|
New Model Forms for Record Requests and Responses
Frequent Inquiries: Record Requests, Fees, Photocopies
Act 87 Protects Privacy of Health Care Information
The Office of Information Practices has published two new model
forms for State and county government agencies entitled "Request
to Access a Government Record" and "Notice to Requester."
The forms were developed to assist agencies and members
of the public with public record requests.
Smoothing the Way
The new forms, created with input from government agencies and the
public, should make the processing of a record request smoother
for both the requester and the agency that processes the request.
Agencies are not required to use these forms and may create their
own.
The forms feature check boxes to clarify and speed
both the request and the agency's response. They also give key information
about the request procedure, the requester's responsibilities, and
the agency's responsibilities.
Forms Available Online
The model forms are available at www.state.hi.us/oip, along with
the text of the rules, the Uniform Information Practices Act ("UIPA"),
the Openline newsletter, general guidance, and information about
the Office of Information Practices.
Frequent Inquiries: Record
Requests, Fees, Photocopies
Just the FAQs! Here are answers to frequently asked questions received
by the OIP in recent days. The OIP's Attorney of the Day service
welcomes your inquiries.
Record Request Fee Waivers
Several callers have asked about the two fee waivers in the new
OIP rules. The first waiver is mandatory and applies to agency charges
for the search, review, and segregation of a record, up to a maximum
of $30. There are no qualifications that must be met to receive
this fee waiver.
The second fee waiver is one that a requester may
apply for if the request is in the public interest. If the requester
meets the requirements in section 2-71-32, Hawaii Administrative
Rules, the requester will receive a total waiver of $60 for fees
for search, review, and segregation.
Simple Record Requests
Callers have asked if they have discretion to charge fees under
the OIP rules when the amount of the fee is less than $30. The answer
is no: the first $30 is a mandatory waiver of fees for searching
for, reviewing, and segregating a record.
The fees were meant to help the government recoup
costs without placing significant barriers in the way of public
access. Therefore, requests that take a small amount of time to
process are subject to the mandatory waiver.
Agencies may elect not to charge fees for search,
review, and segregation, but if they do charge they must follow
the fees in the OIP rules.
Voluminous Record Requests
Callers from small agencies ask how they can process voluminous
record requests without unreasonably disrupting their regular duties.
Section 2-71-15, Hawaii Administrative Rules, lists several extenuating
circumstances, one of which is when an agency requires additional
time to respond to a request in order to avoid an unreasonable interference
with its other statutory duties and functions.
When extenuating circumstances are present, and the
requested records are voluminous, an agency may, in good faith,
elect to make the records available in increments.
Private Information
Sometimes callers ask if they can give out the home address of employees
upon request, or disclose social security numbers. In most cases
disclosure of home addresses, home telephone numbers, and social
security numbers would violate the privacy rights of individuals.
Section 92F-13 (1) of the Uniform Information Practices
Act ("UIPA") protects from disclosure government records
"which, if disclosed, would constitute a clearly unwarranted
invasion of personal privacy."
Do Requesters Have to Give
Their Names?
Sometimes those requesting public records do not want to give their
names. Agencies may not ask for a requester's name as a condition
for disclosing a public record.
If a requester is applying for a waiver of search,
review, and segregation fees in the public interest, however, the
requester must then give their name.
Do Requesters Have to Give
a Reason for Making the Request?
A person making a record request does not have to give a reason
for the request. Agencies should not ask requesters why they are
requesting a record.
Must a Record Request Be in
Writing?
Callers have also asked if a record request must be in writing.
The quick answer is no and yes. No written request is required for
informal requests, but yes, a written request is required for formal
requests.
Section 2-71-11, Hawaii Administrative Rules, covers
informal requests for access to government records. Sections 2-71-12
and 2-71-13 cover formal requests.
The OIP encourages requesters to make written requests.
The advantages include having a written record of the request and
request date, and ensuring a written response or disclosure by the
agency.
Can a Rule or Ordinance Override
the UIPA?
Some callers ask what to follow when it appears that a rule or ordinance
may conflict with the UIPA. Unless the Hawaii Revised Statutes provide
otherwise, a statute (including the UIPA) prevails over rules, ordinances,
or charters.
Recently the office of a county council member called
about historical research that office had conducted. The council
member's office had just received an informal record request for
that research from an attorney for an individual involved in a contested
case hearing. Under that county's rules, council members should
not be giving out information to someone for that individual's personal
gain. The caller asked if the information was public.
The OIP advised the office that the information is
presumed public unless a UIPA exception to disclosure applies. Any
rule or ordinance that contradicts a statute would be "trumped"
by the statute. Thus, if the UIPA made the information public, the
UIPA would likely control access.
Photocopy Charges
Agencies and members of the public often call to find out what the
new photocopy fees are under section 92-21, Hawaii Revised Statutes.
Act 160 amended the fees, effective July 1, 1999, to five cents
per page.
Several agencies have inquired about the procedures
they should follow if they do not wish to charge photocopy fees,
or if they want to charge more than the statutory five cents per
page.
The OIP does not have jurisdiction to opine on copy
fee issues under section 92-21, HRS, or other laws. Agencies should
contact their Deputy Corporation Counsel, Deputy Attorney General,
or in-house counsel if they seek advice in this area.
Act 87 Protects Privacy
of Health Care Information
In the last issue Openline reported on the history of Act 87, the
new Hawaii law regarding privacy of health care information. This
issue features a special supplement with an in-depth analysis of
the major provisions of Act 87.
Act 87 (HB 351, HD2, SD1, CD1), which takes effect
July 1, 2000, regulates information practices in the health care
industry, including patient access to the medical record and health
care provider disclosure of protected health information. The new
law's stated objectives are to:
- protect an individual's right to privacy of medical
information under the Hawaii Constitution,
- protect individuals against the adverse effects
of improper disclosure of medical information,
establish mechanisms to protect against unauthorized and inappropriate
use of protected health information,
- encourage the exchange of health care information
in a manner that will ensure confidentiality of protected information
without impeding high quality health care,
- allow appropriate transfer of personal health
information into nonidentifiable health information for legitimate
purposes including research and promotion of public health,
- discourage litigation by establishing procedures
that will provide courts with strong evidence that medical information
was properly handled and disclosed, and
- establish remedies for violations of Act 87.
Patient’s Right to Access Protected
Health Information
Protected health information is information identifiable to an individual
including the: (1) physical or mental health or condition of a person
including tissue and genetic information; (2) provision of health
care to an individual; or (3) payment for the provision of health
care to an individual.
Although health care providers own those medical records
in their possession, patients have a right to inspect and copy the
medical record within 30 days after their request is received by
covered "entities" (including health care providers, health
plans, employers, health care data organizations, insurers, or educational
institutions).
When Access Is Not Required. Nonetheless, unless a
court orders otherwise, an entity may be permitted to withhold patient
access when:
- the disclosure could endanger the life or physical
safety of, or cause substantial mental harm to, the subject of
the record;
- the information identifies, or could reasonably
lead to the identification of, a person who provided information
under a promise of confidentiality, unless the confidential source
can be protected by redaction or other means;
- the information is protected from discovery under
section 624-25-5, Hawaii Revised Statutes; or
- the information was collected for or during a
clinical trial monitored by an institutional review board, the
trial is not complete, and the researcher reasonably believes
that access would harm the conduct of the trial.
If the entity denies the patient access to the medical
record it has a duty to inform the patient, in writing. The entity
must tell the patient, within 30 days after the date the request
was received, the reasons for the denial, procedures for further
review of the denial and the patient’s right to file a statement
with the entity, setting forth the request for inspection and copying.
Use and Disclosure of Protected
Health Information
The law prohibits health care entities from improper use and disclosure
of protected health information. Moreover, the law requires that
these entities establish and maintain safeguards to protect the
confidentiality, security, accuracy, and integrity of protected
health information.
Under the law, a health care entity may use or disclose
protected health information within that entity only if proper notice
has been given to the patient.
If proper notice has been given, then an entity may
use the protected health information within the entity for purposes
of treatment and certain qualified health care operations. Otherwise,
with the exception of certain public policy uses, all other uses
and disclosures require a specific consent.
Patient "Opt-Out"
Rights
If, after receiving the notice of confidentiality practices, the
patient wishes to prohibit all disclosures required for purposes
of a third-party payor contract, he or she may "opt-out"
of the disclosures for those purposes. Instead, the patient may
pay the provider directly for those services. The provider then
has the duty to ensure that this "opt-out" portion of
the protected health information is not disclosed without a proper
consent.
Notice of Confidentiality Practices
The notice of confidentiality practices generally explains what
a patient’s rights are and what confidentiality practices
that entity follows. The law contains specific language that must
be included in a notice. Entities that hold protected health information
must give their notice of confidentiality practices in one of two
different ways, depending upon the type of entity.
Health Plans must give notice to each individual eligible
to receive care under the health plan 1) upon enrollment, 2) annually,
and 3) whenever confidentiality practices are substantially amended.
All other entities, including health care providers, health care
data organizations, health oversight agencies, public health authorities,
employers insurers, health researchers, and educational institutions,
are required to post notice of their confidentiality practices in
a conspicuous place.
Consent
The law requires that for all other disclosures, the patient must
give his or her consent to disclose (called an "authorization"
in the law). Each disclosure must have a separate consent, in writing,
dated and signed by the patient (or if electronic, then authenticated
by an unique identifier). The patient may revoke the consent at
any time. The consent must:
- identify the person who is authorized to disclose
the protected health information;
identify the patient;
- describe the nature of and time span of the protected
health information to be disclosed;
identify to whom the protected health information is to be disclosed;
- describe the purpose of the disclosure;
- state that the consent is subject to revocation;
- include the date upon which the consent to
disclose ends.
Disclosures Without Consent
For purposes of public policy, protected health information may
be disclosed without consent:
- to the coroner or medical examiner;
- to a designated relative or representative, if
certain conditions are met;
- to assist in identification or safe handling of
a deceased individual;
- in emergency circumstances when it is necessary
to protect the health or safety of the subject from serious, imminent
harm;
- to a health oversight agency for an oversight function
authorized by law;
- to a public health authority or other person authorized
by law for use in legally authorized activities;
- to entities for research purposes if certain conditions
are met;
- in judicial or administrative procedures; and
- for civil or administrative law enforcement
purposes.
OIP's Role
Act 87 gives the OIP two new functions:
Rulemaking Authority: The OIP is required to adopt
rules to implement the establishment of 1) safeguards to protect
confidentiality by entities and 2) standards for electronic disclosures.
Prevention and Deterrence: The OIP may provide advice,
training, technical assistance, and guidance regarding ways to prevent
improper disclosure of protected health information.
Sanctions
Criminal Penalties: The knowing or intentional disclosure of protected
health information in violation of the law is a class C felony (five
years in prison). The knowing or intentional sale, transfer, or
use of protected health information for commercial advantage, personal
gain, or malicious harm, in violation of Act 87, is a class B felony
(ten years in prison).
Civil Penalties: Individuals whose rights under the
law have been violated may bring a civil action. Available civil
remedies include: injunctive relief, equitable relief, compensatory
damages, punitive damages, costs of the action, attorneys' fees,
and any other relief the court finds appropriate. In addition, a
court may serve a cease and desist order upon a person who has violated
any provision of the law and impose fines.
|
