Representative James A. Dunnigan proposes the following substitute bill:


1     
ACCESS TO PROTECTED HEALTH INFORMATION

2     
2024 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: James A. Dunnigan

5     
Senate Sponsor: ____________

6     

7     LONG TITLE
8     General Description:
9          This bill addresses third-party access to medical records.
10     Highlighted Provisions:
11          This bill:
12          ▸     defines "payment and balance information";
13          ▸     requires a person responding to a third-party's request for medical records to include
14     certain information in the response; and
15          ▸     establishes a procedure by which a person may request only payment and balance
16     information, as opposed to medical records generally, with up to $400 in penalties
17     for failure to timely respond to the request.
18     Money Appropriated in this Bill:
19          None
20     Other Special Clauses:
21          None
22     Utah Code Sections Affected:
23     AMENDS:
24          78B-5-618, as last amended by Laws of Utah 2023, Chapters 287, 330
25     

26     Be it enacted by the Legislature of the state of Utah:
27          Section 1. Section 78B-5-618 is amended to read:
28          78B-5-618. Patient access to medical records -- Third-party access to medical
29     records -- Medical records services -- Fees -- Standard form.
30          (1) As used in this section:
31          (a) "Force majeure event" means an event or circumstance beyond the control of the
32     health care provider or the health care provider's third-party service, including fires, floods,
33     earthquakes, acts of God, lockouts, ransomware, or strikes.
34          (b) "Health care provider" means the same as that term is defined in Section
35     78B-3-403.
36          (c) "History of poor payment" means three or more invoices where payment is more
37     than 30 days late within a 12-month period.
38          (d) "Indigent individual" means an individual whose household income is at or below
39     100% of the federal poverty level as defined in Section 26B-3-113.
40          (e) "Inflation" means the unadjusted Consumer Price Index, as published by the Bureau
41     of Labor Statistics of the United States Department of Labor, that measures the average
42     changes in prices of goods and services purchased by urban wage earners and clerical workers.
43          (f) "Payment and balance information" means information, or a summary of the
44     information, maintained by a health care provider during the normal course of business to track
45     a patient's financial obligations to the health care provider for the provision of health care, and
46     the satisfaction of those obligations:
47          (i) all payments the health care provider has received for providing health care to the
48     patient; and
49          (ii) the total balance owed to the health care provider for providing the health care to
50     the patient.
51          [(f)] (g) "Qualified claim or appeal" means a claim or appeal under any:
52          (i) provision of the Social Security Act as defined in Section 67-11-2; or
53          (ii) federal or state financial needs-based benefit program.
54          [(g)] (h) "Third-party service" means a service that has entered into a contract with a
55     health care provider to provide patient records on behalf of a health care provider.
56          (2) Pursuant to Standards for Privacy of Individually Identifiable Health Information,
57     45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or
58     receive a copy of the patient's records from a health care provider when that health care
59     provider is governed by the provisions of 45 C.F.R., Parts 160 and 164.
60          (3) When a health care provider is not governed by Standards for Privacy of
61     Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a
62     patient's personal representative may inspect or receive a copy of the patient's records unless
63     access to the records is restricted by law or judicial order.
64          (4) A health care provider who provides a paper or electronic copy of a patient's
65     records to the patient or the patient's personal representative:
66          (a) shall provide the copy within the deadlines required by the Health Insurance
67     Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec.
68     164.524(b); and
69          (b) may charge a reasonable cost-based fee provided that the fee includes only the cost
70     of:
71          (i) copying, including the cost of supplies for and labor of copying; and
72          (ii) postage, when the patient or patient's personal representative has requested the copy
73     be mailed.
74          (5) (a) Except for records provided under Section 26B-8-411, a health care provider or
75     a health care provider's third-party service that provides a copy of a patient's records to a
76     patient's attorney, legal representative, or other third party authorized to receive records:
77          (i) shall provide the copy within 30 days after receipt of notice;
78          (ii) shall, if the health care provider or the third-party service completing the request on
79     behalf of a health care provider will not comply with Subsection (5)(a)(i), provide a written
80     response that includes:
81          (A) contact information for the individual who the person making the request may
82     contact regarding the request; and
83          (B) the reason for not complying with Subsection (5)(a)(i);
84          [(ii)] (iii) may charge a reasonable fee for paper or electronic copies, but may not
85     exceed the following rates:
86          (A) $30 per request for locating a patient's records;
87          (B) reproduction charges may not exceed 53 cents per page for the first 40 pages and
88     32 cents per page for each additional page;
89          (C) the cost of postage when the requester has requested the copy be mailed;
90          (D) if requested, the person fulfilling the request will certify the record as a duplicate
91     of the original for a fee of $20; and
92          (E) any sales tax owed under Title 59, Chapter 12, Sales and Use Tax Act; and
93          [(iii)] (iv) may charge an expedition fee of $20 if:
94          (A) the requester's notice explicitly requests an expedited response; and
95          (B) the person fulfilling the request postmarks or otherwise makes the record available
96     electronically within 15 days from the day the person fulfilling the request receives notice of
97     the request.
98          (b) Notwithstanding the provisions of Subsection [(5)(a)(ii)] (5)(a)(iii) and subject to
99     Subsection (5)(c), in the event the requested records are not postmarked or otherwise made
100     available electronically by the person fulfilling the request:
101          (i) within 30 days after the day on which notice is received by the person fulfilling the
102     request, the person fulfilling the request shall waive 50% of the fee; or
103          (ii) within 60 days after the day on which notice is received by the person fulfilling the
104     request, the person fulfilling the request shall provide the requested records free of charge to
105     the requester.
106          (c) Performance under Subsection (5)(b) shall be extended in accordance with
107     Subsection (5)(d) if the person fulfilling the request notifies the requester of:
108          (i) the occurrence of a force majeure event within 10 days from the day:
109          (A) the force majeure event occurs; or
110          (B) the person fulfilling the request receives notice of the request; and
111          (ii) the termination of the force majeure event within 10 days from the day the force
112     majeure event terminates.
113          (d) In accordance with Subsection (5)(c), for a force majeure event:
114          (i) that lasts less than eight days, the person fulfilling the request shall, if the records
115     are not postmarked or otherwise made available electronically within:
116          (A) 30 days of the day the force majeure event ends, waive 50% of the fee for
117     providing the records; and
118          (B) 60 days of the day the force majeure event ends, waive the entire fee for providing
119     the records;
120          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request
121     shall, if the records are not postmarked or otherwise made available electronically within:
122          (A) 60 days of the day the force majeure event ends, waive 50% of the fee for
123     providing the records; and
124          (B) 90 days of the day the force majeure event ends, waive the entire fee for providing
125     the records; and
126          (iii) that lasts more than 30 days, the person fulfilling the request shall, if the records
127     are not postmarked or otherwise made available electronically within:
128          (A) 90 days of the day the force majeure event ends, waive 50% of the fee for
129     providing the records; and
130          (B) 120 days of the day the force majeure event ends, waive the entire fee for providing
131     the records.
132          (e) (i) A third-party service may require prepayment before sending records for a
133     request under this Subsection (5) if the third-party service:
134          (A) determines the requester has a history of poor payment; and
135          (B) notifies the requester, within the time periods described in [Subsection]
136     Subsections (5)(b)(i) and (ii), that the records will be sent as soon as the request has been
137     prepaid.
138          (ii) The fee reductions described in Subsection (5)(d) do not apply if a third-party
139     service complies with Subsection (5)(e)(i).
140          (f) If a third-party service does not possess or have access to the data necessary to
141     fulfill a request, the third-party service shall notify:
142          (i) the requester that the request cannot be fulfilled; and
143          (ii) state the reasons for the third-party service's inability to fulfill the request within 30
144     days from the day on which the request is received by the third-party service.
145          (g) A patient's attorney, legal representative, or other third party authorized to receive
146     records may request patient records directly from a third-party service.
147          (6) (a) A notice of request only for payment and balance information shall:
148          (i) clearly indicate that the request is only for payment and balance information; and
149          (ii) indicate the name, telephone number, email address, and address of the person or
150     entity making the request.
151          (b) A health care provider or third-party service fulfilling a request for only payment
152     and balance information from a patient's attorney, legal representative, or other third-party
153     representative, shall fulfill the request within 30 days after the day on which notice is received,
154     by:
155          (i) mailing a postmarked copy of the information to the requester; or
156          (ii) providing the information electronically or telephonically.
157          (c) A health care provider or third-party service that has access to the requested
158     payment and balance information but fails to:
159          (i) comply with Subsection (6)(b) shall pay, as a penalty, $200; and
160          (ii) fulfill the request within 60 days shall pay, as a penalty, an additional $200.
161          (d) A health care provider or third-party service obligated to pay a penalty under
162     Subsection (6)(c) shall pay it:
163          (i) to reduce any amount the patient owes to the health care provider for the provision
164     of health care, after any third-party obligations to pay, if the amount owed is more than the
165     penalty;
166          (ii) directly to the patient, if the requested payment and balance information to which
167     the health care provider or third-party service has access reflect that the patient owes no
168     amount to the health care provider for the provision of health care services; or
169          (iii) allocated between:
170          (A) a payment to satisfy the amount the patient owes to the health care provider for the
171     provision of health care, as indicated on the payment and balance information; and
172          (B) a payment in the amount of any remaining penalty obligation to the patient.
173          (7) A health care provider or third-party service shall, if the health care provider or the
174     third-party service completing the request on behalf of a health care provider will not comply
175     with Subsection (6)(b), provide a written response that includes:
176          (a) contact information for the individual who the person making the request may
177     contact regarding the request; and
178          (b) the reason for not complying with Subsection (5)(a)(i)
179          [(6)] (8) (a) (i) [A] Subject to Subsection (7)(a)(ii), a health care provider that contracts
180     with a third-party service to fulfill the health care provider's medical record requests shall file a
181     statement with the Division of Professional Licensing containing:
182          [(i)] (A) the name of the third-party service;
183          [(ii)] (B) the phone number of the third-party service; and
184          [(iii)] (C) the fax number, email address, website portal address, if applicable, and
185     mailing address for the third-party service where medical record requests can be sent for
186     fulfillment.
187          (ii) If an individual health care provider is an employee or contractor of an organization
188     that is a health care provider and that contracts with a third-party service to fulfill the medical
189     record requests for the individual health care provider, the organization may file the statement
190     under Subsection (6)(a)(i) on behalf of the organization's employees and contractors.
191          (b) A health care provider described in Subsection [(6)(a)] (7)(a) shall update the filing
192     described in Subsection [(6)(a)] (7)(a) as necessary to ensure that the information is accurate.
193          (c) The Division of Professional Licensing shall develop a form for a health care
194     provider to complete that provides the information required by Subsection [(6)(a)] (7)(a).
195          (d) The Division of Professional Licensing shall:
196          (i) maintain an index of statements described in Subsection [(6)(a)] (7)(a) arranged
197     alphabetically by entity; and
198          (ii) make the index available to the public electronically on the Division of
199     Professional Licensing's website.
200          [(7)] (9) A health care provider or the health care provider's third-party service shall
201     deliver the medical records in the electronic medium customarily used by the person fulfilling
202     the request or in a universally readable image such as portable document format:
203          (a) if the patient, patient's personal representative, or a third party authorized to receive
204     the records requests the records be delivered in an electronic medium; and
205          (b) the original medical record is readily producible in an electronic medium.
206          [(8)] (10) (a) Except as provided in Subsections [(8)(b)] (9)(b) through (d), the per
207     page fee in Subsections (4) and (5) applies to medical records reproduced electronically or on
208     paper.
209          (b) The per page fee for producing a copy of records in an electronic medium shall be
210     50% of the per page fee otherwise provided in this section, regardless of whether the original
211     medical records are stored in electronic format.
212          (c) (i) A health care provider or a health care provider's third-party service shall deliver
213     the medical records in the electronic medium customarily used by the health care provider or
214     the health care provider's third-party service or in a universally readable image, such as
215     portable document format, if the patient, patient's personal representative, patient's attorney,
216     legal representative, or a third party authorized to receive the records, requests the records be
217     delivered in an electronic medium.
218          (ii) A person fulfilling the request under Subsection [(8)(c)(i)] (9)(c)(i):
219          (A) shall provide the requested information within 30 days; and
220          (B) may not charge a fee for the electronic copy that exceeds $150 regardless of the
221     number of pages and regardless of whether the original medical records are stored in electronic
222     format.
223          (d) Subject to Subsection [(8)(e)] (9)(e), in the event the requested records under
224     Subsection [(8)(c)(i)] (9)(c)(i) are not postmarked or otherwise made available electronically by
225     the person fulfilling the request:
226          (i) within 30 days after the day notice is received by the person fulfilling the request,
227     the person fulfilling the request may not charge a fee for the electronic copy that exceeds $75
228     regardless of the number of pages and regardless of whether the original medical records are
229     stored in electronic format; or
230          (ii) within 60 days after the day notice is received by the person fulfilling the request,
231     the person fulfilling the request shall provide the requested records free of charge to the
232     requester.
233          (e) Performance under Subsection [(8)(d)] (9)(d) shall be extended in accordance with
234     Subsection [(8)(f)] (9)(f) if the person fulfilling the request notifies the requester of:
235          (i) the occurrence of a force majeure event within 10 days from the day:
236          (A) the force majeure event occurs; or
237          (B) the person fulfilling the request receives notice of the request; and
238          (ii) the termination of the force majeure event within 10 days from the day the force
239     majeure event terminates.
240          (f) In accordance with Subsection [(8)(e)] (9)(e), for a force majeure event:
241          (i) that lasts less than eight days, the person fulfilling the request, if the records are not
242     postmarked or otherwise made available electronically within:
243          (A) 30 days of the day the force majeure event ends, may not charge a fee for an
244     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
245     the original medical records are stored in electronic format; and
246          (B) 60 days of the day the force majeure event ends, shall waive the entire fee for
247     providing the records;
248          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request,
249     if the records are not postmarked or otherwise made available electronically within:
250          (A) 60 days of the day the force majeure event ends, may not charge a fee for an
251     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
252     the original medical records are stored in electronic format; and
253          (B) 90 days of the day the force majeure event ends, shall waive the entire fee for
254     providing the records; and
255          (iii) that lasts more than 30 days, the person fulfilling the request, if the records are not
256     postmarked or otherwise made available electronically within:
257          (A) 90 days of the day the force majeure event ends, may not charge a fee for an
258     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
259     the original medical records are stored in electronic format; and
260          (B) 120 days of the day the force majeure event ends, shall waive the entire fee for
261     providing the records.
262          [(9)] (11) (a) On January 1 of each year, the state treasurer shall adjust the following
263     fees for inflation:
264          (i) the fee for providing patient's records under Subsections (5)(a)(ii)(A) and (B); and
265          (ii) the maximum amount that may be charged for an electronic copy under Subsection
266     [(8)(c)(ii)(B)] (9)(c)(ii)(B).
267          (b) On or before January 30 of each year, the state treasurer shall:
268          (i) certify the inflation-adjusted fees and maximum amounts calculated under this
269     section; and
270          (ii) notify the Administrative Office of the Courts of the information described in
271     Subsection [(9)(b)(i)] (10)(b)(i) for posting on the court's website.
272          [(10)] (12) Notwithstanding Subsections (4) through (6), if a request for a medical
273     record is accompanied by documentation of a qualified claim or appeal, a health care provider
274     or the health care provider's third-party service:
275          (a) may not charge a fee for the first copy of the record for each date of service that is
276     necessary to support the qualified claim or appeal in each calendar year;
277          (b) for a second or subsequent copy in a calendar year of a date of service that is
278     necessary to support the qualified claim or appeal, may charge a reasonable fee that may not:
279          (i) exceed 60 cents per page for paper photocopies;
280          (ii) exceed a reasonable cost for copies of X-ray photographs and other health care
281     records produced by similar processes;
282          (iii) include an administrative fee or additional service fee related to the production of
283     the medical record; or
284          (iv) exceed the fee provisions for an electronic copy under Subsection [(8)(c)] (9)(c);
285     and
286          (c) shall provide the health record within 30 days after the day on which the request is
287     received by the health care provider.
288          [(11)] (13) (a) Except as otherwise provided in Subsections (4) through [(6)] (7), a
289     health care provider or the health care provider's third-party service shall waive all fees under
290     this section for an indigent individual.
291          (b) A health care provider or the health care provider's third-party service may require
292     the indigent individual or the indigent individual's authorized representative to provide proof
293     that the individual is an indigent individual by executing an affidavit.
294          (c) (i) An indigent individual that receives copies of a medical record at no charge
295     under this Subsection [(11)] (12) is limited to one copy for each date of service for each health
296     care provider, or the health care provider's third-party service, in each calendar year.
297          (ii) Any request for additional copies in addition to the one copy allowed under
298     Subsection [(11)(c)] (12)(c) is subject to the fee provisions described in Subsection [(10)] (11).
299          [(12)] (14) By January 1, 2023, a health care provider and all of the health care
300     provider's contracted third party health related services shall accept a properly executed form
301     described in Section 26B-8-514.
302          Section 2. Effective date.
303          This bill takes effect on May 1, 2024.