BILL NUMBER: S4762

SPONSOR: LANZA
 
TITLE OF BILL:

An act to amend the penal law, in relation to the unlawful possession of
a patient record

 
PURPOSE:

This bill will criminalize the unlawful possession of a patient record.

 
SUMMARY OF PROVISIONS:

Section 1 adds a new section 250.70 to the Penal law, creating the crime
of unlawful possession of a patient record, a class A misdemeanor. A
person not authorized by the federal Health Insurance Portability and
Accountability Act (HIPAA) who obtains a patient record without legal
authority and disregards a written demand by a health care provider or a
patient to return or destroy the record would be guilty of a class A
misdemeanor, and subject to up to a year in jail and a fine.

              

Section 2 makes the law effective sixty days after it shall have become
a law

 
EXISTING LAW:

Public Health Law Section 18 provides patients and other qualified
persons with access to patient information and provides procedures for
making records available and outlines conditions under which a provider
can deny access. It also provides a right to appeal any denial. In addi-
tion health care providers must also comply with the federal HIPAA law,
which generally requires such providers to provide patients with access
to all medical records and billing records, with the exception of
psychotherapy notes.

 
JUSTIFICATION:

Federal and NYS laws and regulations, including HIPAA, require health
care providers to safeguard a patient's protected health information
(PHI), and prohibit the disclosure of PHI without a lawful purpose.
Despite the best efforts of health care providers, breaches of PHI
occur, sometimes inadvertently, sometimes as a result of deliberate
security breaches. In such instances these laws and regulations impose
several obligations on providers, including the obligation to "mitigate"
the breach. In particular, if the provider sent or gave a document with
PHI to the wrong person, the provider must retrieve or arrange for the
destruction in that document. For example, it is not uncommon a provider
to fax a document with PHI to the wrong number, or to email a document
with PHI to the wrong recipient.

In most instances, when a provider contacts a person who wrongfully or
mistakenly received another's PHI, the recipient will cooperate in
returning or destroying the document. That cooperation reflects basic
decency recognition of the need to protect the privacy of others. But in
some cases, persons who wrongfully or mistakenly receive a record will-
fully refuse a provider's request to return or destroy it, without
legitimate reason. Indeed, in some instances the recipient may amplify
the harm by further disseminating the record they received or by
disclosing the information in it. Federal and NYS regulations apply only
to health care providers, and do not constrain such egregious conduct by
members of the public.

A careful and measured penal provision, aimed persons who wrongfully
refuse to return records that include PHI about another person, after a
written request by the provider or subject, would protect patient priva-
cy without impairing any legitimate interest of the public.

 
LEGISLATIVE HISTORY:

2022: S.6096 - Referred to Codes

2021: S.6096 - Referred to Codes

2020: S.3175 - Referred to Codes

2019: S.3175 - Referred to Codes

2018: S.7911 - Third Reading Calendar

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
60 Days after it shall become a law.