A BILL TO BE ENTITLED
AN ACT TO PROTECT HEALTH INFORMATION PRIVACY BY PROHIBITING USE or DISCLOSURE OF PROTECTED HEALTH INFORMATION FOR PURPOSES OF MARKETING WITHOUT WRITTEN AUTHORIZATION OF THE INDIVIDUAL, AND BY LIMITING THE USE OR DISCLOSURE OF PROTECTED HEALTH INFORMATION WITHOUT INDIVIDUAL AUTHORIZATION FOR CERTAIN PUBLIC HEALTH‑RELATED ACTIVITIES.
The General Assembly of North Carolina enacts:
SECTION 1.  The General Statutes are amended by adding the following new Chapter to read:
"Chapter 132A.
"Privacy of Health Information.
"Article 1.
"Use or Disclosure of Protected Health Information.
"§ 132A-1.  Purpose.
The purpose of this Article is to provide greater patient privacy protections regarding the use or disclosure of protected health information for marketing purposes than are provided under the Health Insurance Portability and Accountability Act and Privacy Standards, and regulations adopted thereunder. 
"§ 132A-2. Definitions.
(a)	Unless otherwise defined in this Article, each term used in this Article has the meaning and application assigned by the Health Insurance Portability and Accountability Act and Privacy Standards.
(b)	As used in this Article:
(1)	'Health Insurance Portability and Accountability Act and Privacy Standards' means the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability Act of 1996 (Pub. L. 104-191) and the final rules adopted December 28, 2000, as modified August 14, 2002, and any subsequent amendments.
(2)	'Marketing' means to make a communication about a product or service to encourage recipients of the communication to purchase or use the product or service, but does not include communications made as part of the treatment of a patient for the purpose of furthering treatment unless the covered entity receives direct or indirect remuneration from a third party for making the communication.
"§ 132A-3. Protection of private health information.
(a)	Except in accordance with subsection (b) of this section, a covered entity shall not:
(1)	Disclose protected health information to any entity for marketing the products or services of the entity; or
(2)	Use protected health information in its possession to provide marketing services to any entity.
(b)	A covered entity may provide marketing services to a pharmaceutical company if the covered entity:
(1)	Provides clear and conspicuous notice to the individual involved concerning its disclosure practices for all protected health information collected or created with regard to the individual; and
(2)	Obtains the consent of the individual involved to use the information and that consent is manifested by an affirmative act in a written communication which only references and applies to the specific marketing purpose for which the information is to be used.
(c)	Applicability. – This Article does not affect the validity of another law of this State that provides greater confidentiality for information made confidential by this Article. 
"§ 132A-4. Use or disclosure of protected health information for public health activities and purposes to persons subject to the jurisdiction of the Food and Drug Administration.
A covered entity shall not use or disclose protected health information without the written consent of the individual who is the subject of the protected health information to persons subject to the jurisdiction of the Food and Drug Administration except for the following public health activities or purposes:
(1)	To report adverse events (or similar reports with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations if the disclosure is made to the person required or directed to report the information to the Food and Drug Administration;
(2)	To track products if the disclosure is made to a person required or directed by the Food and Drug Administration to track the product;
(3)	To enable product recalls, repairs, or replacement (including locating and notifying individuals who have received products of product recalls, withdrawals, or other problems); or
(4)	To conduct post-marketing surveillance to comply with requirements or at the direction of the Food and Drug Administration.
"§ 132A-5. Enforcement.
(a)	Injunctive Relief. – The Attorney General of this State may institute an action for injunctive relief to restrain a violation of this Article.
(b)	Civil Penalties. – In addition to the injunctive relief provided by this section, the Attorney General may institute an action for civil penalties against a covered entity for a violation of this Article. A civil penalty assessed under this section may not exceed three thousand dollars ($3,000) for each violation. If the court in which an action under this subsection is pending finds that the violations have occurred with a frequency as to constitute a pattern or practice, the court may assess a civil penalty not to exceed two hundred fifty thousand dollars ($250,000).
(c)	Disciplinary Action. – In addition to the penalties prescribed under this section, a violation of this Article by an individual or facility that is licensed by an agency of this State is subject to investigation and disciplinary proceedings, including probation or suspension by the licensing agency. If the licensing agency finds evidence that the violations of this Article constitute a pattern or practice, the licensing agency may revoke the individual's or facility's license.
(d)	Availability of Other Remedies. – This Article does not affect any right of a person under other law to bring a cause of action or otherwise seek relief with respect to conduct that is a violation of this Article."
SECTION 2.  This act becomes effective January 1, 2004.