I. Highlights

Act 87, Session Laws of Hawaii 1999, established a new law, chapter 323C, Hawaii Revised Statutes, on the Privacy of Health Care Information. The Act is to become effective on July 1, 2000. Section 7 of that Act requires the Legislative Reference Bureau to identify the most appropriate method by which to enforce and implement the new medical records confidentiality law.

1. The OIP is the single agency in state government having the greatest amount of subject matter expertise with respect to privacy issues involving records. OIP also wants the responsibility for the new law. However, the OIP could not implement the new law without a substantial increase in staffing and funding. The agency estimated that its present staff of seven and budget of just under $333,000 would have to be increased by an additional ten positions. The added cost of those new positions would likely be at least $350,000 to $400,000 a year in general fund appropriations. OIP is attached to the Office of the Lieutenant Governor for administrative purposes, and could not reasonably expect to draw much in the way of support or assistance from that office or other attached agencies.

2. The DCCA does not favor being given the responsibility for the new law, but already has a well integrated mechanism in place to handle the intake and investigation of complaints and prosecution of cases at least through the administrative hearing stage. DCCA attorneys also take a narrow range of cases to Circuit Court, and a formal working relationship is in place for the Attorney General's Office to do so in other cases.

3. DCCA is the licensing and regulatory authority for a number of entities subject to regulation under the new law (either through the Insurance or Professional and Vocational Licensing Divisions), and all businesses register with the Department's Business Registration Division. This enables the Department to fund operations under the new law through assessments on the regulated entities. If the Department is authorized to assess other entities subject to the new law, it appears to be in a better position to implement such a scheme than any other state agency. If OIP were directed to implement a similar funding scheme, it would need additional staff just to implement it, and would have to build its entire database of agencies to assess from ground zero, and would probably need to search the data at DCCA.

4. If the Legislature is willing to appropriate the funds, presumably general funds needed for OIP to implement the medical records confidentiality law, then OIP, the agency with the greatest subject matter expertise, should be designated as the implementing agency.

5. If the Legislature would prefer to fund implementation of the new law through assessments on regulated entities, then DCCA should be designated as the implementing agency.

6. If the Legislature does not assign OIP responsibility for the new law, the Legislature should reconsider the issue at a later date if, as advocated by OIP's Director, the Legislature decides to broaden OIP's mission to encompass the commercial handling and use of personal information.

II. Anticipated Questions

1. Section 7 of Act 87 which directed this study specifically asked the Bureau to review RICO, the Insurance Division, and OIP. Why does the study instead compare DCCA and OIP?

   Answer: RICO and the Insurance Division are both divisions within the DCCA. There is no reason to assume that any single division (or branch or other unit of organization) within a department has to implement a law or program entirely on its own. Simply reviewing each of those divisions as stand alone entities would give an incomplete picture of DCCA's abilities, as the Department integrates to a great degree the functions and operations of a diverse collection of organic and attached agencies.

2. Does the report consider any agencies other than OIP and DCCA as possible candidates?

   Answer: No. Aside from the fact that the Legislature was primarily concerned with those agencies as candidates, the Bureau believed that the Legislature had already selected well. Other possible candidates could have included the Department of Health (which regulates health care facilities) and the Department of Labor and Industrial Relations (which regulates all employers in a number of ways although it does not actually "license" them or otherwise permit them to operate as businesses). However, practically speaking, no other state agency appeared to have either the subject matter expertise of OIP, or the integrated operations of DCCA ranging from registration of the business entities themselves, to receiving and investigating complaints, and prosecuting and hearing administrative cases on a department-wide basis.

3. Why does the study discuss things like the investigation of complaints and handling of administrative hearings? The new law (chapter 323C, Hawaii Revised Statutes) only specifically mentions civil actions by individuals, cease and desist orders, and civil penalties (section 323C-53) and criminal penalties (section 323C-51).

   Answer: The study considers them solely because they appear to be reasonable and practical elements in an implementation or enforcement scheme. If nothing else, with court proceedings clearly and specifically provided for (and absolutely required in the case of the criminal penalties), some form of investigation of complaints is necessary. It would not be a very good use of resources to bring cases to court (particularly those involving the class C felony liability under section 323C-51) based solely upon allegation of a complainant. Consequently, investigation of complaints would be appropriate even if administrative hearings were specifically precluded. Practically speaking, however, aside from the fact that both DCCA and OIP personnel assumed or at least contemplated their use, some form of administrative hearing process would be appropriate for handling smaller, more routine cases.

4. Does the study make any findings as to whether OIP's mission should be broadened to include the commercial handling and use of personal information?

   Answer: No. That would be an entire study in itself and beyond the scope of this one.

Back