Florida Senate - 2014 COMMITTEE AMENDMENT
Bill No. SB 862
Ì1215485Î121548
LEGISLATIVE ACTION
Senate . House
Comm: RCS .
04/02/2014 .
.
.
.
—————————————————————————————————————————————————————————————————
—————————————————————————————————————————————————————————————————
1 Senate Amendment (with title amendment)
2
3 Delete lines 360 - 427
4 and insert:
5 3. A law enforcement agency during active investigations of
6 regarding potential criminal activity, fraud, or theft regarding
7 prescribed controlled substances, in accordance with paragraph
8 (d).
9 4. A patient or the legal guardian or designated health
10 care surrogate of an incapacitated patient as described in s.
11 893.0551 who, for the purpose of verifying the accuracy of the
12 database information, submits a written and notarized request
13 that includes the patient’s full name, address, and date of
14 birth, and includes the same information if the legal guardian
15 or health care surrogate submits the request. If the patient’s
16 legal guardian or health care surrogate is the requestor, the
17 request shall be validated by the department to verify the
18 identity of the patient and the legal guardian or health care
19 surrogate, if the patient’s legal guardian or health care
20 surrogate is the requestor. Such verification is also required
21 for any request to change a patient’s prescription history or
22 other information related to his or her information in the
23 electronic database.
24 (c) Information in or released from the prescription drug
25 monitoring program database for the electronic prescription drug
26 monitoring system is not discoverable or admissible in any civil
27 or administrative action, except in an investigation and
28 disciplinary proceeding by the department or the appropriate
29 regulatory board. Information shared with a state attorney
30 pursuant to s. 893.0551(3)(a) or (c) may be released only in
31 response to a discovery demand if such information is directly
32 related to the criminal case for which the information was
33 requested. If additional information is shared with the state
34 attorney which is not directly related to the criminal case, the
35 state attorney shall inform the inquirer that such information
36 exists. Unrelated information may not be released except upon an
37 order of a court of competent jurisdiction.
38 (d) The department shall adopt a user agreement by rule.
39 Before releasing any information pursuant to subparagraph (b)3.,
40 the department shall enter into a user agreement with the law
41 enforcement agency requesting information from the prescription
42 drug monitoring database. At a minimum, the user agreement must:
43 1. Provide for access control and information security in
44 order to ensure the confidentiality of the information.
45 2. Contain training requirements.
46 3. Require each agency head to submit an annual attestation
47 to the program manager that the user agreement is being complied
48 with and to disclose any findings and actions taken to maintain
49 compliance. Any findings of noncompliance must be reported
50 immediately by the agency head to the program manager.
51 4. Require each agency that receives information from the
52 database to electronically update the database semiannually with
53 the status of the case for which the information was requested,
54 in accordance with procedures established by department rule.
55 5. Require each agency head to appoint one agency
56 administrator to be responsible for appointing authorized users
57 to request and receive investigative reports on behalf of the
58 agency to ensure the agency maintains compliance with the user
59 agreement and laws governing access, use, and dissemination of
60 information received.
61 6. Require each authorized user to attest that each request
62 for confidential information from the database is predicated on
63 and related to an active investigation.
64 7. Require the agency to conduct annual audits of the
65 administrator and of each authorized user to ensure the user
66 agreement is being followed. Such audits must be conducted by an
67 internal affairs, professional compliance, inspector general, or
68 similarly situated unit within the agency which normally handles
69 inspections or internal investigations for that agency. The
70 review must include any allegations of noncompliance, potential
71 security violations, and a report on the user’s compliance with
72 laws, rules, and the user agreement. The agency shall also
73 conduct routine audits on access and dissemination of records.
74 The results of each audit shall be submitted to the program
75 manager within 7 days after completing the audit. By October 1,
76 2014, the department shall adopt rules to ensure that each
77 agency is complying with the audit requirements pursuant to this
78 subparagraph.
79 8. Allow the program manager to restrict, suspend, or
80 terminate an administrator’s or authorized user’s access to
81 information in the database if the department finds that the
82 administrator or authorized user has failed to comply with the
83 terms of the user agreement. If an agency does not comply with
84 the department’s rules on audit requirements, the program
85 manager shall suspend the agency’s access to information in the
86 database until the agency comes into compliance with such rules.
87 (e)(d) Other than the program manager and his or her
88 program or support staff as authorized in paragraph (f),
89 department staff are, for the purpose of calculating performance
90 measures pursuant to subsection (8), shall not be allowed direct
91 access to information in the prescription drug monitoring
92 program database but may request from the program manager and,
93 when authorized by the program manager, the program manager’s
94 program and support staff, information that does not contain
95 contains no identifying information of any patient, physician,
96 health care practitioner, prescriber, or dispenser and that is
97 not confidential and exempt for the purpose of calculating
98 performance measures pursuant to subsection (7).
99 (f) The program manager and designated support staff, upon
100 the direction of the program manager or as otherwise authorized
101 during the program manager’s absence, may access the
102 prescription drug monitoring program database only to manage the
103 program or to manage the program database and systems in support
104 of the requirements of this section or as established by the
105 department in rule pursuant to subparagraph (2)(c)4. The program
106 manager, designated program and support staff who act at the
107 direction of or in the absence of the program manager, and any
108 individual who has similar access regarding the management of
109 the database from the prescription drug monitoring program shall
110 submit fingerprints to the department for background screening.
111 The department shall follow the procedure established by the
112 Department of Law Enforcement to request a statewide criminal
113 history record check and to request that the Department of Law
114 Enforcement forward the fingerprints to the Federal Bureau of
115 Investigation for a national criminal history record check.
116 (g) If the program manager determines a pattern consistent
117 with the rules established under subparagraph (2)(c)4., the
118 department may provide:
119 1. A patient advisory report to an appropriate health care
120 practitioner; and
121 2. Relevant information that does not contain personal
122 identifying information to the applicable law enforcement
123 agency. A law enforcement agency may use such information to
124 determine whether an active investigation is warranted.
125 (h)(e) All transmissions of data required by this section
126
127 ================= T I T L E A M E N D M E N T ================
128 And the title is amended as follows:
129 Delete lines 7 - 23
130 and insert:
131 Department of Health; providing requirements for the
132 release of information shared with a state attorney in
133 response to a discovery demand; providing procedures
134 for the release of information to a law enforcement
135 agency during an active investigation; requiring the
136 department to adopt a user agreement by rule;
137 requiring the department to enter into a user
138 agreement with the law enforcement agency requesting
139 the release of information; providing requirements for
140 the user agreement; requiring a law enforcement agency
141 under a user agreement to conduct annual audits;
142 providing for the restriction, suspension, or
143 termination of a user agreement; providing for access
144 to the program database by the program manager and
145 designated support staff; authorizing the department
146 to provide a patient advisory report to the
147 appropriate health care practitioner if the program
148 manager determines that a specified pattern exists;
149 authorizing the department to provide relevant
150 information that does not contain personal identifying
151 information to a law enforcement agency if the program
152 manager determines that a specified pattern exists;
153 authorizing the law enforcement agency to use such
154 information to determine whether an active
155 investigation is warranted; authorizing the