Chapter 153

153.50(3)(b)5. 5. The signature of the insured or other authorized signature.

153.50(3)(b)6. 6. The signature of the physician.

153.50(3)(b)7. 7. The patient’s account number, after use only as verification of data by the department or by the entity.

153.50(3)(c) (c) Develop, for use by purchasers of data under this subchapter, a data use agreement that specifies data use restrictions, appropriate uses of data and penalties for misuse of data, and notify prospective and current purchasers of data of the appropriate uses.

153.50(3)(d) (d) Require that a purchaser of data under this subchapter sign and have notarized the data use agreement of the department, the entity, or the data organization, as applicable.

153.50(3m) (3m) Provider, administrator, or insurer measures to ensure patient identity protection. A health care provider that is not a hospital or ambulatory surgery center or an insurer or an administrator shall, before submitting information required by the department, or by the data organization under contract under s. 153.05 (2r), under this subchapter, convert to a payer category code as specified by the department or the data organization, as applicable, any names of an insured’s payer or other insured’s payer.

153.50(4) (4) Release of patient-identifiable data.

153.50(4)(a) (a) Except as specified in. pars. (b) and (c), under the procedures specified in sub. (5), release of patient-identifiable data may be made only to any of the following:

153.50(4)(a)1. 1.

153.50(4)(a)1.a. a. An agent of the department who is responsible for the patient-identifiable data in the department, in order to store the data and ensure the accuracy of the information in the database of the department or to create a calculated variable that is derived from the patient-identifiable data.

153.50(4)(a)1.b. b. An agent of the entity under contract under s. 153.05 (2m) (a) who is responsible for the patient-identifiable data of the entity, in order to store the data and ensure the accuracy of the information in the database of the entity or to create a calculated variable that is derived from the patient-identifiable data.

153.50(4)(a)1.c. c. An agent of the data organization under contract under s. 153.05 (2r) who is responsible for the patient-identifiable data of the data organization, in order to store the data and ensure the accuracy of the information in the database of the data organization or to create a calculated variable that is derived from the patient-identifiable data.

153.50(4)(a)2. 2. A health care provider that is not a hospital or ambulatory surgery center or the agent of such a health care provider, to ensure the accuracy of the information in the database of the department or the data organization under contract under s. 153.05 (2r), or a health care provider that is a hospital or ambulatory surgery center or the agent of such a health care provider, to ensure the accuracy of the information in the database of the entity under contract under s. 153.05 (2m) (a).

153.50(4)(a)3. 3. The department or its agent, for purposes of epidemiological investigation, or, with respect to information from health care providers that are not hospitals or ambulatory surgery centers, the department or the data organization under contract under s. 153.05 (2r), to eliminate the need for duplicative databases.

153.50(4)(a)4. 4. An agency or organization that is required by federal or state statute to obtain patient-identifiable data for purposes of epidemiological investigation or to eliminate the need for duplicative databases.

153.50(4)(b) (b) Of information submitted by health care providers that are not hospitals or ambulatory surgery centers, patient-identifiable data that contain a patient’s date of birth may be released under par. (a) only under circumstances as specified by rule by the department.

153.50(4)(c) (c) The data organization under contract under s. 153.05 (2r) may not share health care claims data collected by the data organization unless the sharing is in compliance with 42 USC 1320d-2 and 1320d-4 and 45 CFR 164.

153.50(5) (5) Procedures for release of patient-identifiable data.

153.50(5)(a) (a) The department, an entity that is under contract under s. 153.05 (2m) (a), or a data organization that is under contract under s. 153.05 (2r) may not release or provide access to patient-identifiable data to a person authorized under sub. (4) (a) unless the authorized person requests the department, entity, or data organization, in writing, to release the patient-identifiable data. The request shall include all of the following:

153.50(5)(a)1. 1. The requester’s name and address.

153.50(5)(a)2. 2. The reason for the request.

153.50(5)(a)3. 3. For a person who is authorized under sub. (4) (a) to receive or have access to patient-identifiable data, evidence, in writing, that indicates that authorization.

153.50(5)(a)4. 4. For an agency or organization that is authorized under sub. (4) (a) 4. to receive or have access to patient-identifiable data, evidence, in writing, of all of the following:

153.50(5)(a)4.a. a. The federal or state statutory requirement to obtain the patient-identifiable data.

153.50(5)(a)4.b. b. Any federal or state statutory requirement to uphold the patient confidentiality provisions of this subchapter or patient confidentiality provisions that are more restrictive than those of this subchapter; or, if the latter evidence is inapplicable, an agreement, in writing, to uphold the patient confidentiality provisions of this subchapter.

153.50(5)(b) (b) Upon receipt of a request under par. (a), the department, entity, or data organization, whichever is applicable, shall, as soon as practicable, comply with the request or notify the requester, in writing, of all of the following:

153.50(5)(b)1. 1. That the department, entity, or data organization, as applicable, is denying the request in whole or in part.

153.50(5)(b)2. 2. The reason for the denial.

153.50(5)(b)3. 3. For a person who believes that he or she is authorized under sub. (4) (a), the action provided under s. 19.37.

153.50(5m) (5m) Employers not to request patient-identifiable data. Notwithstanding subs. (4) and (5) no employer may request the release of or access to patient-identifiable data of an employee of the employer.

153.50(6) (6) Information submitted.

153.50(6)(a) (a) The department or entity under contract under s. 153.05 (2m) (a) may not require a health care provider submitting health care information under this subchapter to include the patient’s name or social security number, and the department may not require a health care provider submitting health care information under this subchapter to include the patient’s street address.

153.50(6)(am) (am) Hospitals or ambulatory surgery centers shall submit the patient’s street address to the entity under contract under s. 153.05 (2m) (a) as directed by the entity. The entity may only use the street address to create a calculated variable that does not identify a patient’s address or to convert the data element to the corresponding U.S. bureau of the census census tract and block group. The entity shall destroy the street address information upon the creation of the variable or upon the conversion to the census tract and block group.

153.50(6)(b) (b) The department may not require under this subchapter a health care provider that is not a hospital or ambulatory surgery center to submit uniform patient billing forms.

153.50(6)(c) (c) A health care provider that is not a hospital or ambulatory surgery center may not submit any of the following to the department under the requirements of this subchapter:

153.50(6)(c)1. 1. The data elements specified under sub. (3) (b).

153.50(6)(c)2. 2. The patient’s telephone number.

153.50(6)(c)3. 3. The insured’s employer’s name or school name.

153.50(6)(c)4. 4. Data regarding insureds other than the patient, other than the payer category code under sub. (3m).

153.50(6)(c)5. 5. The patient’s employer’s name or school name.

153.50(6)(c)6. 6. The patient’s relationship to the insured.

153.50(6)(c)7. 7. The insured’s identification number.

153.50(6)(c)8. 8. The insured’s policy or group number.

153.50(6)(c)9. 9. The insured’s date of birth or sex.

153.50(6)(c)10. 10. The patient’s marital, employment or student status.

153.50(6)(d) (d) If a health care provider that is not a hospital or ambulatory surgery center submits a data element that is specified in par. (c) 1. to 10., the department shall immediately return this information to the health care provider or, if discovered later, shall remove and destroy the information.

153.50(6)(e) (e) A health care provider may not submit information that uses any of the following as a patient account number:

153.50(6)(e)1. 1. The patient’s social security number or any substantial portion of the patient’s social security number.

153.50(6)(e)2. 2. A number that is related to another patient identifying number.

153.50 History History: 1987 a. 399; 1989 a. 18; 1993 a. 16; 1995 a. 27 s. 9126 (19); 1997 a. 27, 231; 1999 a. 9, 185; 2003 a. 33; 2005 a. 228; 2009 a. 274; 2015 a. 287.

153.55 153.55 Protection of confidentiality. Data obtained under this subchapter is not subject to inspection, copying or receipt under s. 19.35 (1).

153.55 History History: 1997 a. 231; 1999 a. 9; 2009 a. 274.

153.60 153.60 Department expenditure estimate. Subject to s. 153.455, the department shall, by the first October 1 after the commencement of each fiscal year, estimate the total amount of expenditures under this subchapter for the department for that fiscal year for data collection, database development and maintenance, generation of data files and standard reports, orientation and training provided under s. 153.05 (9) (a) and contracting with the data organization under s. 153.05 (2r).

153.60 History History: 1987 a. 399; 1989 a. 18, 56; 1991 a. 178; 1993 a. 16; 1997 a. 27, 231, 237; 1999 a. 9, 185, 186; 2003 a. 33; 2005 a. 25, 228; 2009 a. 274; 2011 a. 32; 2015 a. 55.

153.65 153.65 Provision of special information; user fees.

153.65(1) (1) Subject to s. 153.455, the department may, but is not required to, provide, upon request from a person, a data compilation or a special report based on the information collected by the department. The department shall establish user fees for the provision of these compilations or reports, payable by the requester, which shall be sufficient to fund the actual necessary and direct cost of the compilation or report. All moneys collected under this subsection shall be credited to the appropriation under s. 20.435 (1) (hi).

153.65(2) (2) Beginning January 1, 2004, unless the entity under contract under s. 153.05 (2m) (a) otherwise agrees and except as provided in s. 153.46 (6), the entity has the exclusive right to use and to provide for a fee, upon request from a person, a data compilation or a special report based on the information concerning hospitals and ambulatory surgery centers that is collected by the entity or provided by the department to the entity. Subject to approval under s. 153.01 (4j) (b), the entity shall establish reasonable and necessary user fees for the provision of a compilation or report, payable by the requester, which shall be sufficient to fund the cost of the compilation or report. The entity may retain all user fees paid under this subsection.

153.65 History History: 1987 a. 399; 1993 a. 16, 104; 1997 a. 27, 231; 1999 a. 9; 2003 a. 33; 2005 a. 25, 228.

153.75 153.75 Rule making.

153.75(1) (1) The department shall promulgate the following rules, of which pars. (a), (b), (f), (h), (m), (n), (o), (r), (t), and (u) shall apply only if the contract under s. 153.05 (2r) is terminated under s. 153.455 (3) and s. 153.455 (4) applies:

153.75(1)(a) (a) Providing procedures, for information submitted by health care providers who are not hospitals or ambulatory surgery centers, to ensure the protection of patient confidentiality under s. 153.50.

153.75(1)(b) (b) Establishing procedures under which health care providers who are not hospitals or ambulatory surgery centers are permitted to review, verify and comment on information and include the comments with the information.

153.75(1)(f) (f) Governing the release of health care provider-specific and employer-specific data under s. 153.45 (1m) and (3).

153.75(1)(g) (g) Establishing criteria for the publication and contents of notices under s. 153.08.

153.75(1)(h) (h) Defining the term “major purchaser, payer or provider of health care services” for the purposes of s. 153.05 (6).

153.75(1)(m) (m) Specifying the classes of health care providers, other than hospitals and ambulatory surgery centers, from whom claims data and other health care information will be collected.

153.75(1)(n) (n) Specifying the uniform data set of health care information, as adjusted for case mix and severity, to be collected from health care providers other than hospitals and ambulatory surgery centers.

153.75(1)(o) (o) Specifying the means by which the information in par. (b) will be collected, including the procedures for submission of data by electronic means.

153.75(1)(p) (p) Specifying the methods for using and disseminating health care data in order for health care providers other than hospitals and ambulatory surgery centers to provide health care that is effective and economically efficient and for consumers and purchasers to make informed decisions in selecting health care plans and health care providers.

153.75(1)(q) (q) Specifying the information to be provided by the department in the consumer guide under s. 153.21 (1).

153.75(1)(r) (r) Specifying the standard reports that will be issued by the department in addition to those required in s. 153.21 (1).

153.75(1)(s) (s) Defining “individual data elements” for purposes of s. 153.45 (4).

153.75(1)(t) (t) Establishing standards for determining under s. 153.05 (13) if a requirement under s. 153.05 (1) (a), (5) (a), or (8) (a) is burdensome for a health care provider other than a hospital or ambulatory surgery center.

153.75(1)(u) (u) Specifying the methods for adjusting health care information obtained from health care providers other than hospitals and ambulatory surgery centers for case mix and severity.

153.75(2) (2) The department may promulgate all of the following rules, which shall apply only if the contract under s. 153.05 (2r) is terminated under s. 153.455 (3) and s. 153.455 (4) applies:

153.75(2)(a) (a) Exempting certain classes of health care providers that are not hospitals or ambulatory surgery centers from providing all or portions of the data required under this subchapter.

153.75(2)(c) (c) Providing for the efficient collection, analysis and dissemination of health care information which the department may require under this subchapter.

153.75 History History: 1987 a. 399; 1989 a. 18; 1993 a. 16; 1997 a. 27, 231; 2003 a. 33; 2005 a. 228; 2009 a. 274; 2017 a. 366.

153.75 Cross-reference Cross-reference: See also ch. DHS 120, Wis. adm. code.

153.76 153.76 Civil liability. Except as provided in s. 153.77, any person violating s. 153.50 or rules promulgated under s. 153.75 (1) (a) is liable to the patient for actual damages and costs, plus exemplary damages of up to $1,000 for a negligent violation and up to $5,000 for an intentional violation.

153.76 History History: 1987 s. 399; 1999 a. 9; 2009 a. 274 s. 37; Stats. 2009 s. 153.76.

153.77 153.77 Immunity from liability.

153.77(1) (1) A health care provider that submits information to the department under this subchapter is immune from civil liability for all of the following:

153.77(1)(a) (a) Any act or omission of an employee, official or agent of the health care provider that results in the release of a prohibited data element while submitting data to the department.

153.77(1)(b) (b) Any act or omission of the department that results in the release of data.

153.77(2) (2) The immunity provided under this section does not apply to intentional, willful or reckless acts or omissions by health care providers.

153.77 History History: 1999 a. 9; 2009 a. 274 s. 38; Stats. 2009 s. 153.77.

153.78 153.78 Penalties.

153.78(1) (1) Whoever intentionally violates s. 153.45 (5) or 153.50 or rules promulgated under s. 153.75 (1) (a) may be fined not more than $15,000 or imprisoned for not more than one year in the county jail or both.