HF 1968

as introduced - 79th Legislature (1995 - 1996) Posted on 12/15/2009 12:00am

  1.1                          A bill for an act 
  1.2             relating to health care information; providing 
  1.3             conditions for the disclosure of health care 
  1.4             information; enacting the Uniform Health Care 
  1.5             Information Act; providing penalties; proposing coding 
  1.6             for new law as Minnesota Statutes, chapter 143. 
  1.7   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA: 
  1.8      Section 1.  [143.01] [LEGISLATIVE FINDINGS.] 
  1.9      The legislature finds that: 
  1.10     (1) Health care information is personal and sensitive 
  1.11  information that if improperly used or released may do 
  1.12  significant harm to a patient's interests in privacy, health 
  1.13  care, or other interests. 
  1.14     (2) Patients need access to their own health care 
  1.15  information as a matter of fairness to enable them to make 
  1.16  informed decisions about their health care and correct 
  1.17  inaccurate or incomplete information about themselves. 
  1.18     (3) In order to retain the full trust and confidence of 
  1.19  patients, health care providers have an interest in assuring 
  1.20  that health care information is not improperly disclosed and in 
  1.21  having clear and certain rules for the disclosure of health care 
  1.22  information. 
  1.23     (4) Persons other than health care providers obtain, use, 
  1.24  and disclose health record information in many different 
  1.25  contexts and for many different purposes.  It is the public 
  1.26  policy of this state that a patient's interest in the proper use 
  2.1   and disclosure of the patient's health care information survives 
  2.2   even when the information is held by persons other than health 
  2.3   care providers.  
  2.4      (5) The movement of patients and their health care 
  2.5   information across state lines, access to and exchange of health 
  2.6   care information from automated data banks, and the emergence of 
  2.7   multistate health care providers creates a compelling need for 
  2.8   uniform law, rules, and procedures governing the use and 
  2.9   disclosure of health care information.  
  2.10     Sec. 2.  [143.02] [DEFINITIONS.] 
  2.11     As used in sections 1 to 22, unless the context otherwise 
  2.12  requires: 
  2.13     (1) "Audit" means an assessment, evaluation, determination, 
  2.14  or investigation of a health care provider by a person not 
  2.15  employed by or affiliated with the provider to determine 
  2.16  compliance with: 
  2.17     (i) statutory, regulatory, fiscal, medical, or scientific 
  2.18  standards; 
  2.19     (ii) a private or public program of payments to a health 
  2.20  care provider; or 
  2.21     (iii) requirements for licensing, accreditation, or 
  2.22  certification. 
  2.23     (2) "Directory information" means information disclosing 
  2.24  the presence and the general health condition of a particular 
  2.25  patient who is an inpatient in a health care facility or who is 
  2.26  currently receiving emergency health care in a health care 
  2.27  facility. 
  2.28     (3) "General health condition" means the patient's health 
  2.29  status described in terms of "critical," "poor," "fair," "good," 
  2.30  "excellent," or terms denoting similar conditions. 
  2.31     (4) "Health care" means any care, service, or procedure 
  2.32  provided by a health care provider:  
  2.33     (i) to diagnose, treat, or maintain a patient's physical or 
  2.34  mental condition, or 
  2.35     (ii) that affects the structure or any function of the 
  2.36  human body. 
  3.1      (5) "Health care facility" means a hospital, clinic, 
  3.2   nursing home, laboratory, office, or similar place, where a 
  3.3   health care provider provides health care to patients.  
  3.4      (6) "Health care information" means any information, 
  3.5   whether oral or recorded in any form or medium, that identifies 
  3.6   or can readily be associated with the identity of a patient and 
  3.7   relates to the patient's health care.  The term includes any 
  3.8   record of disclosures of health care information.  
  3.9      (7) "Health care provider" means a person who is licensed, 
  3.10  certified, or otherwise authorized by the law of this state to 
  3.11  provide health care in the ordinary course of business or 
  3.12  practice of a profession.  The term does not include a person 
  3.13  who provides health care solely through the sale or dispensing 
  3.14  of drugs or medical devices. 
  3.15     (8) "Institutional review board" means any board, 
  3.16  committee, or other group formally designated by an institution, 
  3.17  or authorized under federal or state law, to review, approve the 
  3.18  initiation of, or conduct periodic review of research programs 
  3.19  to assure the protection of the rights and welfare of human 
  3.20  research subjects. 
  3.21     (9) "Maintain," as related to health care information, 
  3.22  means to hold, possess, preserve, retain, store, or control that 
  3.23  information. 
  3.24     (10) "Patient" means an individual who receives or has 
  3.25  received health care.  The term includes a deceased individual 
  3.26  who has received health care. 
  3.27     (11) "Person" means an individual, corporation, business 
  3.28  trust, estate, trust, partnership, association, joint venture, 
  3.29  government, governmental subdivision or agency, or any other 
  3.30  legal or commercial entity. 
  3.31     Sec. 3.  [143.03] [DISCLOSURE BY HEALTH CARE PROVIDER.] 
  3.32     (a) Except as authorized in section 6, a health care 
  3.33  provider, an individual who assists a health care provider in 
  3.34  the delivery of health care, or an agent and employee of a 
  3.35  health care provider may not disclose health care information 
  3.36  about a patient to any other person without the patient's 
  4.1   written authorization.  A disclosure made under a patient's 
  4.2   written authorization must conform to the authorization. 
  4.3      (b) A health care provider shall maintain, in conjunction 
  4.4   with a patient's recorded health care information, a record of 
  4.5   each person who has received or examined, in whole or in part, 
  4.6   the recorded health care information during the next preceding 
  4.7   three years, except for a person who has examined the recorded 
  4.8   health care information under section 6, paragraph (a), clause 
  4.9   (1) or (2).  The record of disclosure must include the name, 
  4.10  address, and institutional affiliation, if any, of each person 
  4.11  receiving or examining the recorded health care information, the 
  4.12  date of the receipt or examination, and, to the extent 
  4.13  practicable, a description of the information disclosed. 
  4.14     Sec. 4.  [143.04] [PATIENT AUTHORIZATION TO HEALTH CARE 
  4.15  PROVIDER FOR DISCLOSURE.] 
  4.16     (a) A patient may authorize a health care provider to 
  4.17  disclose the patient's health care information.  A health care 
  4.18  provider shall honor an authorization and, if requested, provide 
  4.19  a copy of the recorded health care information unless the health 
  4.20  care provider denies the patient access to health care 
  4.21  information under section 9. 
  4.22     (b) A health care provider may charge a reasonable fee, not 
  4.23  to exceed the health care provider's actual cost for providing 
  4.24  the health care information, and is not required to honor an 
  4.25  authorization until the fee is paid. 
  4.26     (c) To be valid, a disclosure authorization to a health 
  4.27  care provider must:  
  4.28     (1) be in writing, dated, and signed by the patient; 
  4.29     (2) identify the nature of the information to be disclosed; 
  4.30     (3) identify the person to whom the information is to be 
  4.31  disclosed. 
  4.32     (d) Except as provided by this act, the signing of an 
  4.33  authorization by a patient is not a waiver of any rights a 
  4.34  patient has under other statutes, the rules of evidence, or 
  4.35  common law. 
  4.36     (e) A health care provider shall retain each authorization 
  5.1   or revocation in conjunction with any health care information 
  5.2   from which disclosures are made. 
  5.3      (f) Except for authorizations to provide information to 
  5.4   third-party health care payers, an authorization may not permit 
  5.5   the release of health care information relating to future health 
  5.6   care that the patient receives more than six months after the 
  5.7   authorization was signed. 
  5.8      (g) An authorization in effect on the effective date of 
  5.9   this act remains valid for 30 months after the effective date of 
  5.10  this act unless an earlier date is specified or it is revoked 
  5.11  under section 5.  Health care information disclosed under such 
  5.12  an authorization is otherwise subject to this act.  An 
  5.13  authorization written after the effective date of this act 
  5.14  becomes invalid after the expiration date contained in the 
  5.15  authorization, which may not exceed 30 months.  If the 
  5.16  authorization does not contain an expiration date, it expires 
  5.17  six months after it is signed. 
  5.18     Sec. 5.  [143.05] [PATIENT'S REVOCATION OF AUTHORIZATION 
  5.19  FOR DISCLOSURE.] 
  5.20     A patient may revoke a disclosure authorization to a health 
  5.21  care provider at any time unless disclosure is required to 
  5.22  effectuate payments for health care that has been provided or 
  5.23  other substantial action has been taken in reliance on the 
  5.24  authorization.  A patient may not maintain an action against the 
  5.25  health care provider for disclosures made in good-faith reliance 
  5.26  on an authorization if the health care provider had no notice of 
  5.27  the revocation of the authorization. 
  5.28     Sec. 6.  [143.06] [DISCLOSURE WITHOUT PATIENT'S 
  5.29  AUTHORIZATION.] 
  5.30     (a) A health care provider may disclose health care 
  5.31  information about a patient without the patient's authorization 
  5.32  to the extent a recipient needs to know the information, if the 
  5.33  disclosure is: 
  5.34     (1) to a person who is providing health care to the 
  5.35  patient; 
  5.36     (2) to any other person who requires health care 
  6.1   information for health care education, or to provide planning, 
  6.2   quality assurance, peer review, or administrative, legal, 
  6.3   financial, or actuarial services to the health care provider, or 
  6.4   for assisting the health care provider in the delivery of health 
  6.5   care and the health care provider reasonably believes that the 
  6.6   person: 
  6.7      (i) will not use or disclose the health care information 
  6.8   for any other purpose; and 
  6.9      (ii) will take appropriate steps to protect the health care 
  6.10  information; 
  6.11     (3) to any other health care provider who has previously 
  6.12  provided health care to the patient, to the extent necessary to 
  6.13  provide health care to the patient, unless the patient has 
  6.14  instructed the health care provider not to make the disclosure; 
  6.15     (4) to any person if the health care provider reasonably 
  6.16  believes that disclosure will avoid or minimize an imminent 
  6.17  danger to the health or safety of the patient or any other 
  6.18  individual; 
  6.19     (5) to immediate family members of the patient, or any 
  6.20  other individual with whom the patient is known to have a close 
  6.21  personal relationship, if made in accordance with good medical 
  6.22  or other professional practice, unless the patient has 
  6.23  instructed the health care provider not to make the disclosure; 
  6.24     (6) to a health care provider who is the successor in 
  6.25  interest to the health care provider maintaining the health care 
  6.26  information; 
  6.27     (7) for use in a research project that an institutional 
  6.28  review board has determined: 
  6.29     (i) is of sufficient importance to outweigh the intrusion 
  6.30  into the privacy of the patient that would result from the 
  6.31  disclosure; 
  6.32     (ii) is impracticable without the use or disclosure of the 
  6.33  health care information in individually identifiable form; 
  6.34     (iii) contains reasonable safeguards to protect the 
  6.35  information from redisclosure; 
  6.36     (iv) contains reasonable safeguards to protect against 
  7.1   identifying, directly or indirectly, any patient in any report 
  7.2   of the research project; and 
  7.3      (v) contains procedures to remove or destroy at the 
  7.4   earliest opportunity, consistent with the purposes of the 
  7.5   project, information that would enable the patient to be 
  7.6   identified, unless an institutional review board authorizes 
  7.7   retention of identifying information for purposes of another 
  7.8   research project; 
  7.9      (8) to a person who obtains information for purposes of an 
  7.10  audit, if that person agrees in writing to: 
  7.11     (i) remove or destroy, at the earliest opportunity, 
  7.12  consistent with the purpose of the audit, information that would 
  7.13  enable the patient to be identified; and 
  7.14     (ii) not to disclose the information further, except to 
  7.15  accomplish the audit or report unlawful or improper conduct 
  7.16  involving fraud in payment for health care by a health care 
  7.17  provider or patient, or other unlawful conduct by the health 
  7.18  care provider; 
  7.19     (9) to an official of a penal or other custodial 
  7.20  institution in which the patient is detained. 
  7.21     (b) A health care provider may disclose health care 
  7.22  information about a patient without the patient's authorization 
  7.23  if the disclosure is: 
  7.24     (1) directory information, unless the patient has 
  7.25  instructed the health care provider not to make the disclosure; 
  7.26     (2) to federal, state, or local public health authorities, 
  7.27  to the extent the health care provider is required by law to 
  7.28  report health care information or when needed to protect the 
  7.29  public health; 
  7.30     (3) to federal, state, or local law enforcement authorities 
  7.31  to the extent required by law; 
  7.32     (4) pursuant to compulsory process in accordance with 
  7.33  section 7. 
  7.34     Sec. 7.  [143.07] [COMPULSORY PROCESS.] 
  7.35     (a) Health care information may not be disclosed by a 
  7.36  health care provider pursuant to compulsory legal process or 
  8.1   discovery in any judicial, legislative, or administrative 
  8.2   proceeding unless: 
  8.3      (1) the patient has consented in writing to the release of 
  8.4   the health care information in response to compulsory process or 
  8.5   a discovery request; 
  8.6      (2) the patient has waived the right to claim 
  8.7   confidentiality for the health care information sought; 
  8.8      (3) the patient is a party to the proceeding and has placed 
  8.9   the patient's physical or mental condition in issue; 
  8.10     (4) the patient's physical or mental condition is relevant 
  8.11  to the execution or witnessing of a will; 
  8.12     (5) the physical or mental condition of a deceased patient 
  8.13  is placed in issue by any person claiming or defending through 
  8.14  or as a beneficiary of the patient; 
  8.15     (6) a patient's health care information is to be used in 
  8.16  the patient's commitment proceeding; 
  8.17     (7) the health care information is for use in any law 
  8.18  enforcement proceeding or investigation in which a health care 
  8.19  provider is the subject or a party; but, health care information 
  8.20  so obtained may not be used in any proceeding against the 
  8.21  patient unless the matter relates to payment for the patient's 
  8.22  health care, or unless authorized under clause (9); 
  8.23     (8) the health care information is relevant to a proceeding 
  8.24  brought under sections 18 to 20; or 
  8.25     (9) a court has determined that particular health care 
  8.26  information is subject to compulsory legal process or discovery 
  8.27  because the party seeking the information has demonstrated that 
  8.28  the interest in access outweighs the patient's privacy interest. 
  8.29     (b) Unless the court, for good cause shown, determines that 
  8.30  the notification should be waived or modified, if health care 
  8.31  information is sought under paragraph (a), clause (2), (4), or 
  8.32  (5), or in a civil proceeding or investigation under paragraph 
  8.33  (a), clause (9), the person seeking discovery or compulsory 
  8.34  process shall mail a notice by first-class mail to the patient 
  8.35  or the patient's attorney of record of the compulsory process or 
  8.36  discovery request at least ten days before presenting the 
  9.1   certificate required under paragraph (c) to the health care 
  9.2   provider. 
  9.3      (c) Service of compulsory process or discovery requests 
  9.4   upon a health care provider must be accompanied by a written 
  9.5   certification, signed by the person seeking to obtain health 
  9.6   care information, or the person's authorized representative, 
  9.7   identifying at least one clause of paragraph (a) under which 
  9.8   compulsory process or discovery is being sought.  The 
  9.9   certification must also state, in the case of information sought 
  9.10  under paragraph (a), clause (2), (4), or (5), or in a civil 
  9.11  proceeding under paragraph (a), clause (9), that the 
  9.12  requirements of paragraph (b) for notice have been met.  A 
  9.13  person may sign the certification only if the person reasonably 
  9.14  believes that the clause of paragraph (a) identified in the 
  9.15  certification provides an appropriate basis for the use of 
  9.16  discovery or compulsory process. Unless otherwise ordered by the 
  9.17  court, the health care provider shall maintain a copy of the 
  9.18  process and the written certification as a permanent part of the 
  9.19  patient's health care information.  
  9.20     (d) Production of health care information under this 
  9.21  section, in and of itself, does not constitute a waiver of any 
  9.22  privilege, objection, or defense existing under other law or 
  9.23  rule of evidence or procedure. 
  9.24     Sec. 8.  [143.08] [REQUIREMENTS AND PROCEDURES FOR 
  9.25  PATIENT'S EXAMINATION AND COPYING.] 
  9.26     (a) Upon receipt of a written request from a patient to 
  9.27  examine or copy all or part of the patient's recorded health 
  9.28  care information, a health care provider, as promptly as 
  9.29  required under the circumstances, but no later than ten days 
  9.30  after receiving the request, shall: 
  9.31     (1) make the information available for examination during 
  9.32  the regular business hours and provide a copy, if requested, to 
  9.33  the patient; 
  9.34     (2) inform the patient if the information does not exist or 
  9.35  cannot be found; 
  9.36     (3) if the health care provider does not maintain a record 
 10.1   of the information, inform the patient and provide the name and 
 10.2   address, if known, of the health care provider who maintains the 
 10.3   record; 
 10.4      (4) if the information is in use or unusual circumstances 
 10.5   have delayed handling the request, inform the patient and 
 10.6   specify in writing the reasons for the delay and the earliest 
 10.7   date, not later than 21 days after receiving the request, when 
 10.8   the information will be available for examination or copying or 
 10.9   when the request will be otherwise disposed of; or 
 10.10     (5) deny the request, in whole or in part, under section 9 
 10.11  and inform the patient. 
 10.12     (b) Upon request, the health care provider shall provide an 
 10.13  explanation of any code or abbreviation used in the health care 
 10.14  information.  If a record of the particular health care 
 10.15  information requested is not maintained by the health care 
 10.16  provider in the requested form, the health care provider is not 
 10.17  required to create a new record or reformulate an existing 
 10.18  record to make the health care information available in the 
 10.19  requested form.  The health care provider may charge a 
 10.20  reasonable fee, not to exceed the health care provider's actual 
 10.21  cost, for providing the health care information and is not 
 10.22  required to permit examination or copying until the fee is paid. 
 10.23     Sec. 9.  [143.09] [DENIAL OF EXAMINATION AND COPYING.] 
 10.24     (a) A health care provider may deny access to health care 
 10.25  information by a patient if the health care provider reasonably 
 10.26  concludes that: 
 10.27     (1) knowledge of the health care information would be 
 10.28  injurious to the health of the patient; 
 10.29     (2) knowledge of the health care information could 
 10.30  reasonably be expected to lead to the patient's identification 
 10.31  of an individual who provided the information in confidence and 
 10.32  under circumstances in which confidentiality was appropriate; 
 10.33     (3) knowledge of the health care information could 
 10.34  reasonably be expected to cause danger to the life or safety of 
 10.35  any individual; 
 10.36     (4) the health care information was compiled and is used 
 11.1   solely for litigation, quality assurance, peer review, or 
 11.2   administrative purposes; or 
 11.3      (5) access to the health care information is otherwise 
 11.4   prohibited by law. 
 11.5      (b) If a health care provider denies a request for 
 11.6   examination and copying under this section, the provider, to the 
 11.7   extent possible, shall segregate health care information for 
 11.8   which access has been denied under paragraph (a) from 
 11.9   information for which access cannot be denied and permit the 
 11.10  patient to examine or copy the disclosable information. 
 11.11     (c) If a health care provider denies a patient's request 
 11.12  for examination and copying, in whole or in part, under 
 11.13  paragraph (a), clause (1) or (3), the provider shall permit 
 11.14  examination and copying of the record by another health care 
 11.15  provider, selected by the patient, who is licensed, certified, 
 11.16  or otherwise authorized under the laws of this state to treat 
 11.17  the patient for the same condition as the health care provider 
 11.18  denying the request.  The health care provider denying the 
 11.19  request shall inform the patient of the patient's right to 
 11.20  select another health care provider under this paragraph.  
 11.21     Sec. 10.  [143.10] [REQUEST FOR CORRECTION OR AMENDMENT.] 
 11.22     (a) For purposes of accuracy or completeness, a patient may 
 11.23  request in writing that a health care provider correct or amend 
 11.24  its record of the patient's health care information to which a 
 11.25  patient has access under section 8. 
 11.26     (b) As promptly as required under the circumstances, but no 
 11.27  later than ten days after receiving a request from a patient to 
 11.28  correct or amend its record of the patient's health care 
 11.29  information, the health care provider shall:  
 11.30     (1) make the requested correction or amendment and inform 
 11.31  the patient of the action and of the patient's right to have the 
 11.32  correction or amendment sent to previous recipients of the 
 11.33  health care information in question; 
 11.34     (2) inform the patient if the record no longer exists or 
 11.35  cannot be found; 
 11.36     (3) if the health care provider does not maintain the 
 12.1   record, inform the patient and provide the patient with the name 
 12.2   and address, if known, of the person who maintains the record; 
 12.3      (4) if the record is in use or unusual circumstances have 
 12.4   delayed the handling of the correction or amendment request, 
 12.5   inform the patient and specify in writing, the earliest date, 
 12.6   not later than 21 days after receiving the request, when the 
 12.7   correction or amendment will be made or when the request will 
 12.8   otherwise be disposed of; or 
 12.9      (5) inform the patient in writing of the provider's refusal 
 12.10  to correct or amend the record as requested, the reason for the 
 12.11  refusal, and the patient's right to add a statement of 
 12.12  disagreement and to have that statement sent to previous 
 12.13  recipients of the disputed health care information.  
 12.14     Sec. 11.  [143.11] [PROCEDURE FOR ADDING CORRECTION OR 
 12.15  AMENDMENT OR STATEMENT OF DISAGREEMENT.] 
 12.16     (a) In making a correction or amendment, the health care 
 12.17  provider shall: 
 12.18     (1) add the amending information as a part of the health 
 12.19  record; and 
 12.20     (2) mark the challenged entries as corrected or amended 
 12.21  entries and indicate the place in the record where the corrected 
 12.22  or amended information is located, in a manner practicable under 
 12.23  the circumstances. 
 12.24     (b) If the health care provider maintaining the record of 
 12.25  the patient's health care information refuses to make the 
 12.26  patient's proposed correction or amendment, the provider shall: 
 12.27     (1) permit the patient to file as a part of the record of 
 12.28  the patient's health care information a concise statement of the 
 12.29  correction or amendment requested and the reasons therefor; and 
 12.30     (2) mark the challenged entry to indicate that the patient 
 12.31  claims the entry is inaccurate or incomplete and indicate the 
 12.32  place in the record where the statement of disagreement is 
 12.33  located, in a manner practicable under the circumstances. 
 12.34     Sec. 12.  [143.12] [DISSEMINATION OF CORRECTED OR AMENDED 
 12.35  INFORMATION OR STATEMENT OF DISAGREEMENT.] 
 12.36     (a) A health care provider, upon request of a patient, 
 13.1   shall take reasonable steps to provide copies of corrected or 
 13.2   amended information or of a statement of disagreement to all 
 13.3   persons designated by the patient and who are identified in the 
 13.4   health care information as having examined or received copies of 
 13.5   the information sought to be corrected or amended. 
 13.6      (b) A health care provider may charge the patient a 
 13.7   reasonable fee, not exceeding the provider's actual cost, for 
 13.8   distributing corrected or amended information or the statement 
 13.9   of disagreement, unless the provider's error necessitated the 
 13.10  correction or amendment. 
 13.11     Sec. 13.  [143.13] [CONTENT AND DISSEMINATION OF NOTICE.] 
 13.12     (a) A health care provider who provides health care at a 
 13.13  health care facility that the provider operates and who 
 13.14  maintains a record of a patient's health care information shall 
 13.15  create a "notice of information practices" that contains 
 13.16  substantially the following: 
 13.17                              Notice
 13.18     "We keep a record of the health care services we provide 
 13.19     you.  You may ask us to see and copy that record.  You may 
 13.20     also ask us to correct that record.  We will not disclose 
 13.21     your record to others unless you direct us to do so or 
 13.22     unless the law authorizes or compels us to do so.  You may 
 13.23     see your record or get more information about it at 
 13.24     ................" 
 13.25     (b) The health care provider shall post a copy of the 
 13.26  notice of information practices in a conspicuous place in the 
 13.27  health care facility and, upon request, provide patients or 
 13.28  prospective patients with a copy of the notice. 
 13.29     Sec. 14.  [143.14] [HEALTH CARE REPRESENTATIVES.] 
 13.30     (a) A person authorized to consent to health care for 
 13.31  another may exercise the rights of that person under this act to 
 13.32  the extent necessary to effectuate the terms or purposes of the 
 13.33  grant of authority.  If the patient is a minor and is authorized 
 13.34  to consent to health care without parental consent under the 
 13.35  laws of this state, only the minor may exclusively exercise the 
 13.36  rights of a patient under this act as to information pertaining 
 14.1   to health care to which the minor lawfully consented. 
 14.2      (b) A person authorized to act for a patient shall act in 
 14.3   good faith to represent the best interests of the patient. 
 14.4      Sec. 15.  [143.15] [REPRESENTATIVE OF DECEASED PATIENT.] 
 14.5      A personal representative of a deceased patient may 
 14.6   exercise all of the deceased patient's rights under this act.  
 14.7   If there is no personal representative, or upon discharge of the 
 14.8   personal representative, a deceased patient's rights under this 
 14.9   act may be exercised by persons who are authorized by law to act 
 14.10  for the deceased patient. 
 14.11     Sec. 16.  [143.16] [DUTY TO ADOPT SECURITY SAFEGUARDS.] 
 14.12     A health care provider shall effect reasonable safeguards 
 14.13  for the security of all health care information it maintains.  
 14.14     Sec. 17.  [143.17] [RETENTION OF RECORD.] 
 14.15     A health care provider shall maintain a record of existing 
 14.16  health care information for at least one year following receipt 
 14.17  of an authorization to disclose that health care information 
 14.18  under section 5, and during the pendency of a request for 
 14.19  examination and copying under section 8 or a request for 
 14.20  correction or amendment under section 10. 
 14.21     Sec. 18.  [143.18] [CRIMINAL PENALTY.] 
 14.22     (a) A person who willfully discloses health care 
 14.23  information in violation of this act, and who knew or should 
 14.24  have known that disclosure is prohibited, is guilty of a gross 
 14.25  misdemeanor. 
 14.26     (b) A person who, by means of 
 14.27     (1) bribery, 
 14.28     (2) theft, 
 14.29     (3) misrepresentation of identity, purpose of use or 
 14.30  entitlement to the information, or 
 14.31     (4) trespass, 
 14.32  examines or obtains, in violation of this act, health care 
 14.33  information maintained by a health care provider, is guilty of a 
 14.34  gross misdemeanor. 
 14.35     (c) A person who, knowing that a certification under 
 14.36  section 7, paragraph (c) or a disclosure authorization under 
 15.1   section 4 is false, willfully presents the certification or 
 15.2   disclosure authorization to a health care provider, is guilty of 
 15.3   a gross misdemeanor. 
 15.4      Sec. 19.  [143.19] [CIVIL ENFORCEMENT.] 
 15.5      The attorney general or county attorney may maintain a 
 15.6   civil action to enforce this act.  The court may order any 
 15.7   relief authorized by section 20. 
 15.8      Sec. 20.  [143.20] [CIVIL REMEDIES.] 
 15.9      (a) A person aggrieved by a violation of this act may 
 15.10  maintain an action for relief as provided in this section. 
 15.11     (b) The court may order the health care provider or other 
 15.12  person to comply with this act and may order any other 
 15.13  appropriate relief. 
 15.14     (c) A health care provider who relies in good faith upon a 
 15.15  certification, pursuant to section 7, paragraph (c), is not 
 15.16  liable for disclosures made in reliance on that certification. 
 15.17     (d) In an action by a patient alleging that health care 
 15.18  information was improperly withheld under sections 8 and 9 the 
 15.19  burden of proof is on the health care provider to establish that 
 15.20  the information was properly withheld. 
 15.21     (e) If the court determines that there is a violation of 
 15.22  this act, the aggrieved person is entitled to recover damages 
 15.23  for pecuniary losses sustained as a result of the violation; 
 15.24  and, in addition, if the violation results from willful or 
 15.25  grossly negligent conduct, the aggrieved person may recover not 
 15.26  in excess of $5,000, exclusive of any pecuniary loss. 
 15.27     (f) If a plaintiff prevails, the court may assess 
 15.28  reasonable attorney's fees and all other expenses reasonably 
 15.29  incurred in the litigation. 
 15.30     (g) Any action under this act is barred unless the action 
 15.31  is commenced within two years after the cause of action accrues. 
 15.32     Sec. 21.  [143.21] [SAVING CLAUSE.] 
 15.33     This act does not affect other law restricting, to a 
 15.34  greater extent than does this act, the disclosure of specific 
 15.35  types of health care information to any person other than the 
 15.36  patient to whom it relates. 
 16.1      Sec. 22.  [143.22] [SHORT TITLE.] 
 16.2      Sections 1 to 22 may be cited as the Uniform Health Care 
 16.3   Information Act.