Provides relative to protecting healthcare data

House Bill 897 enacts new subsections (G) and (H) of Louisiana Revised Statute 46:972.1 to establish comprehensive data protection requirements for the Louisiana Pregnancy and Baby Care Initiative. The legislation adds mandatory confidentiality provisions that prohibit the general contractor and subcontractors operating the program from disclosing a client's name or any protected health information that could be reasonably linked to an individual without obtaining the client's written permission for each specific disclosure. Before seeking such written consent, contractors must provide clients with a clear privacy notice detailing the purpose of disclosure, the specific types of information to be shared, and the identity of third parties who may receive the information. The statute also requires contractors to establish a simple mechanism allowing clients to revoke previously granted consent and mandates that clients receive copies of their complete records within ten business days upon request at no cost, while permitting disclosure of aggregated or de-identified data that maintains individual confidentiality.

The practical effect of this legislation extends to all individuals and families utilizing services through the Louisiana Pregnancy and Baby Care Initiative, including pregnant women, biological fathers of unborn children, parents or guardians of children up to thirty-six months old, individuals who have experienced child loss, and immediate family members of participating parents. The general contractor and any subcontractors providing counseling, mentoring, referrals, educational classes, or material assistance under the program must comply with these new requirements or face significant consequences. Violations may result in the Department of Children and Family Services declaring a contractor ineligible for future contracts, suspending or terminating existing contracts, or declining to renew agreements, though the department must afford contractors notice and an opportunity to cure violations or respond before taking such action in accordance with applicable state contracting procedures.

These provisions operate within the existing statutory framework of the Louisiana Pregnancy and Baby Care Initiative established in R.S. 46:972.1, which designates DCFS as the administering agency responsible for contracting with a single nonprofit general contractor that subcontracts with existing nonprofit service providers on a fee-for-service basis. The new data protection requirements interact with DCFS's general authority to manage and oversee contracts and align with Louisiana's broader regulatory approach to health information privacy. The bill addresses the intersection of healthcare privacy expectations and social service program administration, creating enforceable contractual obligations that ensure clients maintain meaningful control over the disclosure of their sensitive personal and health information within the program's ecosystem of multiple nonprofit organizations.