Committee reviews S.28 revisions to broaden patient privacy and allow pharmacy redaction for certain prescriptions

Legislative counsel reviewed a new draft of S.28 on April 9 that would expand state limits on disclosing protected health information tied to legally protected health care activity and add specific redaction rules for prescriptions for reproductive and gender‑affirming health care services.

The committee heard from Jen Harvey of the Office of Legislative Council, who walked members through the draft’s principal changes, including a new section that would bar covered entities and business associates from disclosing identifiable protected health information about legally protected health care activity to government entities other than the State of Vermont and its instrumentalities if the discloser has reason to believe the information will be used to investigate or penalize a person “for the mere act of seeking, obtaining, providing, or facilitating” such care. Harvey said the provision is intended to protect patients and providers to the extent state law can go beyond HIPAA’s permissive disclosures.

Harvey said the draft keeps existing exceptions but reorganizes them into a two‑part structure: the general prohibition (subdivision 1) and a set of circumstances under which disclosure is permitted (subdivision 2). Permitted disclosures would include those authorized in writing by the patient or the patient’s legal representative; disclosures required by federal law, Vermont law, or Vermont Supreme Court rules; disclosures ordered by a court finding good cause; and disclosures necessary for bona fide investigations by regulators such as the Board of Medical Practice or the Office of Professional Regulation (OPR), or for investigations of licensed facilities by the Vermont Department of Health or the Department of Disabilities, Aging, and Independent Living (DAIL).

The draft also clarifies that a covered entity may designate a person (including a business associate) to receive protected information, but the recipient may use that information only to defend the covered entity in proceedings arising from claims against it.

One of the bill’s operational provisions would let a pharmacist or other licensed pharmacy staff redact or remove a prescribing practitioner’s name or initials from a fulfilled prescription and from any accompanying printed material for non‑controlled medications used for gender‑affirming or reproductive health care services, if the prescriber requests it and federal law does not expressly require the name. The pharmacy could also redact the pharmacist’s own name or initials on request. The draft creates a limited immunity for a pharmacist or licensed pharmacy staff member who fails to redact a name when requested, except for conduct rising to gross negligence, recklessness, or intentional misconduct.

Committee members asked how those redaction requests would be communicated in practice. Harvey said requests could come via existing e‑prescribing systems (for example, by adding a checkbox or a flag), by fax cover sheets, phone messages, or other transmittal mechanisms used today; members and stakeholders noted that implementation will rely on pharmacies’ workflows and software. Harvey emphasized that the redaction provisions apply only to non‑controlled medications: federal law generally requires practitioner identification on labels for controlled substances, and the bill does not override federal requirements.

Members also questioned the legal standard that limits immunity—gross negligence, recklessness, or intentional misconduct—and whether the bill should define those terms. Harvey and committee members discussed Vermont case law and the common legislative practice of not statutorily defining those culpability standards because courts interpret them; legislative counsel recommended against inserting a statutory definition and noted those concepts appear frequently across statutes and in case law.

The draft contains an edit to adaptive‑questionnaire language across provider licensing provisions to require that any adaptive screening tool be developed by or in consultation with health care professionals with clinically appropriate expertise and that the licensee be a licensed health care provider. That change is intended to ensure decision trees and clinical algorithms in an adaptive questionnaire are clinically appropriate, the committee was told.

The committee discussed terminology in the bill’s definitions, particularly the use of the phrase “behavioral health.” Harvey explained the drafting choice to include a broad list of services—“medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventative, rehabilitative, or supportive nature, including medication”—to align protections with other states and to cover services that can fall on a continuum across disciplines. Several members described the term “behavioral health” as problematic or painful for some constituents; others said keeping a broad definition helps prevent gaps that could be exploited outside Vermont. Harvey said the language can be adjusted but warned the committee that the bill’s intent is to be broadly protective.

No formal vote or committee action on final passage was recorded during this briefing. Harvey said stakeholders (including the Board of Pharmacy, OPR, pharmacists’ associations, the medical society, and advocacy organizations such as Planned Parenthood) had participated in drafting the redaction and immunity language and that the bill’s confidentiality provisions would take effect on passage rather than after a delayed implementation date.

The committee asked for additional practical detail and indicated it would revisit the draft at a subsequent meeting.