Representative James A. Dunnigan proposes the following substitute bill:


1     
ACCESS TO PROTECTED HEALTH INFORMATION

2     
2024 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: James A. Dunnigan

5     
Senate Sponsor: Michael K. McKell

6     

7     LONG TITLE
8     General Description:
9          This bill addresses third-party access to medical records.
10     Highlighted Provisions:
11          This bill:
12          ▸     defines "payment and balance information";
13          ▸     clarifies the rights and obligations of persons involved in a third-party request for
14     medical records or payment and balance information; and
15          ▸     establishes a penalty for failure to fulfill a request for payment and balance
16     information.
17     Money Appropriated in this Bill:
18          None
19     Other Special Clauses:
20          None
21     Utah Code Sections Affected:
22     AMENDS:
23          78B-5-618, as last amended by Laws of Utah 2023, Chapters 287, 330
24     

25     Be it enacted by the Legislature of the state of Utah:
26          Section 1. Section 78B-5-618 is amended to read:
27          78B-5-618. Patient access to medical records -- Third-party access to medical
28     records -- Medical records services -- Fees -- Standard form.
29          (1) As used in this section:
30          (a) "Force majeure event" means an event or circumstance beyond the control of the
31     health care provider or the health care provider's third-party service, including fires, floods,
32     earthquakes, acts of God, lockouts, ransomware, or strikes.
33          (b) "Health care provider" means the same as that term is defined in Section
34     78B-3-403.
35          (c) "History of poor payment" means three or more invoices where payment is more
36     than 30 days late within a 12-month period.
37          (d) "Indigent individual" means an individual whose household income is at or below
38     100% of the federal poverty level as defined in Section 26B-3-113.
39          (e) "Inflation" means the unadjusted Consumer Price Index, as published by the Bureau
40     of Labor Statistics of the United States Department of Labor, that measures the average
41     changes in prices of goods and services purchased by urban wage earners and clerical workers.
42          (f) "Payment and balance information" means:
43          (i) all payments the health care provider has received for providing health care to the
44     patient; and
45          (ii) the total balance owed to the health care provider for providing the health care to
46     the patient.
47          [(f)] (g) "Qualified claim or appeal" means a claim or appeal under any:
48          (i) provision of the Social Security Act as defined in Section 67-11-2; or
49          (ii) federal or state financial needs-based benefit program.
50          [(g)] (h) "Third-party service" means a service that has entered into a contract with a
51     health care provider to provide patient records on behalf of a health care provider.
52          (2) Pursuant to Standards for Privacy of Individually Identifiable Health Information,
53     45 C.F.R., Parts 160 and 164, a patient or a patient's personal representative may inspect or
54     receive a copy of the patient's records from a health care provider when that health care
55     provider is governed by the provisions of 45 C.F.R., Parts 160 and 164.
56          (3) When a health care provider is not governed by Standards for Privacy of
57     Individually Identifiable Health Information, 45 C.F.R., Parts 160 and 164, a patient or a
58     patient's personal representative may inspect or receive a copy of the patient's records unless
59     access to the records is restricted by law or judicial order.
60          (4) A health care provider who provides a paper or electronic copy of a patient's
61     records to the patient or the patient's personal representative:
62          (a) shall provide the copy within the deadlines required by the Health Insurance
63     Portability and Accountability Act of 1996, Administrative Simplification rule, 45 C.F.R. Sec.
64     164.524(b); and
65          (b) may charge a reasonable cost-based fee provided that the fee includes only the cost
66     of:
67          (i) copying, including the cost of supplies for and labor of copying; and
68          (ii) postage, when the patient or patient's personal representative has requested the copy
69     be mailed.
70          (5) (a) Except for records provided under Section 26B-8-411, a health care provider or
71     a health care provider's third-party service that provides a copy of a patient's records to a
72     patient's attorney, legal representative, or other third party authorized to receive records:
73          (i) shall provide the copy within 30 days after receipt of notice;
74          (ii) may charge a reasonable fee for paper or electronic copies, but may not exceed the
75     following rates:
76          (A) $30 per request for locating a patient's records;
77          (B) reproduction charges may not exceed 53 cents per page for the first 40 pages and
78     32 cents per page for each additional page;
79          (C) the cost of postage when the requester has requested the copy be mailed;
80          (D) if requested, the person fulfilling the request will certify the record as a duplicate
81     of the original for a fee of $20; and
82          (E) any sales tax owed under Title 59, Chapter 12, Sales and Use Tax Act; and
83          (iii) may charge an expedition fee of $20 if:
84          (A) the requester's notice explicitly requests an expedited response; and
85          (B) the person fulfilling the request postmarks or otherwise makes the record available
86     electronically within 15 days from the day the person fulfilling the request receives notice of
87     the request.
88          (b) Notwithstanding the provisions of Subsection (5)(a)(ii) and subject to Subsection
89     (5)(c), in the event the requested records are not postmarked or otherwise made available
90     electronically by the person fulfilling the request:
91          (i) within 30 days after the day on which notice is received by the person fulfilling the
92     request, the person fulfilling the request shall waive 50% of the fee; or
93          (ii) within 60 days after the day on which notice is received by the person fulfilling the
94     request, the person fulfilling the request shall provide the requested records free of charge to
95     the requester.
96          (c) Performance under Subsection (5)(b) shall be extended in accordance with
97     Subsection (5)(d) if the person fulfilling the request notifies the requester of:
98          (i) the occurrence of a force majeure event within 10 days from the day:
99          (A) the force majeure event occurs; or
100          (B) the person fulfilling the request receives notice of the request; and
101          (ii) the termination of the force majeure event within 10 days from the day the force
102     majeure event terminates.
103          (d) In accordance with Subsection (5)(c), for a force majeure event:
104          (i) that lasts less than eight days, the person fulfilling the request shall, if the records
105     are not postmarked or otherwise made available electronically within:
106          (A) 30 days of the day the force majeure event ends, waive 50% of the fee for
107     providing the records; and
108          (B) 60 days of the day the force majeure event ends, waive the entire fee for providing
109     the records;
110          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request
111     shall, if the records are not postmarked or otherwise made available electronically within:
112          (A) 60 days of the day the force majeure event ends, waive 50% of the fee for
113     providing the records; and
114          (B) 90 days of the day the force majeure event ends, waive the entire fee for providing
115     the records; and
116          (iii) that lasts more than 30 days, the person fulfilling the request shall, if the records
117     are not postmarked or otherwise made available electronically within:
118          (A) 90 days of the day the force majeure event ends, waive 50% of the fee for
119     providing the records; and
120          (B) 120 days of the day the force majeure event ends, waive the entire fee for providing
121     the records.
122          (e) (i) A third-party service may require prepayment before sending records for a
123     request under this Subsection (5) if the third-party service:
124          (A) determines the requester has a history of poor payment; and
125          (B) notifies the requester, within the time periods described in [Subsection]
126     Subsections (5)(b)(i) and (ii), that the records will be sent as soon as the request has been
127     prepaid.
128          (ii) The fee reductions described in Subsection (5)(d) do not apply if a third-party
129     service complies with Subsection (5)(e)(i).
130          (f) If a third-party service does not possess or have access to the data necessary to
131     fulfill a request, the third-party service shall notify:
132          (i) the requester that the request cannot be fulfilled; and
133          (ii) state the reasons for the third-party service's inability to fulfill the request within 30
134     days from the day on which the request is received by the third-party service.
135          (g) A patient's attorney, legal representative, or other third party authorized to receive
136     records may request patient records directly from a third-party service.
137          (6) (a) A separate notice of request for payment and balance information shall:
138          (i) clearly indicate that the request is only for payment and balance information; and
139          (ii) indicate the name, telephone number, email address, and address of the requester.
140          (b) A health care provider or third-party service fulfilling a request for payment and
141     balance information from a patient's attorney, legal representative, or other third-party
142     representative, shall fulfill the request within 30 days after the day on which notice is received
143     by the health care provider or by the third-party service, whichever is fulfilling the request, by:
144          (i) mailing a postmarked copy of the information to the requester; or
145          (ii) providing the information electronically or telephonically.
146          (c) A health care provider or third-party service that is responsible for fulfilling a
147     request for payment and balance information but fails to:
148          (i) fulfill the request within 30 days, in accordance with Subsection (6)(b), shall pay, as
149     a penalty, $50; and
150          (ii) fulfill the request within 60 days shall pay, as a penalty, an additional $150.
151          (d) A health care provider or third-party service obligated to pay a penalty under
152     Subsection (6)(c) shall pay the amount owed:
153          (i) to reduce any amount the patient owes to the health care provider for the provision
154     of health care, after any third-party obligations to pay, if the amount owed is more than the
155     penalty;
156          (ii) directly to the patient, if the requested payment and balance information reflects
157     that the patient owes no amount to the health care provider for the provision of health care
158     services; or
159          (iii) allocated between:
160          (A) a payment to satisfy the amount the patient owes to the health care provider for the
161     provision of health care, as indicated on the payment and balance information; and
162          (B) a payment in the amount of any remaining penalty obligation to the patient.
163          (e) A third-party service may satisfy any obligation to pay a penalty under Subsection
164     (6)(c) by remitting the penalty amount to the health care provider to be allocated in accordance
165     with Subsection (6)(d).
166          (7) A health care provider or third-party service shall, if the health care provider or the
167     third-party service responding to a request for payment and balance information is unable to
168     comply with Subsection (6)(b), provide a written response that includes:
169          (a) contact information, if known, for the individual who the requester may contact to
170     fulfill the request; and
171          (b) the reason for not complying with Subsection (6)(b).
172          [(6)] (8) (a) [A] Subject to Subsection (8)(b), a health care provider that contracts with
173     a third-party service to fulfill the health care provider's medical record requests shall file a
174     statement with the Division of Professional Licensing containing:
175          (i) the name of the third-party service;
176          (ii) the phone number of the third-party service; [and]
177          (iii) the fax number, email address, website portal address, if applicable, and mailing
178     address for the third-party service where medical record requests can be sent for fulfillment[.];
179     and
180          (iv) beginning January 1, 2025, whether the third-party service is authorized to fulfill
181     requests for patient medical records for patient payment and balance information.
182          (b) If an individual health care provider is an employee or contractor of an organization
183     that is a health care provider and that contracts with a third-party service to fulfill the medical
184     record requests for the individual health care provider, the organization may file the statement
185     under Subsection (8)(a) on behalf of the organization's employees and contractors.
186          [(b)] (c) A health care provider described in Subsection [(6)(a)] (8)(a) shall update the
187     filing described in Subsection [(6)(a)] (8)(a) as necessary to ensure that the information is
188     accurate.
189          [(c)] (d) The Division of Professional Licensing shall develop a form for a health care
190     provider to complete that provides the information required by Subsection [(6)(a)] (8)(a).
191          [(d)] (e) The Division of Professional Licensing shall:
192          (i) maintain an index of statements described in Subsection [(6)(a)] (8)(a) arranged
193     alphabetically by entity; and
194          (ii) make the index available to the public electronically on the Division of
195     Professional Licensing's website.
196          [(7)] (9) A health care provider or the health care provider's third-party service shall
197     deliver the medical records in the electronic medium customarily used by the person fulfilling
198     the request or in a universally readable image such as portable document format:
199          (a) if the patient, patient's personal representative, or a third party authorized to receive
200     the records requests the records be delivered in an electronic medium; and
201          (b) the original medical record is readily producible in an electronic medium.
202          [(8)] (10) (a) Except as provided in Subsections [(8)(b)] (10)(b) through (d), the per
203     page fee in Subsections (4) and (5) applies to medical records reproduced electronically or on
204     paper.
205          (b) The per page fee for producing a copy of records in an electronic medium shall be
206     50% of the per page fee otherwise provided in this section, regardless of whether the original
207     medical records are stored in electronic format.
208          (c) (i) A health care provider or a health care provider's third-party service shall deliver
209     the medical records in the electronic medium customarily used by the health care provider or
210     the health care provider's third-party service or in a universally readable image, such as
211     portable document format, if the patient, patient's personal representative, patient's attorney,
212     legal representative, or a third party authorized to receive the records, requests the records be
213     delivered in an electronic medium.
214          (ii) A person fulfilling the request under Subsection [(8)(c)(i)] (10)(c)(i):
215          (A) shall provide the requested information within 30 days; and
216          (B) may not charge a fee for the electronic copy that exceeds $150 regardless of the
217     number of pages and regardless of whether the original medical records are stored in electronic
218     format.
219          (d) Subject to Subsection [(8)(e)] (10)(e), in the event the requested records under
220     Subsection [(8)(c)(i)] (10)(c)(i) are not postmarked or otherwise made available electronically
221     by the person fulfilling the request:
222          (i) within 30 days after the day notice is received by the person fulfilling the request,
223     the person fulfilling the request may not charge a fee for the electronic copy that exceeds $75
224     regardless of the number of pages and regardless of whether the original medical records are
225     stored in electronic format; or
226          (ii) within 60 days after the day notice is received by the person fulfilling the request,
227     the person fulfilling the request shall provide the requested records free of charge to the
228     requester.
229          (e) Performance under Subsection [(8)(d)] (10)(d) shall be extended in accordance with
230     Subsection [(8)(f)] (10)(f) if the person fulfilling the request notifies the requester of:
231          (i) the occurrence of a force majeure event within 10 days from the day:
232          (A) the force majeure event occurs; or
233          (B) the person fulfilling the request receives notice of the request; and
234          (ii) the termination of the force majeure event within 10 days from the day the force
235     majeure event terminates.
236          (f) In accordance with Subsection [(8)(e)] (10)(e), for a force majeure event:
237          (i) that lasts less than eight days, the person fulfilling the request, if the records are not
238     postmarked or otherwise made available electronically within:
239          (A) 30 days of the day the force majeure event ends, may not charge a fee for an
240     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
241     the original medical records are stored in electronic format; and
242          (B) 60 days of the day the force majeure event ends, shall waive the entire fee for
243     providing the records;
244          (ii) that lasts at least eight days but less than 30 days, the person fulfilling the request,
245     if the records are not postmarked or otherwise made available electronically within:
246          (A) 60 days of the day the force majeure event ends, may not charge a fee for an
247     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
248     the original medical records are stored in electronic format; and
249          (B) 90 days of the day the force majeure event ends, shall waive the entire fee for
250     providing the records; and
251          (iii) that lasts more than 30 days, the person fulfilling the request, if the records are not
252     postmarked or otherwise made available electronically within:
253          (A) 90 days of the day the force majeure event ends, may not charge a fee for an
254     electronic copy that exceeds $75 regardless of the number of pages and regardless of whether
255     the original medical records are stored in electronic format; and
256          (B) 120 days of the day the force majeure event ends, shall waive the entire fee for
257     providing the records.
258          [(9)] (11) (a) On January 1 of each year, the state treasurer shall adjust the following
259     fees for inflation:
260          (i) the fee for providing patient's records under Subsections [(5)(a)(ii)(A)] (5)(a)(iii)(A)
261     and (B); and
262          (ii) the maximum amount that may be charged for an electronic copy under Subsection
263     [(8)(c)(ii)(B)] (10)(c)(ii)(B).
264          (b) On or before January 30 of each year, the state treasurer shall:
265          (i) certify the inflation-adjusted fees and maximum amounts calculated under this
266     section; and
267          (ii) notify the Administrative Office of the Courts of the information described in
268     Subsection [(9)(b)(i)] (11)(b)(i) for posting on the court's website.
269          [(10)] (12) Notwithstanding Subsections (4) through [(6)] (8), if a request for a medical
270     record is accompanied by documentation of a qualified claim or appeal, a health care provider
271     or the health care provider's third-party service:
272          (a) may not charge a fee for the first copy of the record for each date of service that is
273     necessary to support the qualified claim or appeal in each calendar year;
274          (b) for a second or subsequent copy in a calendar year of a date of service that is
275     necessary to support the qualified claim or appeal, may charge a reasonable fee that may not:
276          (i) exceed 60 cents per page for paper photocopies;
277          (ii) exceed a reasonable cost for copies of X-ray photographs and other health care
278     records produced by similar processes;
279          (iii) include an administrative fee or additional service fee related to the production of
280     the medical record; or
281          (iv) exceed the fee provisions for an electronic copy under Subsection [(8)(c)] (10)(c);
282     and
283          (c) shall provide the health record within 30 days after the day on which the request is
284     received by the health care provider.
285          [(11)] (13) (a) Except as otherwise provided in Subsections (4) through [(6)] (8), a
286     health care provider or the health care provider's third-party service shall waive all fees under
287     this section for an indigent individual.
288          (b) A health care provider or the health care provider's third-party service may require
289     the indigent individual or the indigent individual's authorized representative to provide proof
290     that the individual is an indigent individual by executing an affidavit.
291          (c) (i) An indigent individual that receives copies of a medical record at no charge
292     under this Subsection [(11)] (13) is limited to one copy for each date of service for each health
293     care provider, or the health care provider's third-party service, in each calendar year.
294          (ii) Any request for additional copies in addition to the one copy allowed under
295     Subsection [(11)(c)] (13)(c) is subject to the fee provisions described in Subsection [(10)] (12).
296          [(12)] (14) By January 1, 2023, a health care provider and all of the health care
297     provider's contracted third party health related services shall accept a properly executed form
298     described in Section 26B-8-514.
299          Section 2. Effective date.
300          This bill takes effect on May 1, 2024.