• Main Menu
• Issues
• Legal Issues

November 1, 2006

Summary of P.A. 93-739

P.A. 93-739 places new conditions on hospital use of patient social security numbers, which took effect on July 1, 2006. Under P.A. 93-679, which amends the Illinois Consumer Fraud and Deceptive Business Practices Act, a hospital may not print a patient’s social security number on any materials mailed to the patient. It may do so, however, if it had a continuous practice of mailing such material to patients on or before July 1, 2005. Thus, an existing practice of using social security numbers in patient billing records shared with patients via the mail is permissible if it existed on July 1, 2005.

But, a hospital that sends patients billing records containing their social security numbers must now send those patients an annual disclosure that informs the patient that he or she has the right to stop the inclusion of his or her social security number in their mailed billing records. If a patient advises the hospital in writing that the patient wishes to have the hospital stop using the patient’s social security number in materials that are sent by mail to the patient, the hospital must do so within 30 days of receiving such written notice.

A hospital may not encode or embed a social security number on a patient’s billing records that are placed in the mail through means such as using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number as required by P.A. 93-739. A hospital also may not charge the patient a fee for implementing the request and it may not deny a patient any services for making such a request.

Interestingly, the law creates a "safe harbor" for hospitals in the event that the Department of Health and Human Services establishes a national unique patient health identifier program. Under P.A. 93-739, any person who complies with such a federal law will be deemed to be in compliance with this law.

Analysis of P.A. 93-739
P.A. 93-739 is designed to protect individuals from having their social security numbers identified by individuals who may steal their mail. A hospital that has historically sent billing records to patients with the patient’s social security number, may continue to do so as long as it informs patients of their right to have this practice stop. It is not required to stop including such information in billing records sent to patients unless and until the patient responds in writing to end the practice.

This law took effect on July 1, 2006, so hospitals that send billing records containing patient social security numbers to patients will have to provide them with an annual disclosure of the patient’s right to have the practice stopped no later than July 1, 2007. It is unclear how many patients will go through the trouble of sending the hospital a letter instructing the hospital to stop sending billing records with their social security number on them.

When such a request is made, the hospital may either stop including a patient’s social security number on all of its billing records for all patients (i.e., a system-wide adjustment) or it may simply establish a system to ensure that only those patients who made a formal written request to have the practice stopped no longer get billing records containing social security numbers via record redaction or some other information masking technique (i.e., a case-by-case approach). In any event, the practice would have to stop within 30 days of the hospital receiving the request.

The Illinois Attorney General has the authority to enforce this new section of the Consumer Fraud and Deceptive Business Practices Act.

The complete text of P.A. 93-739 can be found by clicking here.

Staff Contact: Ted Nodzenski: (630) 276-5472