HRS §323B-1 Applicability
323B-1. Applicability
This chapter shall apply, unless amended by specific reference to this chapter or any section thereof.
L 2012, c 315, pt of §2
HEALTH CARE PRIVACY HARMONIZATION ACT
HRS div. 1, tit. 19, ch. 323B
in effectHRS §323B-2 Definitions
323B-2. Definitions
As used in this chapter:
"Breach" has the same meaning as in
45 Code of Federal Regulations section 164.402, as may be amended.
"Business associate" has the same
meaning as in 45 Code of Federal Regulations section 160.103, as may be
amended.
"Covered entity" has the same meaning
as in 45 Code of Federal Regulations section 160.103, as may be amended.
"Disclosure" has the same meaning as
in 45 Code of Federal Regulations section 160.103, as may be amended.
"Health information" has the same
meaning as in 45 Code of Federal Regulations section 160.103, as may be
amended.
"Individually identifiable health
information" has the same meaning as in 45 Code of Federal Regulations
section 160.103, as may be amended.
"Unsecured protected health
information" has the same meaning as in 45 Code of Federal Regulations
section 164.402, as may be amended.
"Use" has the same meaning as in 45
Code of Federal Regulations section 160.103, as may be amended.
[L 2012, c 315,
pt of §2]
HRS §323B-3 Privacy of individually identifiable health information
323B-3. Privacy of individually identifiable health information
(a) Notwithstanding any law to the contrary, any use or disclosure of individually identifiable health information by any covered entity or business associate that is permitted by 45 Code of Federal Regulations part 164, subpart E, shall be deemed to comply with all state laws relating to the use, disclosure, or confidentiality of such information.
(b) Notwithstanding any law to the contrary,
an authorization for release of individually identifiable health information
that complies with 45 Code of Federal Regulations section 164.508 shall be
deemed to comply with all state laws relating to individual authorization.
(c) Notwithstanding any law to the contrary,
any notice of breach of unsecured protected health information that complies
with 45 Code of Federal Regulations part 164, subpart D, shall be deemed to
comply with all state laws relating to notice of breach of protected health
information.
[L 2012, c 315, pt of §2]
HRS §323B-4 Relationship to other laws
323B-4. Relationship to other laws
Nothing in this chapter shall be construed to:
(1) Authorize the disclosure of individually
identifiable health information to the extent that disclosure is restricted by
federal law or regulations, including federal regulations about the
confidentiality of information about drugs and alcohol, as set forth in 42 Code
of Federal Regulations part 2;
(2) Compel the disclosure of individually
identifiable health information that is not required by law to be disclosed;
(3) Require a written authorization for release of
individually identifiable health information or de‑identified information
to the extent that the Health Insurance Portability and Accountability Act of
1996, Public Law 104-191, and its related regulations, as may be amended, does
not require such authorization;
(4) Limit or otherwise affect any state law that:
(A) Requires persons or entities to report
disease, injury, child abuse, elder abuse, domestic violence, birth, or death;
or
(B) Governs public health surveillance,
investigation, or intervention;
(5) Limit or otherwise affect health plan reporting,
including reporting required for purposes of state management or financial
audits; or
(6) Limit or otherwise affect any evidentiary
privilege, limitation on discovery, or confidentiality protection provided by
any state law, decision, or order in relation to individually identifiable
health information sought, used, or produced in any judicial or administrative
proceeding.
[L 2012, c 315, pt of §2]
HRS §323B-5 Disclosure, use, and production of de-identified protected health information
323B-5. Disclosure, use, and production of de-identified protected health information
(a) Provided that individually identifiable protected health information has been de-identified pursuant to title 45 Code of Federal Regulations part 164, as may be amended, the State shall have a compelling interest in the public and private disclosure, use, and production of the de-identified protected health information for the purposes of medical or economic research, protecting patient or public safety, ensuring proper operation of facilities providing medical care, and health care operations as defined in title 45 Code of Federal Regulations part 164, as may be amended.
(b) Public and private uses of de-identified
protected health information in which the State shall have a compelling
interest include but are not limited to:
(1) De-identified protected health information from
state agencies, hospitals, medical and health care facilities, health care
providers, and providers of health insurance relating to:
(A) Medical or economic research; and
(B) Public safety;
(2) De-identified protected health information from
state agencies, pharmacies, hospitals, medical and health care facilities,
health care providers, and providers of health insurance relating to patient
protection and public safety involving unfair or deceptive acts or practices,
restraints of trade, and price-fixing in violation of chapter 480; and
(3) De-identified protected health information from
state agencies, hospitals, medical and health care facilities, and health care
providers relating to the proper operation of medical and health care
facilities that includes:
(A) Quality assessment and improvement
activities;
(B) Patient protection and safety activities;
(C) Population based activities relating to
improving health or reducing health care costs;
(D) Fraud and abuse detection and compliance;
and
(E) Employment actions.
[L 2017, c 157, §2]
Source: Hawaii State Legislature (capitol.hawaii.gov), via Internet Archive capturesURL: http://www.capitol.hawaii.gov/hrscurrent/Vol06_Ch0321-0344/HRS0323B/HRS_0323B-.htmFetched: 11/10/2026