic format;
and
(B) 60 days of the day the force majeure event ends, shall waive the entire fee for
providing the [
records
] 
protected health information
;
(ii) that lasts at least eight days but less than 30 days, the person fulfilling the request,
if the [
records are
] 
protected health information is
 not postmarked or otherwise made available
electronically within:
(A) 60 days of the day the force majeure event ends, may not charge a fee for an
electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
the original [
medical records are
] 
protected health information is
 stored in electronic format;
and
(B) 90 days of the day the force majeure event ends, shall waive the entire fee for
providing the [
records
] 
protected health information
; and
(iii) that lasts more than 30 days, the person fulfilling the request, if the [
records are
]
protected health information is
 not postmarked or otherwise made available electronically
within:
(A) 90 days of the day the force majeure event ends, may not charge a fee for an
electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
the original [
medical records are
] 
protected health information is
 stored in electronic format;
and
(B) 120 days of the day the force majeure event ends, shall waive the entire fee for
providing the [
records
] 
protected health information
.
(9) (a) On January 1 of each year, the state treasurer shall adjust the following fees for
inflation:
(i) the fee for providing patient's [
records
] 
protected health information
 under
Subsections [
(5)(a)(ii)(A)
] 
(5)(a)(iii)(A)
 and (B); and
(ii) the maximum amount that may be charged for an electronic copy under Subsection
(8)(c)(ii)(B).
(b) On or before January 30 of each year, the state treasurer shall:
(i) certify the inflation-adjusted fees and maximum amounts calculated under this
section; and
(ii) notify the Administrative Office of the Courts of the information described in
Subsection (9)(b)(i) for posting on the court's website.
(10) Notwithstanding Subsections (4) through (6), if a request for a medical record is
accompanied by documentation of a qualified claim or appeal, a health care provider or the
health care provider's third-party service:
(a) may not charge a fee for the first copy of the record for each date of service that is
necessary to support the qualified claim or appeal in each calendar year;
(b) for a second or subsequent copy in a calendar year of a date of service that is
necessary to support the qualified claim or appeal, may charge a reasonable fee that may not:
(i) exceed 60 cents per page for paper photocopies;
(ii) exceed a reasonable cost for copies of X-ray photographs and other [
health care
records
] 
protected health information
 produced by similar processes;
(iii) include an administrative fee or additional service fee related to the production of
the medical record; or
(iv) exceed the fee provisions for an electronic copy under Subsection (8)(c); and
(c) shall provide the health record within 30 days after the day on which the request is
received by the health care provider.
(11) (a) Except as otherwise provided in Subsections (4) through (6), a health care
provider or the health care provider's third-party service shall waive all fees under this section
for an indigent individual.
(b) A health care provider or the health care provider's third-party service may require
the indigent individual or the indigent individual's authorized representative to provide proof
that the individual is an indigent individual by executing an affidavit.
(c) (i) An indigent individual that receives copies of a medical record at no charge
under this Subsection (11) is limited to one copy for each date of service for each health care
provider, or the health care provider's third-party service, in each calendar year.
(ii) Any request for additional copies in addition to the one copy allowed under
Subsection (11)(c) is subject to the fee provisions described in Subsection (10).
(12) By January 1, 2023, a health care provider and all of the health care provider's
contracted third party health related services shall accept a properly executed form described in
Section 
26B-8-514
.
Section 2. 
Effective date.
This bill takes effect on May 1, 2024.