A BILL TO BE ENTITLED
AN ACT TO PROTECT HEALTH INFORMATION PRIVACY BY PROHIBITING USE or DISCLOSURE OF PROTECTED HEALTH INFORMATION FOR PURPOSES OF MARKETING WITHOUT WRITTEN AUTHORIZATION OF THE INDIVIDUAL.
The General Assembly of North Carolina enacts:
SECTION 1.  The General Statutes are amended by adding the following new Chapter to read:
"Chapter 132A.
"Privacy of Health Information.
"Article 1.
"Use or Disclosure of Protected Health Information.
"§ 132A-1.  Purpose.
The purpose of this Article is to provide greater patient privacy protections regarding the use or disclosure of protected health information for marketing purposes than are provided under the Health Insurance Portability and Accountability Act and Privacy Standards and regulations adopted thereunder.
"§ 132A-2. Definitions.
(a)	Unless otherwise defined in this Article, each term used in this Article has the meaning and application assigned by the Health Insurance Portability and Accountability Act and Privacy Standards.
(b)	As used in this Article:
(1)	'Health Insurance Portability and Accountability Act and Privacy Standards' means the privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability Act of 1996 (Pub. L. 104-191) and the final rules adopted December 28, 2000, as modified August 14, 2002, and any subsequent amendments.
(2)	'Marketing' or 'to market' means to make a communication about a product or service to encourage recipients of the communication to purchase or use the product of service, but does not include communications:
a.	Made as part of the treatment of an individual for the purpose of furthering treatment;
b.	For care coordination and managing the treatment of the individual, including communications made for the purpose of furthering the individual's adherence to a prescription drug medication or for the purpose of recommending alternative treatments or settings of care to the individual, and including questionnaires and surveys sent directly to or used directly with individuals; or
c.	By a health benefit plan to its enrollees about the plan of benefits and replacements or enhancements to the benefit plan, the network of providers, or value-added services available to its enrollees.
"§ 132A-3. Protection of private health information.
(a)	A covered entity shall not, in the marketing of its products or services, disclose protected health information or use protected health information in its possession to market the products or service of another entity.
(b)	A covered entity may use protected health information to market its nonhealth-related products and services to an individual only if the covered entity:
(1)	Obtains the consent of the individual; and
(2)	Provides clear and conspicuous notice to the individual involved concerning its disclosure practices for that individual's protected health information.
(c)	Applicability. – This Article does not affect the validity of another law of this State that provides greater confidentiality for information made confidential by this Article. 
"§ 132A-4. Enforcement.
(a)	Injunctive Relief. – The Attorney General of this State may institute an action for injunctive relief to restrain a violation of this Article.
(b)	Civil Penalties. – In addition to the injunctive relief provided by this section, the Attorney General may institute an action for civil penalties against a covered entity for a violation of this Article. A civil penalty assessed under this section may not exceed five thousand dollars ($5,000) for each violation. If the court in which an action under this subsection is pending finds that the violations have occurred with a frequency as to constitute a pattern or practice, the court may assess a civil penalty not to exceed two hundred fifty thousand dollars ($250,000).
(c)	Availability of Other Remedies. – This Article does not affect any right of a person under other law to bring a cause of action or otherwise seek relief with respect to conduct that is a violation of this Article."
SECTION 2.  This act becomes effective January 1, 2004.