TITLE XXX
OCCUPATIONS AND PROFESSIONS

Chapter 332-I
MEDICAL RECORDS, PATIENT INFORMATION, AND THE HEALTH INFORMATION ORGANIZATION CORPORATION

Section 332-I:1

    332-I:1 Medical Records; Definitions. –
I. All medical information contained in the medical records in the possession of any health care provider shall be deemed to be the property of the patient. The patient shall be entitled to a copy of such records upon request. The charge for the copying of a patient's medical records shall not exceed $15 for the first 30 pages or $.50 per page, whichever is greater; provided, that copies of filmed records such as radiograms, x-rays, and sonograms shall be copied at a reasonable cost.
II. In this chapter:
(a) The following terms have the same meaning as given in the regulations under sections 262 and 264 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA):
(1) Business associate;
(2) Use;
(3) Disclosure; and
(4) Protected health information.
(b) "Health care provider" means any person, corporation, facility, or institution either licensed by this state or otherwise lawfully providing health care services, including, but not limited to, a physician, advanced practice registered nurse, physician assistant, hospital, office, clinic, health center or other health care facility, dentist, nurse, optometrist, pharmacist, podiatrist, physical therapist, mental health professional, care coordinator, managed care provider, or the department of health and human services, and any officer, employee, or agent of such provider acting in the course and scope of employment or agency related to or supportive of health care services.
(c) [Repealed.]
(d) "Marketing" means:
(1) To make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless the communication is made by the individual's health care provider;
(A) For treatment of the individual;
(B) For case management or care coordination for the individual;
(C) To direct or recommend to the individual:
(i) Alternative treatments or therapies if recommended by the individual's health care provider;
(ii) Health care providers;
(iii) Settings of care; or
(D) For treatment-related reminders or health promotion activities by health care providers.
(2) An arrangement between a health care provider and any other person whereby the health care provider discloses protected health information to the other person, in exchange for direct or indirect remuneration, for the other person or an affiliate of the other person to make a communication about the person's own product or service that encourages recipients of the communication to purchase or use that product or service.
(e) "Audit trail" means a chronological record identifying specific persons who have accessed an electronic medical record, the date and time the record was accessed, and, if such information is available, the area of the record that was accessed. An audit trail shall not be considered a part of a person's medical care.
(f) "Individual" means the subject of the protected health information, including a guardian or other legal representative.
(g) [Repealed.]
(h) [Repealed.]
III. Release or use of patient identifiable medical information for the purpose of sales or marketing of services or products shall be prohibited without written authorization.

Source. 1989, 43:2. 1997, 331:11. 1998, 236:2. 2001, 85:2. 2004, 144:1. 2006, 250:1. 2009, 213:5; 318:2. 2010, 64:1. 2011, 232:2, 3. 2014, 189:1, eff. Sept. 9, 2014. 2020, 37:4, XXIII, XXIV, eff. July 29, 2020.

Section 332-I:2

    332-I:2 Patient Information. –
I. (a) The patient has the right to courtesy, respect, dignity, responsiveness, and timely attention to his or her needs.
(b) The patient has the right to receive information from the health care provider and to discuss the benefits, risks, and costs of appropriate treatment alternatives.
(c) The patient shall be fully informed by the health care provider of his or her medical condition, health care needs and diagnostic test results, including the manner by which such results will be provided and the expected time interval between testing and receiving results, unless medically inadvisable and so documented in the medical record.
(d) The patient has the right to make decisions regarding the health care that is recommended by the health care provider. Accordingly, patients may accept or refuse any recommended medical treatment and be involved in experimental research upon the patient's written consent only.
(e) The health care provider shall not reveal confidential communications or information without the consent of the patient, unless provided for by law or by the need to protect the welfare of the individual or the public interest.
(f) Subject to the terms and conditions of the patient's insurance plan, the patient shall have access to any provider in his or her insurance plan network and referral to a provider or facility within such network shall not be unreasonably withheld pursuant to RSA 420-J:8, XIV.
(g) When an individual's medical record is maintained in electronic form, the individual has the right to a report, based on whatever audit trail of that record is then maintained, of access to the record by a health care provider named by the individual within an identified period in the prior 3 years. The report shall indicate whether the named provider had access, or did not have access, or whether access could not be determined with the available data. If the named provider had access, the report shall summarize, as the available data permit, the extent of access to the record. This subparagraph shall not apply to individuals being held in correctional facilities within the state.
II. Facilities subject to RSA 151:21 and RSA 151:21-b shall be exempt from paragraph I.

Source. 1997, 331:12. 2006, 250:2. 2009, 252:2. 2010, 64:2, eff. Jan. 1, 2011.

Section 332-I:3

    332-I:3 Use and Disclosure of Protected Health Information; Health Information Exchange. –
I. Except as provided in paragraph VI, a health care provider or a business associate of a health care provider or a patient or patient's legal representative may transmit the patient's protected health information through the health information organization. Only a health care provider, for purposes of treatment, care coordination, or quality assurance, or a patient or a patient's legal representative with respect to the patient's protected health information, may have access to protected health information transmitted through the health information organization.
II. The health information organization shall adhere to the protected health information requirements for health care providers in state and federal law.
III. The health information organization shall maintain an audit log of the transactions transmitted through the health information organization. The parties transmitting or receiving information through the health information organization shall maintain audit logs in accordance with nationally accepted interoperability standards, practices, regulations, and statutes, including but not limited to:
(a) The identity of the health care provider accessing the information;
(b) The identity of the individual whose protected health information was accessed by the health care provider;
(c) The date the protected health information was accessed; and
(d) The area of the record that was accessed.

[Paragraph IV, as amended by 2011, 232:4, shall take effect upon the date provided by 2009, 318:5; see "Applicability; Certification" note below.]


IV. The health information organization shall be certified, when federal certification standards are established, to be in compliance with nationally accepted interoperability standards and practices.
V. No person shall require a health care provider to participate in the health information organization as a condition of payment or participation.
VI. An individual shall be given an opportunity to opt out of sharing his or her name and address and his or her protected health care information through the health information organization. Such an opportunity shall be provided in a clear and conspicuous manner, including, but not limited to, simple opt out language in a font and size easily readable by the average adult reader so that the individual may make his or her decision known.
VII. The health information organization shall follow all current and future laws relative to medical information privacy and all existing laws regarding health information exchanges.
VIII. Notwithstanding paragraph I, health care providers otherwise required or authorized by law to submit data to the department of health and human services may do so through a health information organization; provided, that such transmissions meet the same standards for privacy and security of protected health information that apply when such information is exchanged between providers.

Source. 2009, 318:4. 2011, 232:4. 2012, 184:1. 2014, 189:2, 3, eff. Sept. 9, 2014.

Section 332-I:4

    332-I:4 Use and Disclosure of Protected Health Information; Marketing; Fundraising. –
I. A health care provider, or a business associate of the health care provider, shall obtain an authorization for any use or disclosure of protected health information for marketing. Such authorization shall meet the authorization implementation specifications for marketing under the regulations adopted pursuant to sections 262 and 264 of HIPAA, as amended.
II. (a) For use or disclosure of protected health information for fundraising, a health care provider, or a business associate of the health care provider, shall, in a clear and conspicuous manner, provide an opportunity for any intended recipient of one or more fundraising communications to elect not to receive such communications. A clear and conspicuous opportunity shall include, but not be limited to, simple election language and type of a sufficient size as to be easily readable by the average adult reader. Such opportunity shall be provided:
(1) Sixty days prior to any fundraising communication; or
(2) Upon presentation of the notice of privacy practices required by regulations adopted pursuant to sections 262 and 264 of HIPAA, as amended, if such notice is given to the intended recipient prior to any fundraising communication; or
(3) To an individual who does not elect to not receive fundraising communications in the opportunities in subparagraph (1) or (2), in any subsequent written fundraising communications.
(b) When an individual elects not to receive any fundraising communication, such election shall be treated as a revocation of authorization under 45 C.F.R. section 164.508.
III. Protected health information disclosed for marketing or fundraising shall not be disclosed by voice mail, an unattended facsimile, or through other methods of communication that are not secure.

Source. 2009, 213:6, eff. Jan. 1, 2010 at 12:01 a.m.

Section 332-I:5

    332-I:5 Unauthorized Disclosure. – In the event of a use or disclosure of protected health information by a health care provider or a business associate of a health care provider that is allowed under federal law but not permitted by RSA 332-I:4, the health care provider shall promptly notify in writing the individual or individuals whose protected health information was disclosed. A business associate shall be responsible for the cost of such notification if the use or disclosure was by the business associate.

Source. 2009, 213:6, eff. Jan. 1, 2010 at 12:01 a.m.

Section 332-I:6

    332-I:6 Complaints; Right of Action. – An aggrieved individual may bring a civil action under RSA 332-I:4 or RSA 332-I:5 and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.

Source. 2009, 213:6, eff. Jan. 1, 2010 at 12:01 a.m.

Section 332-I:7 to 332-I:10

    332-I:7 to 332-I:10 Repealed by 2020, 37:4, XXII, eff. July 29, 2020. –

Section 332-I:11

    332-I:11 Limited Immunity. – Any health care provider who relies in good faith upon any information provided through the health information organization in the treatment of a patient, shall be immune from any criminal or civil liability arising from any damages caused by such good faith reliance. This immunity shall not apply to acts or omissions constituting negligence or reckless, wanton, or intentional misconduct.

Source. 2011, 232:5, eff. July 5, 2011.

Section 332-I:12

    332-I:12 Disposition of Assets. – In the event of the dissolution of the corporation, its remaining assets after payment of all debts and obligations of the corporation, if any, shall be distributed for one or more exempt purposes within the meaning of section 501(c)(3) of the Internal Revenue Code, or the corresponding section of any future federal tax code, or shall be distributed to the federal government, or to a state or local government, for a public purpose. Any such assets not disposed of shall be disposed by a court of competent jurisdiction of the county in which the principal office of the corporation is then located, exclusively for such purposes or to such organization or organizations as the court shall determine, which are organized and operated exclusively for such purposes.

Source. 2012, 23:2, eff. Apr. 25, 2012.

Section 332-I:13

    332-I:13 Medical Records of Deceased Spouse or Next of Kin. –
I. Where there is no estate administration, the surviving spouse or next of kin of the deceased is designated the personal representative of the deceased for the limited purpose of obtaining the medical records of the deceased. Such authority shall automatically cease upon the initiation of estate administration or the death of the surviving spouse or next of kin.
II. (a) "Next of kin" means:
(1) Adult child by blood or adoption only in the absence of a surviving spouse.
(2) Parent, only in the absence of a surviving spouse or adult child.
(b) If 2 or more relatives in the same category qualify as next of kin, each shall be considered the deceased's personal representative under this section.
III. (a) Where there is no estate administration, the requestor shall provide:
(1) A notarized affidavit, pursuant to paragraph VII, indicating he or she is authorized to access the patient's records;
(2) An authorization in compliance with the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. section 1320d et seq., and the regulations implementing such act ("HIPAA"); and
(3) A copy of the death certificate.
(b) Upon request, a health care provider, as defined in RSA 332-I:1, II(b), shall provide the surviving spouse or next of kin with a copy of the legal medical records of the deceased, unless the deceased has indicated or any court of competent jurisdiction has ordered that the surviving spouse or next of kin not have access to those records. The health care provider shall provide such records within the time frame established under 45 C.F.R. 164.524(b)(2). Requests under this subparagraph shall be valid within the time frame established under RSA 508:4.
(c) A health care provider shall not release mental health records or other medical records afforded additional privacy protection under other state or federal law.
IV. A health care provider shall not be required to initiate a conversation with a patient on the subject of access to the information in a medical record by a surviving spouse or next of kin.
V. Any provider shall be justified in relying upon the affidavit provided in accordance with paragraph III.
VI. Any provider or person who in good faith releases copies of medical records in accordance with this section shall not have violated any criminal law or be civilly liable to the patient, the deceased patient's estate, or to any other person for the release of such medical records.
VII. An affidavit in the following form shall be used by any surviving spouse or next of kin seeking records under this section.
AFFIDAVIT OF SURVIVING SPOUSE OR NEXT OF KIN SEEKING ACCESS TO MEDICAL RECORDS
I, __________ , being duly sworn, do hereby state as follows:
As "Surviving Spouse" or "Next of Kin" to __________ (name of "decedent"), I am requesting a copy of a decedent's legal medical record.
I acknowledge and understand that Next of Kin includes the following surviving individuals:
1) Adult child by blood or adoption only in the absence of a surviving spouse.
2) Parent only in the absence of a surviving spouse or adult child.
I represent that, as the surviving spouse, adult child by blood or adoption, parent (circle one) of the decedent, that I am the Surviving Spouse or Next of Kin and that there is no survivor of higher priority.
I hereby represent and affirm that no estate administration has been initiated on behalf of the decedent and that I have not applied and been denied access to the requested records by any court.
I declare subject to the criminal penalty of false swearing established in RSA 641:2 that the foregoing statements are true and correct.
Date: __________ Signed: __________
STATE OF NEW HAMPSHIRE
COUNTY OF __________
Signed and sworn to (or affirmed) before me on the _____ day of _____ , 20 ___ , by __________ (name of person).

Source. 2017, 108:2, eff. Jan. 1, 2018.