For the purposes of this chapter, the term:
(1) "Agency" means an agency, department, unit, or instrumentality of the District of Columbia government.
(2) "Disclosure" means the release, transfer, provision of access to, or distribution of information in any manner by an entity holding the information to a person outside of the entity.
(3) "Health and human services information" means any information that relates to:
(A) The past, present, or future physical or mental health of an individual or family;
(B) The provision of health care or human services, including benefits or supports, to an individual or family; or
(C) The past, present, or future payment for the provision of health care or human services to an individual or family.
(4) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, approved August 21, 1996 (110 Stat. 1936; 42 U.S.C. § 1320d et seq.), and the regulations issued pursuant to it.
(5) "Human services" means programs, assistance, supports, or benefits of any kind to improve quality of life or to meet the social, physical health, housing, and mental health needs of an individual.
(6) "Identified individual" means a natural person to whom health and human services information pertains.
(7) "Individually identifiable health information" shall have the same meaning as it does in HIPAA.
(8) "Person" means a natural person, firm, company, association, corporation, service provider, or government instrumentality or agency.
(9) "Service provider" means an entity that provides health or human services to District residents pursuant to a contract, grant, or other similar agreement with an agency.
(10) "Use" means the sharing, employment, application, utilization, examination, or analysis of health and human services information.
(Dec. 4, 2010, D.C. Law 18-273, § 101, 57 DCR 7171.)
HISTORICAL AND STATUTORY NOTES
Emergency Act Amendments
For temporary (90 day) addition, see § 101 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 101 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
Law 18-273, the "Data-Sharing and Information Coordination Amendment Act of 2010", was introduced in Council and assigned Bill No. 18-356 which was referred to the Committee on Health and Human Services. The Bill was adopted on first and second readings on June 1, 2010, and June 29, 2010, respectively. Signed by the Mayor on July 20, 2010, it was assigned Act No. 18-489 and transmitted to both Houses of Congress for its review. D.C. Law 18-273 became effective on December 4, 2010.
Miscellaneous Notes
Establishment of a Health and Human Services Integrated Case Management Initiative; Establishment of a Health and Human Services Integrated Case Management Executive Committee; and Delegation of Rulemaking Authority to the Department of Human Services, see Mayor's Order 2011-169, October 5, 2011 (58 DCR 8843).
(a) In accordance with § 7-243 and without prior consent from the identified individual, an agency or service provider may use and shall disclose to another agency or service provider health and human services information referencing or relating to the identified individual for the following purposes; provided, that the use or disclosure is not specifically prohibited under District or federal law:
(1) To establish the identified individual's eligibility for, or determine his or her amount and type of:
(A) Treatment;
(B) Services;
(C) Benefits;
(D) Support; or
(E) Assistance;
(2) To coordinate for the identified individual, his or her:
(A) Treatment;
(B) Benefits;
(C) Services;
(D) Support; or
(E) Assistance;
(3) To conduct oversight activities, including:
(A) Management;
(B) Financial and other audits;
(C) Program evaluations;
(D) Planning;
(E) Investigations;
(F) Examinations;
(G) Inspections;
(H) Quality reviews;
(I) Licensure;
(J) Disciplinary actions; or
(K) Civil, administrative, or criminal proceedings or actions; and
(4) To conduct research related to treatment, benefits, services, supports, and assistance; provided, that:
(A) Health and human services information referencing or relating to an identified individual shall not be disclosed in a manner that would permit the identity of the individual to be reasonably inferred by either direct or indirect means; and
(B) The agency or service provider receiving the health and human services information shall affirm in writing that any individually identifiable health information shall be treated in accordance with HIPAA.
(b) A service provider shall disclose health and human services information to an agency upon request by the agency; provided, that the disclosure and use of such information is in accordance with this chapter.
(c) An agency or service provider shall use or disclose individually identifiable health information in accordance with HIPAA.
(d) When using or disclosing health and human services information, an agency or service provider shall make reasonable efforts to limit such information to the minium amount necessary to accomplish the purpose of the use or disclosure.
(e) An agency or service provider that discloses health and human services information shall designate an individual responsible for:
(1) Responding to requests for health and human services information from another agency or service provider, who shall:
(A) Respond to a request within 48 hours;
(B) Not unreasonably deny a request; and
(C) Within 5 business days of the date of the request, supply the requested information to the extent such request was approved; and
(2) Ensuring that any health and human services information disclosed pursuant to § 7-243 is limited to the minimum amount of information necessary to accomplish the purpose of the disclosure.
(Dec. 4, 2010, D.C. Law 18-273, § 102, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)
HISTORICAL AND STATUTORY NOTES
Effect of Amendments
D.C. Law 19-171 validated a previously made technical correction.
Emergency Act Amendments
For temporary (90 day) addition, see § 102 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 102 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
Law 19-171, the "Technical Amendments Act of 2012", was introduced in Council and assigned Bill No. 19-397, which was referred to the Committee of the Whole. The Bill was adopted on first and second readings on March 20, 2012, and April 17, 2012, respectively. Signed by the Mayor on May 23, 2012, it was assigned Act No. 19-376 and transmitted to both Houses of Congress for its review. D.C. Law 19-171 became effective on September 26, 2012.
The Mayor may establish a single or combined data system to store and share health and human services information; provided, that the system meets the security requirements of HIPAA and that individuals with authority to access the system receive training in accordance with HIPAA prior to any use of the system.
(Dec. 4, 2010, D.C. Law 18-273, § 103, 57 DCR 7171.)
HISTORICAL AND STATUTORY NOTES
Emergency Act Amendments
For temporary (90 day) addition, see § 103 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 103 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
(a) Before an agency or service provider discloses health and human services information to a service provider pursuant to this chapter, the receiving service provider shall make a written request for the information, describing the health and human services information sought and the purpose for the information.
(b) Regarding requests for health and human services information from a service provider, an agency or service provider must maintain an accurate record, for a reasonable period of time:
(1) Of the date and purpose for any request for the information;
(2) The date on which the information was disclosed; and
(3) A record of to whom the information was disclosed.
(Dec. 4, 2010, D.C. Law 18-273, § 104, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)
HISTORICAL AND STATUTORY NOTES
Effect of Amendments
D.C. Law 19-171 validated a previously made technical correction.
Emergency Act Amendments
For temporary (90 day) addition, see § 104 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 104 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
For temporary (90 day) amendment of section, see § 211(a) of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18-582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
For history of Law 19-171, see notes under § 7-242.
(a)(1) A person who negligently uses or discloses health and human services information in a manner not authorized by this chapter or other District law shall be liable in an amount of $500 for each violation.
(2) For the purposes of this subsection, the term "negligently" means that a person guided by ordinary considerations should have known, and by exercising reasonable diligence would have known, that the use or disclosure was not authorized.
(b) A person who willfully uses or discloses health and human services information in a manner not authorized by this chapter or other District law shall be liable in an amount of $1,000 for each violation.
(c) This section shall not apply to disclosures of information authorized pursuant to other District law or to federal law.
(Dec. 4, 2010, D.C. Law 18-273, § 105, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)
HISTORICAL AND STATUTORY NOTES
Effect of Amendments
D.C. Law 19-171 validated a previously made technical correction.
Emergency Act Amendments
For temporary (90 day) addition, see § 105 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 105 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
For temporary (90 day) amendment of section, see § 211(b) of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18-582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
For history of Law 19-171, see notes under § 7-242.
A person who knowingly obtains, uses, or discloses health and human services information in a manner not authorized by this chapter or other District law shall be guilty of a misdemeanor, and upon conviction, shall be fined not more than $2,500, imprisoned not more than 60 days, or both; except, that if the offense is committed through deception or theft the person shall be guilty of a misdemeanor and shall be fined not more than $5,000, imprisoned for not more than 180 days, or both.
(Dec. 4, 2010, D.C. Law 18-273, § 106, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)
HISTORICAL AND STATUTORY NOTES
Effect of Amendments
D.C. Law 19-171 validated a previously made technical correction.
Emergency Act Amendments
For temporary (90 day) addition, see § 106 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 106 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
For history of Law 19-171, see notes under § 7-242.
If a civil or criminal penalty imposed by another law applies to an action that is also subject to a civil or criminal penalty under this chapter, the greater penalty shall apply.
(Dec. 4, 2010, D.C. Law 18-273, § 107, 57 DCR 7171; Sept. 26, 2012, D.C. Law 19-171, § 53(a), 59 DCR 6190.)
HISTORICAL AND STATUTORY NOTES
Effect of Amendments
D.C. Law 19-171 validated a previously made technical correction.
Emergency Act Amendments
For temporary (90 day) addition, see § 107 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 107 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
For history of Law 19-171, see notes under § 7-242.
(a) The Mayor, pursuant to subchapter I of Chapter 5 of Title 2, shall issue rules to implement the provisions of this chapter.
(b) The Mayor shall submit the proposed rules to the Council for a 30-day period of review, excluding Saturdays, Sundays, holidays, and days of Council recess. If the Council does not approve or disapprove the proposed rules, in whole or in part, by resolution within this 30-day review period, the proposed rules shall be deemed approved.
(Dec. 4, 2010, D.C. Law 18-273, § 108, 57 DCR 7171.)
HISTORICAL AND STATUTORY NOTES
Emergency Act Amendments
For temporary (90 day) addition, see § 108 of Data-Sharing and Information Coordination Emergency Amendment Act of 2010 (D.C. Act 18-530, August 6, 2010, 57 DCR 8099).
For temporary (90 day) addition, see § 108 of Data-Sharing and Information Coordination Congressional Review Emergency Amendment Act of 2010 (D.C. Act 18- 582, October 20, 2010, 57 DCR 10118).
Legislative History of Laws
For Law 18-273, see notes following § 7-241.
