Health care; allowing patients to request certain restrictions on disclosure of protected health information. Effective date.
Summary
SB 567 creates a new section of Oklahoma law allowing a patient to ask a health care provider or other HIPAA-covered entity to place restrictions on certain disclosures of the patient’s protected health information. The bill specifically addresses disclosures for treatment, payment, and health care operations; disclosures to people involved in the patient’s care or payment; and notifications to family members or others about the patient’s general condition, location, or death.
The bill also allows a patient to request restrictions on a covered entity’s disclosure to another covered entity of certain personal identifying and financial information, including name, address, date of birth, contact information, Social Security number, state identification information, and financial account or card information. The act is set to become effective November 1, 2025.
Impact
If enacted, SB 567 would add a new patient-privacy provision to Title 63 of the Oklahoma Statutes, expanding the circumstances in which patients can request limits on the sharing of their health and personal information. It would affect health care providers and other HIPAA-covered entities by requiring them to consider patient-requested restrictions on specified disclosures, particularly those involving care coordination, family notifications, and transfer of personal identifying or financial data.
Sentiment
The available record shows no committee transcript, vote history, or recorded debate, so there is no documented public sentiment from legislative discussion. Based on the bill text alone, the measure appears privacy-focused and consumer-protective, with an emphasis on giving patients greater control over sensitive information.
Contention
No specific points of contention are documented in the provided materials. Potential areas of debate, based on the bill’s language, could include how the restriction requests would be implemented by covered entities, whether the restrictions would be mandatory or discretionary in practice, and how the bill would interact with existing HIPAA requirements and health care operations.