Draft bill 192.

Summary.

The draft bill amends the purpose of Law 68 of November 20, 2003 to cover call centers acting as providers, health insurers and brokers alongside patients, healthy persons, professionals, and public and private health centers and services. It brings those parties within the rules on information and free, informed decision making. Users of health services and insurance would have the right to learn which services are available and to receive them without discrimination and with respect for their individuality. A person's wish not to receive information would also be respected.

Within health centers and services and medical insurance, patients, insured persons and beneficiaries would be entitled to information about their own health, claims and medical procedures. An express wish not to be informed would be respected, as would a wish that information about a person's health or illness not be passed to family members, persons connected in fact or third parties. Information connected with care, including diagnoses, prognoses and treatment options, as well as claims, procedures and files, would have to be truthful and understandable. It would also have to address the patient's or insured person's needs and intellectual, emotional and cultural circumstances so that they can decide autonomously.

The proposal extends confidentiality to information about health, consultations, claims, procedures and medical records. Access would require the person's authorization unless current legislation provides otherwise. Breach of the duty of confidentiality would be sanctioned under the Criminal Code (Código Penal). Insurers, insurance brokers, clinics and health centers would have to adopt measures and, where appropriate, documented procedures to ensure lawful access to patient and insured person data under Law 81 of 2019 on Personal Data Protection (Ley 81 de 2019 sobre Protección de Datos Personales).

Clinical records would bring together each patient's care documents within each center and identify the physicians and other professionals involved. They would be portable, accessible to patients and interoperable with the unified record system operated by the Ministry of Health (Ministerio de Salud) and the Social Security Fund (Caja de Seguro Social). Records could use paper, audiovisual or electronic media if authenticity, digital storage and data protection are ensured. They could incorporate a user's chosen interoperable, omnichannel digital identity, subject to NIST SP 800-63, FIPS 140 - 2 and FIPS 201 - 2, while leaving control of information and prior consent with the user.

Health centers and services, brokers, insurers, call centers and providers handling patient or insured person information would have to protect it against accidental loss or destruction and unauthorized access, alteration, disclosure or other processing. They would also have to make it interoperable with the unified record system. Administrative staff at health centers and medical insurers could access only data relevant to their duties, with the user's prior authorization specifying which information, when, for what purpose and for how long. Accredited inspection staff of the Ministry of Health and the Social Security Fund could inspect records to verify care, patient rights and other obligations; they would owe confidentiality, their access would be logged, and users could authorize it in advance through digital identity. Management of the covered centers and companies would oversee, control and record data access.

Patients could exercise access rights through duly accredited representatives. The specified centers and companies would establish active custody arrangements enabling confidential collection, retrieval, integration and communication of records. The Ministry of Health and the Social Security Fund would promote a participatory study of a system for sharing records among care centers in Panama (Panamá), taking account of the unified record system being implemented since 2021. Entities handling records would have one year from the law's entry into force to adjust their processing and prepare standardized record models; subsequent care would be documented using the approved models. The draft bill would take effect upon promulgation. Its provisions concern those public bodies, health services, insurers, brokers and medical information providers.