Effect of Hawaii’s New Health Care Information Privacy Act on State Functions

Hawaii Attorney General Legal Opinion 00-02 1 of 13 July 25, 2000 The Honorable Mazie K. Hirono Lieutenant Governor of Hawaii State Capitol, 5th Floor Honolulu, Hawaii 96813 Dear Lieutenant Governor Hirono: Re: Effect of Hawaii's New Health Care Information Privacy Act on State Functions State agencies have asked our department numerous questions about the effect on their functions of chapter 323C, Hawaii Revised Statutes (HRS), Hawaii's new law on the privacy of health care information. Many of those questions are similar, and the answers will rest on the same analyses of basic principles in the new law. We offer here our interpretation of the principles in the new law that affect the use of health care information that state actors either create or are required to handle as part of their operations. Questions have focused on specific areas of chapter 323C, and we wish to deal with those issues, in general terms, as quickly as possible to avoid unnecessary delays in state operations. Therefore, this discussion is not exhaustive.(1) Agencies may call their assigned deputy attorneys general for assistance on specific questions that we do not answer here, or for application of the basic principles to their activities. We address this letter to you in part because of your interest in maintaining and increasing government efficiency, and in part because the legislature established, in Act 140, Session Laws of Hawaii 2000, the medical privacy task force within the Office of Information Practices, which is attached to your office. That task force is to report to the legislature prior to the regular session of 2001 any changes it recommends in chapter 323C. Our analysis may be helpful to the task force in that process. I. General Effect of Chapter 323C on State Operations. Chapter 323C requires caution and safeguards when state agencies record, use, and disclose protected health information. Based on the issues we have analyzed so far, which admittedly are not all the issues that might come up under chapter 323C, we do not believe it presents major barriers to state functions that require the use or disclosure of protected health information. In many ways it is consistent with existing laws The legislature's purpose in enacting Act 87, 1999 Haw. Sess. Laws Hawaii Attorney General Legal Opinion 00-02 2 of 13 155 (codified as chapter 323C, HRS), was to preserve the confidentiality of the doctor-patient relationship as the relationship expands to include multiple parties (employers, health plans, other health care providers, oversight agencies, and the like), but at the same time to "[p]romote the health and welfare of the public by encouraging the effective exchange and transfer of health information in a manner that will ensure the confidentiality of protected health information without impeding the delivery of high quality healthcare," as stated in section 1 of Act 87. The legislature pointed out that "encouraging affordable quality health care, facilitating effective medical research, and preventing fraud and abuse are necessary to the health and safety of our citizens. These are compelling state interests, that may be furthered by allowing the sharing of medical information for limited purposes, without eliminating the confidentiality of the patient-doctor relationship." Id. at 155. Thus, from the start the legislature recognized that quality health care requires the exchange and transfer of health information, subject, to be sure, to the privacy interests of patients. The legislation and the legislative history include no indication that chapter 323C should change the way the State bills third-party payors for services rendered, or the way its boards conduct adjudicatory hearings on state benefits, or the way it regulates licensed health care providers or operations, or the way it oversees the provision of services in or for its programs. And the text of chapter 323C shows that the State may continue to perform these and probably other functions as it has until now, with some new safeguards to protect the privacy of the individuals whose health care information is at issue. II. Chapter 323C's Provisions on the Use and Disclosure of Protected Health Information in State Hands. A. Chapter 323C covers only protected health information. Chapter 323C encompasses "protected health information," which is defined in section 323C-1 to mean: [A]ny information, identifiable to an individual, including demographic information, whether or not recorded in any form or medium that relates directly or indirectly to the past, present, or future: (1) Physical or mental health or condition of a person, including tissue and genetic information; (2) Provision of health care to an individual; or (3) Payment for the provision of health care to an individual. Information that does not fit this definition is not subject to chapter 323C's protections. The most notable category of unprotected health information is "nonidentifiable health information," which is defined in section 323C-1 to mean: [A]ny information that meets all of the following criteria: would otherwise be protected health information except that the Hawaii Attorney General Legal Opinion 00-02 3 of 13 information in and of itself does not reveal the identity of the individual whose health or health care is the subject of the information and will not be used in any way that would identify the subjects of the information or would create protected health information. Redacted records or anonymous data require no special treatment under chapter 323C. B. The requirements for "entities." 1. Is a state agency or office an "entity?" Chapter 323C's requirements for "entities" and for non- "entities" are different. Therefore, any analysis of which requirements apply to a particular state agency or office begins by determining whether the state actor is an "entity." An "entity" for purposes of chapter 323C, as defined in section 323C-1, is: [A] health care provider, health care data organization, health plan, health oversight agency, public health authority, employer, insurer, health researcher, law enforcement official, or educational institution, except as otherwise defined for purposes of a particular section only. Each of these terms within the definition of "entity" is defined in turn in section 323C-1. A single state agency may fit more than one of these definitions, depending on the capacity in which it is acting. For example, the "public health authority" is defined as the Department of Health. The Department of Health is also a "health care provider" because of the health services it provides directly (e.g., at its community health clinics and at the Hawaii State Hospital). And its licensing of adult residential care homes under section 321-15.6, HRS, puts it into the category of a "health oversight agency." As part of the State, the department is also part of an "employer." Specific and sometimes quite different requirements apply to each of these types of "entities." An agency performing a function that does not fit any of these definitions is not an "entity." However, chapter 323C still imposes some confidentiality requirements on non- "entities," which are described below in section IIC. 2. All "entities" must establish safeguards. Any agency functioning as an "entity" must "establish and maintain administrative, technical, and physical safeguards that are appropriate to the size and nature of the entity" and that will appropriately protect the protected health information in its hands, as required by section 323C-14(a), HRS. The Office of Information Practices is to adopt rules to govern these safeguards pursuant to section 323C-14(b) and, until those rules become effective, we suggest that agencies work with their assigned deputy attorneys general to develop appropriate safeguards. Hawaii Attorney General Legal Opinion 00-02 4 of 13 3. In some instances, "entities" may use and disclose protected health information without the individual's consent. Under section 323C-21(a), HRS, "entities" may use or disclose protected health information only as described in parts III and IV of chapter 323C. Some uses and disclosures do not require the individual's consent. a. Treatment does not require consent. Chapter 323C requires certain "entities" to post notice of their confidentiality practices and of patients' rights regarding inspecting, copying, and adding to their medical records. According to section 323C-21(b), HRS, as long as an "entity" provides the notice required by section 323C-13, and the notice meets the requirements of that section and of section 323C-22, the "entity" may use and disclose protected health information for treatment without the consent of the individual. As defined in section 323C-1, "treatment" encompasses "the provision of health care by, or the coordination of health care among, health care providers, or the referral of a patient from one provider to another, or coordination of health care or other services among health care providers and third parties authorized by the health plan or the plan member." Health care providers, to paraphrase the definition of that term in section 323C-1, are people authorized by law (licensed, certified, registered, or otherwise authorized) to provide health care, or a government or employer-sponsored program that does so. Thus, for example, both a clinical psychologist and a registered nurse caring for a resident at the Hawaii State Hospital (HSH) would have access to that person's medical records for purposes of treatment because they would both be providing health care to that person. And the health care professionals at another facility to which an HSH resident is transferred, or those who provide services to an HSH resident at another location, would also have access to the person's medical record as necessary for treatment purposes.(2) b. Qualified health care operations do not require consent. Section 323C-21(b) also allows the use and disclosure of protected health care information, without consent, for "qualified health care operations" as long as proper notice has been given under sections 323C-13 and -22. The term "qualified health care operations" is defined at great length in section 323C-1. In very general terms, qualified health care operations are normal management functions of a health care provider or health plan if those functions cannot be carried out "effectively and efficiently" without some minimum amount of identifiable patient information. Under section 323C-1, HRS, these functions include payment; quality assurance; review of health care professionals' competence; accreditation, licensing, and credentialing; evaluating providers' performance; utilization management; or performing or arranging audits "in accordance with statute, rule, or accreditation requirements." (The individual may, however, prevent disclosure to a payor, under section 323C-21(c), by instructing the provider not to Hawaii Attorney General Legal Opinion 00-02 5 of 13 disclose information to the payor and by paying for the services directly.) Qualified health care operations are also subject to numerous restrictions on the use and handling of protected information, such as using only the minimum amount of information needed to carry out the function efficiently and effectively, and limiting medical record access to certain types of personnel. Section 323C-1, HRS. Any state agency that believes it is conducting a qualified health care operation that does not require the consent of the individuals whose records are involved should check with its deputy attorney general to make sure that the operation is, in fact, a qualified health care operation and that the agency complies with the restrictions. c. Identification of deceased individuals does not require consent. Health care providers may divulge protected health information, under section 323C-33, HRS, if it is necessary to either identify, or allow the safe handling of, a deceased individual. 4. In other situations, "entities" must obtain consent to use or disclose protected health information. As we have seen, consent is not required for properly noticed use and disclosure of protected health information for purposes of treatment or qualified health care operations under section 323C-21(b), HRS. And an "entity" who is a health care provider is allowed by section 323C-33, HRS, to disclose protected information for identification or safe handling of a dead body. For any other purpose, an "entity" may disclose protected health information only with a "separate written authorization executed by the individual who is the subject of the information," section 323C-23(a) (or under one of the exemptions discussed below). Section 323C-23(b) establishes the requirements for the contents of written authorizations. We are working with state agencies on specific forms to meet these requirements and will continue to do so. In order to be able to use the information for the intended purposes, though, agencies should know why two of these required items, in particular, are important. First, the designation of the person(3) to whom the information may be disclosed will determine who within the agency or the State is authorized to receive and use the information. For example, the State of Hawaii will be designated as the "person" to receive the information on most or all employment-related authorizations, allowing not only the personnel office and other necessary staff in the person's own department to use the information for the designated purpose, but also necessary staff in the Department of Human Resources Development. When we help agency staff develop their forms, we will need to know who the appropriate "person" is. Conversely, employees who receive information along with consent forms prepared by others should make sure that the "person" designated on the form to receive the information is the appropriate one for the intended purpose. Second, the described purpose of the disclosure is critical because it determines what can be done with the information once received. Hawaii Attorney General Legal Opinion 00-02 6 of 13 According to section 323C-21(e), "[e]very use and disclosure of protected health information shall be limited to the purpose for which it was collected. Any other use without a valid consent to disclose shall be an unauthorized disclosure." State personnel should be sure that the purpose described in consent forms they receive is adequate to cover the use to which the information will be put. If the described purpose is too narrow, further consent will be necessary before the information can be used or disclosed for purposes not covered by the initial, limited consent. C. Provisions that apply, whether one is an "entity" or not. Some provisions of chapter 323C, including many exemptions from the requirement for consent to disclosure of protected health information, apply both to "entities" and to persons or others that do not fit the definition of "entity" in section 323C-1. 1. Release without consent. a. Release to a coroner or medical examiner. Section 323C-31 allows anyone to release, without consent, protected health information to a coroner or medical examiner for the purpose of determining the cause of a death. b. Release to a designated representative, relative, or surrogate. Section 323C-32 allows a health care provider, or anyone with protected health information, to disclose it to a designated representative, relative, or surrogate, without consent, under certain circumstances. c. Emergency circumstances. Section 323C-34, HRS, permits anyone with protected health information to use or disclose it in an emergency, without consent, "if the use or disclosure is necessary to protect the health or safety of the individual who is the subject of the information from serious, imminent harm." d. Disclosures for health oversight. Some state agencies disclose protected health information in their hands to other "entities" for purposes of health oversight. Others function as health oversight agencies and must be able to obtain information for those purposes. Section 323C-35, governing disclosures for health oversight purposes, describes how state agencies may disclose, and how state health oversight agencies may obtain and use, the necessary information. Anyone may disclose protected health information to a health oversight agency, without the concerned individual's consent, for a legally authorized oversight function, as long as the person who has the authority to conduct the review provides a statement that the information is requested for such a purpose. Section 323C-35(a) and (b), HRS. The Hawaii Attorney General Legal Opinion 00-02 7 of 13 term "health oversight agency" encompasses the functions of many state agencies and offices in its broad scope, including assessments, evaluations, and investigations related to licensing, credentialing, and accreditation of health care; and audits and investigations of "legal, fiscal, medical, or scientific standards or aspects of performance related to the delivery of, or payment for, health care." Section 323C-1, HRS. "Health oversight agencies" must be public agencies, or must be acting on behalf of public agencies (e.g., under contract), or must be performing the activity under a federal or state law that governs violations of laws on licensing, accreditation, or credentialing of health care providers. For example, the MedQUEST division of the Department of Human Services (DHS) functions as a "health oversight agency" when it monitors the fiscal and medical performance of the plans with which it contracts to provide health care services to eligible recipients. Section 346-14(7), HRS, requires DHS to "[a]dminister the medical assistance programs for eligible public welfare and other medically needy individuals by establishing standards, eligibility, and health care participation rules, payment methodologies, reimbursement allowances, systems to monitor recipient and provider compliance, and assuring compliance with federal requirements to maximize federal financial participation" (emphasis added). When it carries out these monitoring responsibilities the MedQUEST division "performs or oversees the performance of an audit, assessment, evaluation, determination, or investigation relating to the effectiveness of, compliance with, or applicability of, legal, fiscal, medical, or scientific standards or aspects of performance related to the delivery of, or payment for, health care . . .," section 323C-1, and is functioning as a "health oversight agency." Anyone may provide protected health information to the MedQUEST division or its agent for this purpose, without the consent of the individuals whose records are involved. e. Disclosures for purposes of public health. Section 323C-36(a) allows any person or "entity" to provide protected health information to the Department of Health or to any other authorized person for use in a legally authorized (1) Disease or injury report; (2) Public health surveillance; (3) Public health investigation or intervention; or (4) Health or disease registry. This section acknowledges existing authority to obtain confidential medical records for reporting, surveillance, investigation, interventions, and registries -- for example, the authority of the Director of Health in section 321-311.5, HRS, to obtain medical information on individuals when the director is conducting epidemiologic investigations on diseases thought to threaten public health and safety; or the child death review system established in part XXVII of chapter 321, HRS, which gives the Director of Health access to medical and other records that are otherwise confidential "in order to reduce the incidence of preventable child deaths," section 321-341. In the child death review system -- specifically, section 321-345 -- and in section 321-311.5's Hawaii Attorney General Legal Opinion 00-02 8 of 13 provisions on epidemiologic investigations, as in this section 323C-36, the protected medical information disclosed for an authorized purpose remains confidential. Thus, at least for epidemiologic investigations and child death reviews, and for similar statutes on disclosure for public health purposes, chapter 323C is consistent with existing practices and authority. f. Disclosure for civil or administrative law enforcement purposes. Section 323C-39 authorizes unconsented-to disclosure of protected health care information in certain circumstances for civil or administrative law enforcement purposes. We do not address this section here because it adds little to the basic analysis. g. Disclosure in civil, judicial, and administrative procedures when the information is related to a party whose medical condition is at issue. According to section 323C-38(a), HRS, in many instances protected health care information may be disclosed in response to a discovery request or a subpoena in civil, judicial, and administrative procedures only with consent or an appropriate court order. However, section 323C-38(c) exempts from that requirement information "related to a party whose medical condition is at issue." In the latter situation, the requested protected health information generally may be disclosed in response to a discovery request or subpoena without either a written authorization or a court order. The text of section 323C-38 is not as clear as it could be that protected information regarding a party in litigation, whose medical condition is at issue, may be disclosed in response to a subpoena or discovery request and generally does not require a court order or consent. However, this year in Act 91, Session Laws of Hawaii 2000, the legislature made a change in the language of section 323C-38(c) and, in section 3 of the same act, amended section 622-52, HRS (governing subpoenas for medical records), to make the meaning unequivocal. Section 622-52, as amended, now begins: § 622-52 Subpoena duces tecum for medical records, compliance. Except as provided by section 323C-38(c), a subpoena duces tecum or discovery request for protected health information is valid only if accompanied by either a court order, or a written authorization signed in accordance with section 323C-23 . . . . [Emphasis added.] The language referring to section 323C-38(c) is new. The Senate Committee on Judiciary, reporting on the bill that became Act 91, explained that this amendment "allow[s] a litigant to subpoena medical records without any written authorization or court order" when the information relates to a party litigant whose medical condition is at issue. S. Stand. Comm. Rep. No. 3318, 20th Leg., 2000 Regular Session. State agency staff who receive subpoenas for protected information in civil judicial or administrative proceedings, without accompanying court orders or Hawaii Attorney General Legal Opinion 00-02 9 of 13 authorizations, should check with their assigned deputy attorney general to make sure that the litigation exemption in section 323C-38(c) applies. The deputy will also need to determine whether a more restrictive provision of state or federal law applies that would require consent or a court order (such as federal restrictions on the disclosure of substance abuse information). 2. Court orders are required for disclosure in response to subpoenas and discovery requests for protected health care information in civil judicial actions and in administrative proceedings if there is no written authorization to release and if the information is not related to a party to the litigation whose medical condition is at issue. Section 323C-38(a) requires court orders or written consents to release protected health information in response to subpoenas or discovery requests in state court or state administrative proceedings (except when the person whose records are requested is a party to the action whose medical condition is at issue). Court orders for release of protected health information in response to discovery requests or subpoenas for protected health information must contain specific provisions. Section 323C-38(b), HRS, requires that the orders state that the information involved is under court protection; specify the person to whom the information may be disclosed; and say that the information may not "otherwise be disclosed or used." Court orders may include other requirements the court imposes to protect the information. Id. Agency staff who receive discovery requests or subpoenas for protected information, without appropriate consents, should call their assigned deputy attorney general. The deputy will check to see that any court order attached contains all the required information. If there is no order or the order in inadequate, the deputy will follow up with the attorney who issued the request or subpoena or obtained the court order. 3. Protected health information may be used only for the purpose for which it was collected. No matter how protected health information has come into the hands of a state agency, section 323C-21(e), HRS, makes clear that the information may be used and disclosed only for the purpose for which it was obtained. The purpose described in the consent form, in any applicable statute or administrative rule, in a subpoena, or in a court order controls how the information may be used. D. The adjudicatory function: issues that arise when a state agency that is not acting as an "entity" under chapter 323C uses protected health information. On July 13, 2000, the Labor and Industrial Relations Appeal Board (LIRAB) suspended all scheduled trials "to allow the parties the opportunity to address the compliance requirements set forth in Act 87 and to provide the Board with the necessary documentation of compliance." Hawaii Attorney General Legal Opinion 00-02 10 of 13 The LIRAB performs an essential state function in the administration of the workers' compensation program and chapter 323C's impact on its work should be resolved quickly. For that reason, and because other state bodies must also use protected health care information in their adjudicatory functions, we analyze the application of chapter 323C to the workers' compensation system in some detail. Under section 386-71, HRS, the Director of Labor and Industrial Relations is "in charge of all matters of administration pertaining to the operation and application" of the workers' compensation law. The director "shall have and exercise all powers necessary to facilitate or promote the efficient execution of this chapter and, in particular, shall supervise, and take all measures necessary for, the prompt and proper payment of compensation." Id. This section describes the purpose for which protected health information is furnished to the director: in a nutshell, the administration of the workers' compensation law. The LIRAB, which is administratively attached to the Department of Labor and Industrial Relations (DLIR), pursuant to section 371-4(g), HRS, has statutory authority "to decide appeals from decisions and orders of the director of labor and industrial relations issued under the workers' compensation law," section 371-4(b). Therefore, when it decides appeals from DLIR decisions on workers' compensation, it is continuing the operation and application of the workers' compensation law. The workers' compensation process begins when an injured employee's employer files a report of injury (a WC-1 form) with the Disability Compensation Division (the DCD) of the DLIR, as required by section 386-95, HRS. That form contains identifying information about the injured employee, such as the employee's name, address, date of birth, and social security number; date of the injury or illness; a description of the accident; and the nature of the injury. Thereafter the DCD receives, primarily from the employer or carrier, periodic reports from the treating physician, medical records from physicians who provided any medical care, and reports from consulting physicians and independent medical examiners. When the employee files a claim with the DCD, the DCD relies on these reports in making a decision. The written decision contains a general description of the injury and may also include a discussion of the medical evidence. If its decision is appealed, the DCD forwards the entire case file to the LIRAB. Like the DCD, the LIRAB also receives reports from medical providers, and generally its written decisions discuss the medical evidence. If a party appeals a LIRAB decision, the LIRAB sends the record to the Hawaii Supreme Court. Neither the DCD nor the LIRAB is an "entity" for purposes of chapter 323C when it reviews, evaluates, and decides on claims for workers' compensation. They do not fit any of the definitions of individuals or groups defined as "entities" in section 323C-1.(4) Therefore, the DCD and the LIRAB need not provide the notice required of selected "entities" by sections 323C-13 and -22. Nor must they establish the safeguards that section 323C-14 describes. Nonetheless, some provisions of chapter 323C apply to each in its adjudicatory capacity because the DCD and the LIRAB receive protected health information when they process workers' compensation claims. For example, on the WC-1, the employer's report of the industrial illness or Hawaii Attorney General Legal Opinion 00-02 11 of 13 injury, the nature of the injury is described in lay terms. Because that form is an injury report that employers must file with DLIR under section 386-95, HRS, it is a "legally authorized . . . disease or injury report" given to an "authorized person" under section 323C-36 and may be given to the DCD without consent or a court order. Physicians, surgeons, and hospitals that provide services to an injured employee must also report the injury and treatment to the DLIR under section 386-96. These reports are, similarly, "legally authorized . . . disease or injury report[s]" given to an "authorized person" under section 323C-36 and may be forwarded to the DCD or the LIRAB without consent or court order. Other information is furnished by the employee or with the employee's consent. When consent is not forthcoming, the parties may use the subpoena powers granted to the DCD or the LIRAB by section 371-6, HRS, to obtain the necessary protected health information by request or administrative subpoena under section 323C-38(c). Submitting a claim for workers' compensation to the DCD makes the employee a party to litigation in which the person's medical condition is at issue. Under section 323C-38(c), neither consent nor a court order is required for the parties to obtain protected health information related to the claimant for workers' compensation purposes, and to turn over that information to the DCD and the LIRAB for their necessary use in the workers' compensation process. An administrative subpoena will do. Once in the DCD's or the LIRAB's hands, those bodies may use and disclose the protected health care information only for the purpose for which it was collected, section 323C-21(e). That purpose, under sections 386-71, 386-73, and 371-4, HRS, is the administration of the workers' compensation law, specifically the processing of a claim through completion. It includes giving copies of DCD's written decisions to the parties. The purpose for which the information was collected also includes forwarding the written decision and the case file, with its protected information, to the LIRAB if the DCD's decision is appealed. Under section 386-87, the LIRAB is authorized "to review the findings of fact, conclusions of law and exercise of discretion by the director in hearing, determining or otherwise handling of [sic] any compensation cases." The board cannot perform this function without access to the protected health information in the written DCD decision and the record. Similarly, the purpose of disclosure includes forwarding the case file and written decision to the Hawaii Supreme Court, because until appeal rights are exhausted the purpose for which DLIR received the information has not been accomplished.(5) III. The Relationship of Chapter 323C to Other Confidentiality Laws. Other confidentiality provisions abound in Hawaii law -- both common and evidentiary law governing privileges, and statutory provisions in specific areas. Section 323C-55 acknowledges certain other state law: it explains that chapter 323C does not "preempt or modify any provisions of state law concerning a privilege of a witness or person in a court of the State . . .," section 323C-55(a), and lists some statutory areas that chapter 323C should not be read to "preempt, supersede, or modify . . .," section 323C-55(b). Section 323C-55(b) thus leaves explicitly untouched the laws that concern the reporting of vital statistics; that require the Hawaii Attorney General Legal Opinion 00-02 12 of 13 reporting of abuse or neglect; that relate to public or mental health and contain greater restrictions on disclosure than chapter 323C; that concern minors' rights to access protected health information or health care services; and that meet "any other requirements that the court determines are needed to protect the confidentiality of the information." (Of course, chapter 323C does not preempt any federal law that requires greater restrictions on disclosure, either.) Based on what we have seen so far, and as we have described in this letter, we believe that in its effect on how state agencies do their work chapter 323C is consistent with many other existing state laws on the confidentiality of medical information as well. Experience with the new law over time may reveal conflicts between chapter 323C and existing law that we have not yet examined. If and when that happens, we will look at specific conflicts and try to determine which provision prevails. Some issues may require legislative clarification. We encourage you, the medical privacy task force, and our state agency clients to raise with us any further questions that arise on the effect of chapter 323C on state functions. Very truly yours, Heidi M. Rian Deputy Attorney General APPROVED: Earl I. Anzai Attorney General Footnotes/Endnotes 1. We do not consider here how law enforcement officials may obtain and use protected health information. In addition, state agencies have not asked us any questions based on the following sections of chapter 323C, and we do not address them here: sections 323C-11 and -12, concerning individuals' rights to inspect and copy, and add to, their health information; section 323C-37, which covers protected health information in the hands of researchers; section 323C-39, which governs disclosure for civil or administrative law enforcement purposes; sections 323C-40 through 43, which concern payment methods for individuals, standards for electronic disclosures, rights of minors under the new law, and the continuing protection of health information after an individual's death; and sections 323C-51 through -54, the sanctions provisions of part V of chapter 323C. 2. The 1999 text of section 323C-21(b) included the words "within the entity," so that the beginning of section 323C-21(b) read, "For the purpose of treatment or qualified health care operations, an entity may Hawaii Attorney General Legal Opinion 00-02 13 of 13 only use or disclose protected health information within the entity if the use or disclosure is properly noticed" (emphasis added). In Act 140, Session Laws of Hawaii 2000, the legislature removed that phrase. 3. A "person," according to the definition of that term in section 323C-1, can include not only individuals but also any kind of legal entity, such as "a government, governmental subdivision, agency or authority, . . . ." 4. In other situations, the DCD and the LIRAB may function as "health oversight agencies." We do not discuss those functions specifically here. 5. In the interest of time, we do not address here the extent to which protected health information in the DCD's and the LIRAB's written decisions may be disclosed to persons other than the parties, the DCD, the LIRAB, and the Hawaii Supreme Court. Because the LIRAB has halted its proceedings temporarily, there is some urgency in resolving the issues surrounding the use and disclosure of protected health information by DCD and in proceedings before the LIRAB so that workers' compensation claims may continue to be processed. We will examine other types of disclosure at a later time.