Wisconsin law requires that identifiable information contained in patient health care records be kept confidential, unless the patient provides informed consent to disclose the information to specific people or entities.1 A patient’s parents, guardian, or representatives may access a patient’s health care records and consent to the disclosure of such records if the patient is a minor or is incapacitated.2 Public use data files submitted to the Department of Health Services must not contain patient or employer identifying information, such as zip codes or race/ethnicity information.3  Wisconsin also requires its Department of Health Services to take steps to protect patient identifying data in data collection and dissemination.  The law requires that data be aggregated and that specific identifying elements be removed.  Furthermore, the law only allows the Department of Health Services to disclose patient identifying data to an agent of the Department, health care provider for verification purposes, or federal or state entity for epidemiological research.4  Wisconsin regulations specify information that is considered patient identifying, and therefore confidential, such as the patient’s date of birth, patient’s employment status, and hospitalization dates.5  Wisconsin law also protects the confidentiality of treatment records for mental illness, alcohol or drug abuse patients, and prohibits the disclosure of patient identifying information.6  In order to disclose whether a person is receiving any such treatment, a patient’s written informed consent must be given, except in limited circumstances, such as program evaluation, research or to law enforcement.7

        Wisconsin generally requires a person to authorize the release of their drug or disease test results. For example, employers may only access their employee’s genetic test results if the employee consents.8 However, Wisconsin requires providers to report, without the test subject’s consent, positive drug test results to a child welfare agency whenever the test subject is the mother of an infant or an expectant mother.9 Additionally, the results of HIV tests may be released without the test subject’s consent to various persons that need to information because they have been exposed to the test subject’s bodily fluid or the information is necessary to ensure their safety.10

        State law also prohibits the use or disclosure of information obtained regarding Medicaid patients or applicants not connected to the administration of benefits.11  Wisconsin also gives similar protections to information regarding Medicare beneficiaries or applicants.12  A number of Wisconsin’s privacy regulations also apply to private health insurance companies.  Insurers must provide a clear and conspicuous notice outlining their privacy policies regarding nonpublic personal financial information to customers.13  The law also requires insurers to provide consumers notice of their right to opt-out of disclosure of nonpublic personal financial information to third parties.14  The law provides certain exceptions for these requirements.15  Insurers are also prohibited from disclosing a consumer’s nonpublic health information unless the insurer obtains an authorization to disclose or the disclosure is for the performance of insurance functions.16  Wisconsin also prohibits insurers from disclosing a consumer’s policy number or similar account code to any nonaffiliated third party for any type of marketing purposes.17

        Publicly reported disease specific data is also subject to confidentiality laws in Wisconsin.  For example, all reports pertaining to sexually transmitted diseases must remain confidential and are not open to public inspection.18  Reports made to the Department of Human Services’ Division of Maternal Child Health regarding birth defects are subject to similar confidentiality requirements.  However, individually identifiable information may be released in some limited circumstances, such as for verification or research purposes.19  Individually identifiable cancer reports must also be kept confidential and cannot be disclosed unless it is to a central registry or for research purposes.20

        Wisconsin does allow certain persons and entities to access, in limited circumstances, patient health records and disclose information contained therein without the patient’s consent. Wisconsin also allows the disclosure of patient health information for purposes of quality and utilization review, but quality and utilization review organizations that access such information must keep it confidential.21