AN ACT CONCERNING PHARMACY REWARDS PROGRAMS AND PROTECTED HEALTH INFORMATION.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. (NEW) (Effective July 1, 2014) (a) For purposes of this section, "pharmacy rewards program" means a promotional arrangement under which a retailer provides a consumer with store credits, discounts or other tangible benefits in exchange for the consumer filling drug prescriptions through such retailer or its affiliate.

(b) Prior to enrolling a consumer in a pharmacy rewards program, a retailer shall provide the consumer with a plain language summary of the terms and conditions of such program. Such summary shall be in writing and shall include, if a HIPAA authorization is required to participate in the program, a disclosure statement that contains conspicuous notice, in bold font, of what a HIPAA authorization is and that explains that, once a HIPAA authorization is signed, the consumer's personal health information may no longer be protected by federal and state privacy laws.

(c) If the consumer is required to sign a HIPAA authorization to participate in the program, the retailer shall include information on the enrollment form, at the point of HIPAA authorization, that states: (1) The specific uses or disclosures the HIPAA authorization allows, (2) whether personal health information obtained by the retailer will be disclosed to third parties and, if so disclosed, shall include a disclosure statement that such information will not be protected by federal or state privacy laws, (3) which, if any, third parties will have access to the consumer's protected health information, (4) instructions on how to revoke the authorization, and (5) that the consumer is entitled to a copy of the authorization once signed.

(d) The terms "HIPAA", "Health Insurance Portability and Accountability Act of 1996", "HIPAA authorization", "personal health information", "Privacy Rule", "privacy law" and "marketing purposes" shall be defined in promotional materials, in the summary required pursuant to subsection (b) of this section, and on the enrollment form at the point of HIPAA authorization, if such terms are used in such materials, summary or enrollment form.

(e) A violation of subsection (b), (c) or (d) of this section shall be deemed an unfair or deceptive act or practice in the conduct of trade or commerce under subsection (a) of section 42-110b of the general statutes.