GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2011
SESSION LAW 2011-314
SENATE BILL 607
AN ACT to conform medical record confidentiality laws.
The General Assembly of North Carolina enacts:
SECTION 1. G.S. 90-85.36 reads as rewritten:
"§ 90-85.36. Availability of pharmacy records.
(a) Except as provided in subsections (b) and (c) below, written or electronic prescription orders on file in a pharmacy or other place where prescriptions are dispensed are not public records and any person having custody of or access to the prescription orders may divulge the contents or provide a copy only to the following persons:
(1) An adult patient for whom the prescription was issued or a person who is legally appointed guardian of that person;
(2) An emancipated minor patient for whom the prescription order was issued or a person who is the legally appointed guardian of that patient;
(3) An unemancipated minor patient for whom the prescription order was issued when the minor's consent is sufficient to authorize treatment of the condition for which the prescription was issued;
(4) A parent or person in loco parentis of an unemancipated minor patient for whom the prescription order was issued when the minor's consent is not sufficient to authorize treatment for the condition for which the prescription is issued;
(5) The licensed practitioner who issued the prescription;
(6) The licensed practitioner who is treating the patient for whom the prescription was issued;
(7) A pharmacist who is providing pharmacy services to the patient for whom the prescription was issued;
(8) Anyone who presents a written authorization for the release of pharmacy information signed by the patient or his legal representative;
(9) Any person authorized by subpoena, court order or statute;
(10) Any firm, association, partnership, business trust, corporation or company charged by law or by contract with the responsibility of providing for or paying for medical care for the patient for whom the prescription order was issued;
(11) A member or designated employee of the Board;
(12) The executor, administrator or spouse of a deceased patient for whom the prescription order was issued;
(13) Researchers and surveyors
who have approval from the Board. The Board shall issue this approval when it
determines that there are adequate safeguards to protect the confidentiality of
the information contained in the prescription orders and that the researchers
or surveyors will not publicly disclose any information that identifies any
person; or
(14) The person owning the
pharmacy or his authorized agent.agent; or
(15) A HIPAA covered entity, or business associate described in 45 C.F.R. § 160.103, or a health care provider who is not a covered entity, for purposes of treatment, payment, or health care operations to the extent that disclosure is permitted or required by applicable State or federal law.
(b) A pharmacist may disclose any information to any person only when he reasonably determines that the disclosure is necessary to protect the life or health of any person.
(c) Records required to be kept by G.S. 90-93(d) (Schedule V) are not public records and shall be disclosed at the pharmacist's discretion."
SECTION 2.(a) G.S. 122C-52(b) reads as rewritten:
"(b) Except as authorized
by G.S. 122C-53 through G.S. 122C-56, no individual having access to
confidential information may disclose this information.information, provided,
however, a HIPAA covered entity or business associate receiving confidential
information that has been disclosed pursuant to G.S. 122C-53 through
G.S. 122C-56 may use and disclose such information as permitted or
required under 45 Code of Federal Regulations Part 164, Subpart E."
SECTION 2.(b) G.S. 122C-55 reads as rewritten:
"§ 122C-55. Exceptions; care and treatment.
(a) Any area or
State facility or the psychiatric service of the University of North
Carolina Hospitals at Chapel Hill may share confidential information
regarding any client of that facility with any other area or State facility
or the psychiatric service of the University of North Carolina Hospitals at
Chapel Hill when necessary to coordinate appropriate and effective care,
treatment or habilitation of the client. For the purposes of this subsection,section,
coordinate means the provision, coordination, or management of mental health,
developmental disabilities, and substance abuse services and other health or
related services by one or more facilities and includes the referral of a
client from one facility to another.
(a1) Any facility may share
confidential information regarding any client of that facility with the
Secretary, and the Secretary may share confidential information regarding any
client with a facility when necessary to conduct quality assessment and
improvement activities or to coordinate appropriate and effective care,
treatment or habilitation of the client. For purposes of this subsectionsubsection,
subsection (a6), and subsection (a6)(a7) of this section, the
purposes or activities for which confidential information may be disclosed
include, but are not limited to, case management and care coordination, disease
management, outcomes evaluation, the development of clinical guidelines and
protocols, the development of care management plans and systems, population-based
activities relating to improving or reducing health care costs, and the
provision, coordination, or management of mental health, developmental
disabilities, and substance abuse services and other health or related
services. As used in this section, "facility" includes an LME and
"Secretary" includes the Department's Community Care of North
Carolina ProgramProgram, or other primary care case management
programs that contract with the Department to provide a primary care case
management program for recipients of publicly funded health and related
services.
(a2) Any area or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with any other area facility or State facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill when necessary to conduct payment activities relating to an individual served by the facility. Payment activities are activities undertaken by a facility to obtain or provide reimbursement for the provision of services and may include, but are not limited to, determinations of eligibility or coverage, coordination of benefits, determinations of cost-sharing amounts, claims management, claims processing, claims adjudication, claims appeals, billing and collection activities, medical necessity reviews, utilization management and review, precertification and preauthorization of services, concurrent and retrospective review of services, and appeals related to utilization management and review.
(a3) Whenever there is reason to believe that a client is eligible for benefits through a Department program, any State or area facility or the psychiatric service of the University of North Carolina Hospitals at Chapel Hill may share confidential information regarding any client of that facility with the Secretary, and the Secretary may share confidential information regarding any client with an area facility or State facility or the psychiatric services of the University of North Carolina Hospitals at Chapel Hill. Disclosure is limited to that information necessary to establish initial eligibility for benefits, determine continued eligibility over time, and obtain reimbursement for the costs of services provided to the client.
(a4) An area authority or county program may share confidential information regarding any client with any area facility, and any area facility may share confidential information regarding any client of that facility with the area authority or county program, when the area authority or county program determines the disclosure is necessary to develop, manage, monitor, or evaluate the area authority's or county program's network of qualified providers as provided in G.S. 122C-115.2(b)(1) b., G.S. 122C-141(a), the State Plan, and rules of the Secretary. For the purposes of this subsection, the purposes or activities for which confidential information may be disclosed include, but are not limited to, quality assessment and improvement activities, provider accreditation and staff credentialing, developing contracts and negotiating rates, investigating and responding to client grievances and complaints, evaluating practitioner and provider performance, auditing functions, on-site monitoring, conducting consumer satisfaction studies, and collecting and analyzing performance data.
(a5) Any area facility may share confidential information with any other area facility regarding an applicant when necessary to determine whether the applicant is eligible for area facility services. For the purpose of this subsection, the term "applicant" means an individual who contacts an area facility for services.
(a6) When necessary to conduct
quality assessment and improvement activities or to coordinate appropriate and
effective care, treatment, or habilitation of the client, a DHHS primary
care case managerthe Department's Community Care of North Carolina
Program, or other primary care case management program, may disclose
confidential information acquired pursuant to subsection (a1) of this section
to a health care provider or other entity that has entered into a written agreement
with the Department's Community Care of North Carolina Program, or other
primary care case management program, to participate in the care management
support network and systems developed and maintained by the primary care case
manager for the purpose of coordinating and improving the quality of care for
recipients of publicly funded health and related services. Health care
providers and other entities receiving confidential information from the
Department's Community Care of North Carolina Program or other primary care
case management program pursuant to this subsection may use and disclose the
information as authorized by G.S. 122C-53 through G.S. 122C-56 or as
permitted or required by other applicable State or federal law.that has
been disclosed pursuant to this subsection may use and disclose the information
as permitted or required under 45 Code of Federal Regulations Part 164, Subpart
E.
(a7) A facility may share confidential information with one or more HIPAA covered entities or business associates for the same purposes set forth in subsection (a1) of this section. Before making disclosures under this subsection, the facility shall inform the client or his legally responsible person that the facility may make such disclosures unless the client or his legally responsible person objects in writing or signs a non-disclosure form that shall be supplied by the facility. If the client or his legally responsible person objects in writing or signs a non-disclosure form, the disclosures otherwise permitted by this subsection are prohibited. A covered entity or business associate receiving confidential information that has been disclosed by a facility pursuant to this subsection may use and disclose the information as permitted or required under 45 Code of Federal Regulations Part 164, Subpart E; provided however, that such confidential information shall not be used or disclosed for discriminatory purposes including, without limitation, employment discrimination, medical insurance coverage or rate discrimination, or discrimination by law enforcement officers.
…."
SECTION 3. G.S. 130A-12 reads as rewritten:
"§ 130A-12. Confidentiality of records.
All records containing privileged patient medical
information, information protected under 45 Code of Federal Regulations Parts
160 and 164, and information collected under the authority of Part 4 of Article
5 of this Chapter that are in the possession of the Department of Health and
Human Services, the Department of Environment and Natural Resources, or local
health departments shall be confidential and shall not be public records
pursuant to G.S. 132-1. Information contained in the records may be
disclosed only when disclosure is authorized or required by State or federal
law. Notwithstanding G.S. 8-53 or G.S. 130A-143,G.S. 8-53,
the information contained in the records may be disclosed for purposes of
treatment, payment, research, or health care operations.operations
to the extent that disclosure is permitted under 45 Code of Federal Regulations
§§ 164.506 and 164.512(i). For purposes of this section, the terms
"treatment," "payment," "research," and
"health care operations" have the meanings given those terms in 45
Code of Federal Regulations § 164.501."
SECTION 4. G.S. 130A-143 reads as rewritten:
"§ 130A-143. Confidentiality of records.
All information and records, whether publicly or privately maintained, that identify a person who has AIDS virus infection or who has or may have a disease or condition required to be reported pursuant to the provisions of this Article shall be strictly confidential. This information shall not be released or made public except under the following circumstances:
(1) Release is made of specific medical or epidemiological information for statistical purposes in a way that no person can be identified;
(2) Release is made of all or part of the medical record with the written consent of the person or persons identified or their guardian;
(3) Release is made to
health care personnel providing medical care to the patient;for purposes
of treatment, payment, research, or health care operations to the extent that
disclosure is permitted under 45 Code of Federal Regulations §§ 164.506 and
164.512(i). For purposes of this section, the terms 'treatment,' 'payment,'
'research,' and 'health care operations' have the meaning given those terms in
45 Code of Federal Regulations § 164.501;
(4) Release is necessary to protect the public health and is made as provided by the Commission in its rules regarding control measures for communicable diseases and conditions;
(5) Release is made pursuant to other provisions of this Article;
(6) Release is made pursuant to subpoena or court order. Upon request of the person identified in the record, the record shall be reviewed in camera. In the trial, the trial judge may, during the taking of testimony concerning such information, exclude from the courtroom all persons except the officers of the court, the parties and those engaged in the trial of the case;
(7) Release is made by the Department or a local health department to a court or a law enforcement official for the purpose of enforcing this Article or Article 22 of this Chapter, or investigating a terrorist incident using nuclear, biological, or chemical agents. A law enforcement official who receives the information shall not disclose it further, except (i) when necessary to enforce this Article or Article 22 of this Chapter, or when necessary to conduct an investigation of a terrorist incident using nuclear, biological, or chemical agents, or (ii) when the Department or a local health department seeks the assistance of the law enforcement official in preventing or controlling the spread of the disease or condition and expressly authorizes the disclosure as necessary for that purpose;
(8) Release is made by the Department or a local health department to another federal, state or local public health agency for the purpose of preventing or controlling the spread of a communicable disease or communicable condition;
(9) Release is made by the Department for bona fide research purposes. The Commission shall adopt rules providing for the use of the information for research purposes;
(10) Release is made pursuant to G.S. 130A-144(b); or
(11) Release is made pursuant to any other provisions of law that specifically authorize or require the release of information or records related to AIDS."
SECTION 5. G.S. 131D-21 reads as rewritten:
"§ 131D-21. Declaration of residents' rights.
Each facility shall treat its residents in accordance with the provisions of this Article. Every resident shall have the following rights:
(1) To be treated with respect, consideration, dignity, and full recognition of his or her individuality and right to privacy.
(2) To receive care and services which are adequate, appropriate, and in compliance with relevant federal and State laws and rules and regulations.
(3) To receive upon admission and during his or her stay a written statement of the services provided by the facility and the charges for these services.
(4) To be free of mental and physical abuse, neglect, and exploitation.
(5) Except in emergencies, to be free from chemical and physical restraint unless authorized for a specified period of time by a physician according to clear and indicated medical need.
(6) To have his or
her personal and medical records kept confidential and not disclosed without
the written consent of the individual or guardian, which consent shall specify
to whom the disclosure may be made, except as permitted or required
by applicable State or federal statute or regulation or by third party
contract. It is not the intent of this section to prohibit access to medical
records by the treating physician except when the individual objects in
writing. Records may also be disclosed without the written consent of the
individual to agencies, institutions or individuals which are providing
emergency medical services to the individual. Disclosure of information shall
be limited to that which is necessary to meet the emergency.law.
(7) To receive a reasonable response to his or her requests from the facility administrator and staff.
(8) To associate and communicate privately and without restriction with people and groups of his or her own choice on his or her own or their initiative at any reasonable hour.
(9) To have access at any reasonable hour to a telephone where he or she may speak privately.
(10) To send and receive mail promptly and unopened, unless the resident requests that someone open and read mail, and to have access at his or her expense to writing instruments, stationery, and postage.
(11) To be encouraged to exercise his or her rights as a resident and citizen, and to be permitted to make complaints and suggestions without fear of coercion or retaliation.
(12) To have and use his or her own possessions where reasonable and have an accessible, lockable space provided for security of personal valuables. This space shall be accessible only to the resident, the administrator, or supervisor-in-charge.
(13) To manage his or her personal needs funds unless such authority has been delegated to another. If authority to manage personal needs funds has been delegated to the facility, the resident has the right to examine the account at any time.
(14) To be notified when the facility is issued a provisional license or notice of revocation of license by the North Carolina Department of Health and Human Services and the basis on which the provisional license or notice of revocation of license was issued. The resident's responsible family member or guardian shall also be notified.
(15) To have freedom to participate by choice in accessible community activities and in social, political, medical, and religious resources and to have freedom to refuse such participation.
(16) To receive upon admission to the facility a copy of this section.
(17) To not be transferred or discharged from a facility except for medical reasons, the residents' own or other residents' welfare, nonpayment for the stay, or when the transfer is mandated under State or federal law. The resident shall be given at least 30 days' advance notice to ensure orderly transfer or discharge, except in the case of jeopardy to the health or safety of the resident or others in the home. The resident has the right to appeal a facility's attempt to transfer or discharge the resident pursuant to rules adopted by the Medical Care Commission, and the resident shall be allowed to remain in the facility until resolution of the appeal unless otherwise provided by law. The Medical Care Commission shall adopt rules pertaining to the transfer and discharge of residents that offer at least the same protections to residents as State and federal rules and regulations governing the transfer or discharge of residents from nursing homes."
SECTION 6. G.S. 131E-144.3 reads as rewritten:
"§ 131E-144.3. Declaration of home care clients' rights.
Each client of a home care agency shall have the following rights:
(1) To be informed and participate in his or her plan of care.
(2) To be treated with respect, consideration, dignity, and full recognition of his or her individuality and right to privacy.
(3) To receive care and services that are adequate, appropriate, and in compliance with relevant federal and State laws and rules and regulations.
(4) To voice grievances about care and not be subjected to discrimination or reprisal for doing so.
(5) To have his or
her personal and medical records kept confidential and not be disclosed without
appropriate written consent.except as permitted or required by
applicable State or federal law.
(6) To be free of mental and physical abuse, neglect, and exploitation.
(7) To receive a written statement of services provided by the agency and the charges the client is liable for paying.
(8) To be informed of the process for acceptance and continuance of service and eligibility determination.
(9) To accept or refuse services.
(10) To be informed of the agency's on-call service.
(11) To be informed of supervisory accessibility and availability.
(12) To be advised of the agency's procedures for discharge.
(13) To receive a reasonable response to his or her requests of the agency.
(14) To be notified within 10 days when the agency's license has been revoked, suspended, canceled, annulled, withdrawn, recalled, or amended.
(15) To be advised of the agency's policies regarding patient responsibilities."
SECTION 7. This act becomes effective January 1, 2012.
In the General Assembly read three times and ratified this the 17th day of June, 2011.
s/ Walter H. Dalton
President of the Senate
s/ Thom Tillis
Speaker of the House of Representatives
s/ Beverly E. Perdue
Governor
Approved 10:55 a.m. this 27th day of June, 2011