1     
ACCESS TO PROTECTED HEALTH INFORMATION

2     
2024 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: James A. Dunnigan

5     
Senate Sponsor: ____________

6     

7     LONG TITLE
8     General Description:
9          This bill amends provisions related to a third-party's access to protected health
10     information.
11     Highlighted Provisions:
12          This bill:
13          ▸     defines terms;
14          ▸     imposes penalties on a health care provider or the health care provider's third-party
15     service, if applicable, for failure to respond to a valid request for a patient's
16     protected health information within 30 days and 60 days, respectively, of the
17     request; and
18          ▸     allows an organization of health care providers to file a statement with the Division
19     of Professional Licensing on behalf of the individual health care providers within
20     the organization.
21     Money Appropriated in this Bill:
22          None
23     Other Special Clauses:
24          None
25     Utah Code Sections Affected:
26     AMENDS:
27          78B-5-618, as last amended by Laws of Utah 2023, Chapters 287, 330
28     

29     Be it enacted by the Legislature of the state of Utah:
30          Section 1. Section 78B-5-618 is amended to read:
31          78B-5-618. Patient access to protected health information -- Third-party access to
32     Protected health information -- Protected health information services -- Fees -- Standard
33     form.
34          (1) As used in this section:
35          (a) "Force majeure event" means an event or circumstance beyond the control of the
36     health care provider or the health care provider's third-party service, including fires, floods,
37     earthquakes, acts of God, lockouts, ransomware, or strikes.
38          (b) "Health care provider" means the same as that term is defined in Section
39     78B-3-403.
40          (c) "History of poor payment" means three or more invoices where payment is more
41     than 30 days late within a 12-month period.
42          (d) "Indigent individual" means an individual whose household income is at or below
43     100% of the federal poverty level as defined in Section 26B-3-113.
44          (e) "Inflation" means the unadjusted Consumer Price Index, as published by the Bureau
45     of Labor Statistics of the United States Department of Labor, that measures the average
46     changes in prices of goods and services purchased by urban wage earners and clerical workers.
47          (f) (i) "Protected health information" means the same as that term is defined in 45
48     C.F.R. Sec. 160.103.
49          (ii) "Protected health information" of a patient includes the patient's total outstanding
50     balance owed to a health care provider.
51          [(f)] (g) "Qualified claim or appeal" means a claim or appeal under any:
52          (i) provision of the Social Security Act as defined in Section 67-11-2; or
53          (ii) federal or state financial needs-based benefit program.
54          [(g)] (h) "Third-party service" means a service that has entered into a contract with a
55     health care provider to provide patient [records] protected health information on behalf of a
56     health care provider.
57          (2) Pursuant to Standards for Privacy of Individually Identifiable Health Information,
58     45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or
59     receive a copy of the patient's [records] protected health information from a health care
60     provider when that health care provider is governed by the provisions of 45 C.F.R., Parts
61     160 and 164.
62          (3) When a health care provider is not governed by Standards for Privacy of
63     Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a
64     patient's personal representative may inspect or receive a copy of the patient's [records]
65     protected health information unless access to the [records] information is restricted by law or
66     judicial order.
67          (4) A health care provider who provides a paper or electronic copy of a patient's
68     [records] protected health information to the patient or the patient's personal representative:
69          (a) shall provide the copy within the deadlines required by the Health Insurance
70     Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec.
71     164.524(b); and
72          (b) may charge a reasonable cost-based fee provided that the fee includes only the cost
73     of:
74          (i) copying, including the cost of supplies for and labor of copying; and
75          (ii) postage, when the patient or patient's personal representative has requested the copy
76     be mailed.
77          (5) (a) Except for [records] protected health information provided under Section
78     26B-8-411, a health care provider or a health care provider's third-party service that provides a
79     copy of a patient's [records] protected health information to a patient's attorney, legal
80     representative, or other third party authorized to receive [records] protected health information:
81          (i) shall provide the copy within 30 days after receipt of notice;
82          (ii) shall, if the health care provider or third-party service completing the request will
83     not provide the copy in accordance with Subsection (5)(a)(i), provide a written response that
84     includes:
85          (A) contact information for the individual who the person making the request may
86     contact to resolve the request; and
87          (B) the reason for not complying with Subsection (5)(a)(i);
88          [(ii)] (iii) may charge a reasonable fee for paper or electronic copies, but may not
89     exceed the following rates:
90          (A) $30 per request for locating a patient's [records] protected health information;
91          (B) reproduction charges may not exceed 53 cents per page for the first 40 pages and
92     32 cents per page for each additional page;
93          (C) the cost of postage when the requester has requested the copy be mailed;
94          (D) if requested, the person fulfilling the request will certify the record as a duplicate
95     of the original for a fee of $20; and
96          (E) any sales tax owed under Title 59, Chapter 12, Sales and Use Tax Act; and
97          [(iii)] (iv) may charge an expedition fee of $20 if:
98          (A) the requester's notice explicitly requests an expedited response; and
99          (B) the person fulfilling the request postmarks or otherwise makes the [record]
100     protected health information available electronically within 15 days from the day the person
101     fulfilling the request receives notice of the request.
102          (b) If the person fulfilling the request fails to comply with Subsection (5)(a)(ii):
103          (i) within 30 days after the day on which notice is received by the health care provider
104     or third-party service fulfilling the request, the person fulfilling the request shall pay $200
105     toward the patient's total outstanding balance owed to the health care provider:
106          (A) fulfilling the request; or
107          (B) with respect to which the third-party service is providing the protected health
108     information.
109          (ii) within 60 days after the day on which notice is received by the person fulfilling the
110     request, the person fulfilling the request shall pay an additional $400 toward the patient's total
111     outstanding balance owed to the health care provider:
112          (A) fulfilling the request; or
113          (B) with respect to which the third-party service is providing the protected health
114     information; and
115          [(b)] (c) Notwithstanding the provisions of Subsection [(5)(a)(ii)] (5)(a)(iii) and subject
116     to Subsection [(5)(c)] (5)(d), in the event the requested records are not postmarked or otherwise
117     made available electronically by the person fulfilling the request:
118          (i) within 30 days after the day on which notice is received by the person fulfilling the
119     request, the person fulfilling the request shall waive 50% of the fee; or
120          (ii) within 60 days after the day on which notice is received by the person fulfilling the
121     request, the person fulfilling the request shall provide the requested records free of charge to
122     the requester.
123          [(c)] (d) Performance under Subsection [(5)(b)] (5)(c) shall be extended in accordance
124     with Subsection [(5)(d)] (5)(e) if the person fulfilling the request notifies the requester of:
125          (i) the occurrence of a force majeure event within 10 days from the day:
126          (A) the force majeure event occurs; or
127          (B) the person fulfilling the request receives notice of the request; and
128          (ii) the termination of the force majeure event within 10 days from the day the force
129     majeure event terminates.
130          [(d)] (e) In accordance with Subsection [(5)(c)] (5)(d), for a force majeure event:
131          (i) that lasts less than eight days, the person fulfilling the request shall, if the [records
132     are] protected health information is not postmarked or otherwise made available electronically
133     within:
134          (A) 30 days of the day the force majeure event ends, waive 50% of the fee for
135     providing the [records] protected health information; and
136          (B) 60 days of the day the force majeure event ends, waive the entire fee for providing
137     the [records] protected health information;
138          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request
139     shall, if the [records are] protected health information is not postmarked or otherwise made
140     available electronically within:
141          (A) 60 days of the day the force majeure event ends, waive 50% of the fee for
142     providing the [records] protected health information; and
143          (B) 90 days of the day the force majeure event ends, waive the entire fee for providing
144     the [records] protected health information; and
145          (iii) that lasts more than 30 days, the person fulfilling the request shall, if the [records
146     are] protected health information is not postmarked or otherwise made available electronically
147     within:
148          (A) 90 days of the day the force majeure event ends, waive 50% of the fee for
149     providing the [records] protected health information; and
150          (B) 120 days of the day the force majeure event ends, waive the entire fee for providing
151     the [records] protected health information.
152          [(e)] (f) (i) A third-party service may require prepayment before sending [records]
153     protected health information for a request under this Subsection (5) if the third-party service:
154          (A) determines the requester has a history of poor payment; and
155          (B) notifies the requester, within [the time periods described in Subsection (5)(b)(i) and
156     (ii)] 30 days after receipt of notice, that the [records] protected health information will be sent
157     as soon as the request has been prepaid.
158          (ii) The fee reductions described in Subsection [(5)(d)] (5)(e) do not apply if a
159     third-party service complies with Subsection [(5)(e)(i)] (5)(f)(i).
160          [(f)] (g) If a third-party service does not possess or have access to the data necessary to
161     fulfill a request, the third-party service shall notify:
162          (i) the requester that the request cannot be fulfilled; and
163          (ii) state the reasons for the third-party service's inability to fulfill the request within 30
164     days from the day on which the request is received by the third-party service.
165          [(g)] (h) A patient's attorney, legal representative, or other third party authorized to
166     receive [records] protected health information may request patient [records] protected health
167     information directly from a third-party service.
168          (6) (a) (i) [A] Subject to Subsection (6)(a)(ii), a health care provider that contracts with
169     a third-party service to fulfill the health care provider's medical record requests shall file a
170     statement with the Division of Professional Licensing containing:
171          [(i)] (A) the name of the third-party service;
172          [(ii)] (B) the phone number of the third-party service; and
173          [(iii)] (C) the fax number, email address, website portal address, if applicable, and
174     mailing address for the third-party service where medical record requests can be sent for
175     fulfillment.
176          (ii) If an individual health care provider is an employee or owner of an organization
177     that is a health care provider and that contracts with a third-party service to fulfill the medical
178     record requests for the individual health care provider, the organization may file the statement
179     under Subsection (6)(a)(i) on behalf of the organization's employees and owners.
180          (b) A health care provider described in Subsection [(6)(a)] (6)(a)(i) shall update the
181     filing described in Subsection [(6)(a)] (6)(a)(i) as necessary to ensure that the information is
182     accurate.
183          (c) The Division of Professional Licensing shall develop a form for a health care
184     provider to complete that provides the information required by Subsection [(6)(a)] (6)(a)(i).
185          (d) The Division of Professional Licensing shall:
186          (i) maintain an index of statements described in Subsection [(6)(a)] (6)(a)(i) arranged
187     alphabetically by entity; and
188          (ii) make the index available to the public electronically on the Division of
189     Professional Licensing's website.
190          (7) A health care provider or the health care provider's third-party service shall deliver
191     the [medical records] protected health information in the electronic medium customarily used
192     by the person fulfilling the request or in a universally readable image such as portable
193     document format:
194          (a) if the patient, patient's personal representative, or a third party authorized to receive
195     the [records] protected health information requests the [records] protected health information
196     be delivered in an electronic medium; and
197          (b) the original medical record is readily producible in an electronic medium.
198          (8) (a) Except as provided in Subsections (8)(b) through (d), the per page fee in
199     Subsections (4) and (5) applies to [medical records] protected health information reproduced
200     electronically or on paper.
201          (b) The per page fee for producing a copy of [records] protected health information in
202     an electronic medium shall be 50% of the per page fee otherwise provided in this section,
203     regardless of whether the original medical [records are] protected health information is stored
204     in electronic format.
205          (c) (i) A health care provider or a health care provider's third-party service shall deliver
206     the [medical records] protected health information in the electronic medium customarily used
207     by the health care provider or the health care provider's third-party service or in a universally
208     readable image, such as portable document format, if the patient, patient's personal
209     representative, patient's attorney, legal representative, or a third party authorized to receive the
210     [records] protected health information, requests the [records] protected health information be
211     delivered in an electronic medium.
212          (ii) A person fulfilling the request under Subsection (8)(c)(i):
213          (A) shall provide the requested information within 30 days; and
214          (B) may not charge a fee for the electronic copy that exceeds $150 regardless of the
215     number of pages and regardless of whether the original [medical records are] protected health
216     information is stored in electronic format.
217          (d) Subject to Subsection (8)(e), in the event the requested [records] protected health
218     information under Subsection (8)(c)(i) [are] is not postmarked or otherwise made available
219     electronically by the person fulfilling the request:
220          (i) within 30 days after the day notice is received by the person fulfilling the request,
221     the person fulfilling the request may not charge a fee for the electronic copy that exceeds $75
222     regardless of the number of pages and regardless of whether the original [medical records are]
223     protected health information is stored in electronic format; or
224          (ii) within 60 days after the day notice is received by the person fulfilling the request,
225     the person fulfilling the request shall provide the requested [records] protected health
226     information free of charge to the requester.
227          (e) Performance under Subsection (8)(d) shall be extended in accordance with
228     Subsection (8)(f) if the person fulfilling the request notifies the requester of:
229          (i) the occurrence of a force majeure event within 10 days from the day:
230          (A) the force majeure event occurs; or
231          (B) the person fulfilling the request receives notice of the request; and
232          (ii) the termination of the force majeure event within 10 days from the day the force
233     majeure event terminates.
234          (f) In accordance with Subsection (8)(e), for a force majeure event:
235          (i) that lasts less than eight days, the person fulfilling the request, if the [records are]
236     protected health information is not postmarked or otherwise made available electronically
237     within:
238          (A) 30 days of the day the force majeure event ends, may not charge a fee for an
239     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
240     the original [medical records are] protected health information is stored in electronic format;
241     and
242          (B) 60 days of the day the force majeure event ends, shall waive the entire fee for
243     providing the [records] protected health information;
244          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request,
245     if the [records are] protected health information is not postmarked or otherwise made available
246     electronically within:
247          (A) 60 days of the day the force majeure event ends, may not charge a fee for an
248     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
249     the original [medical records are] protected health information is stored in electronic format;
250     and
251          (B) 90 days of the day the force majeure event ends, shall waive the entire fee for
252     providing the [records] protected health information; and
253          (iii) that lasts more than 30 days, the person fulfilling the request, if the [records are]
254     protected health information is not postmarked or otherwise made available electronically
255     within:
256          (A) 90 days of the day the force majeure event ends, may not charge a fee for an
257     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
258     the original [medical records are] protected health information is stored in electronic format;
259     and
260          (B) 120 days of the day the force majeure event ends, shall waive the entire fee for
261     providing the [records] protected health information.
262          (9) (a) On January 1 of each year, the state treasurer shall adjust the following fees for
263     inflation:
264          (i) the fee for providing patient's [records] protected health information under
265     Subsections [(5)(a)(ii)(A)] (5)(a)(iii)(A) and (B); and
266          (ii) the maximum amount that may be charged for an electronic copy under Subsection
267     (8)(c)(ii)(B).
268          (b) On or before January 30 of each year, the state treasurer shall:
269          (i) certify the inflation-adjusted fees and maximum amounts calculated under this
270     section; and
271          (ii) notify the Administrative Office of the Courts of the information described in
272     Subsection (9)(b)(i) for posting on the court's website.
273          (10) Notwithstanding Subsections (4) through (6), if a request for a medical record is
274     accompanied by documentation of a qualified claim or appeal, a health care provider or the
275     health care provider's third-party service:
276          (a) may not charge a fee for the first copy of the record for each date of service that is
277     necessary to support the qualified claim or appeal in each calendar year;
278          (b) for a second or subsequent copy in a calendar year of a date of service that is
279     necessary to support the qualified claim or appeal, may charge a reasonable fee that may not:
280          (i) exceed 60 cents per page for paper photocopies;
281          (ii) exceed a reasonable cost for copies of X-ray photographs and other [health care
282     records] protected health information produced by similar processes;
283          (iii) include an administrative fee or additional service fee related to the production of
284     the medical record; or
285          (iv) exceed the fee provisions for an electronic copy under Subsection (8)(c); and
286          (c) shall provide the health record within 30 days after the day on which the request is
287     received by the health care provider.
288          (11) (a) Except as otherwise provided in Subsections (4) through (6), a health care
289     provider or the health care provider's third-party service shall waive all fees under this section
290     for an indigent individual.
291          (b) A health care provider or the health care provider's third-party service may require
292     the indigent individual or the indigent individual's authorized representative to provide proof
293     that the individual is an indigent individual by executing an affidavit.
294          (c) (i) An indigent individual that receives copies of a medical record at no charge
295     under this Subsection (11) is limited to one copy for each date of service for each health care
296     provider, or the health care provider's third-party service, in each calendar year.
297          (ii) Any request for additional copies in addition to the one copy allowed under
298     Subsection (11)(c) is subject to the fee provisions described in Subsection (10).
299          (12) By January 1, 2023, a health care provider and all of the health care provider's
300     contracted third party health related services shall accept a properly executed form described in
301     Section 26B-8-514.
302          Section 2. Effective date.
303          This bill takes effect on May 1, 2024.