BILL NUMBER: AB 2191 CHAPTERED 09/25/02 CHAPTER 853 FILED WITH SECRETARY OF STATE SEPTEMBER 25, 2002 APPROVED BY GOVERNOR SEPTEMBER 25, 2002 PASSED THE ASSEMBLY AUGUST 22, 2002 PASSED THE SENATE AUGUST 20, 2002 AMENDED IN SENATE AUGUST 12, 2002 AMENDED IN ASSEMBLY MAY 16, 2002 AMENDED IN ASSEMBLY MAY 1, 2002 AMENDED IN ASSEMBLY APRIL 1, 2002 INTRODUCED BY Assembly Member Migden (Principal coauthor: Assembly Member Papan) FEBRUARY 20, 2002 An act to amend Sections 56.05, 56.101, 56.11, and 56.12 of, and to add Section 56.102 to, the Civil Code, relating to medical information. LEGISLATIVE COUNSEL'S DIGEST AB 2191, Migden. Medical records: confidentiality. (1) Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, and contractors, as defined, from disclosing medical information regarding a patient, without first obtaining authorization, except in specified instances. This bill would prohibit pharmaceutical companies, as defined, or agents or representatives of pharmaceutical companies, from disclosing medical information regarding a patient, without first obtaining authorization, except as specified. (2) The Confidentiality of Medical Information Act also prohibits providers of health care, health care service plans, and contractors from requiring a patient, as a condition of receiving health care services, to sign an authorization, release, consent, or waiver permitting the disclosure of medical information, except as specified, and further requires these entities to maintain, dispose of, and release medical information and records in a manner that preserves confidentiality, according to certain procedures. This bill would prohibit pharmaceutical companies, or agents or representatives of pharmaceutical companies, as defined, from requiring a patient, as a condition of receiving pharmaceuticals, medications, or prescription drugs, to sign an authorization, release, consent, or waiver permitting the disclosure of medical information, except as specified. The bill would also require pharmaceutical companies to adhere to specified procedures regarding the maintenance, disposal, and release of medical information and records. (3) A violation of the Confidentiality of Medical Information Act constitutes a crime. Because a violation of this bill would be a crime, this bill would impose a state-mandated local program by creating a new crime. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 56.05 of the Civil Code is amended to read: 56.05. For purposes of this part: (a) "Authorization" means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information. (b) "Authorized recipient" means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20. (c) "Contractor" means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. "Contractor" does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). (d) "Health care service plan" means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). (e) "Licensed health care professional" means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code. (f) "Medical information" means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment. "Individually identifiable" means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual's identity. (g) "Patient" means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (h) "Pharmaceutical company" means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. "Pharmaceutical company" does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care. (i) "Provider of health care" means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. "Provider of health care" does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code. SEC. 2. Section 56.101 of the Civil Code is amended to read: 56.101. Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical records shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical records shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36. SEC. 3. Section 56.102 is added to the Civil Code, to read: 56.102. (a) A pharmaceutical company may not require a patient, as a condition of receiving pharmaceuticals, medications, or prescription drugs, to sign an authorization, release, consent, or waiver that would permit the disclosure of medical information that otherwise may not be disclosed under Section 56.10 or any other provision of law, unless the disclosure is for one of the following purposes: (1) Enrollment of the patient in a patient assistance program or prescription drug discount program. (2) Enrollment of the patient in a clinical research project. (3) Prioritization of distribution to the patient of a prescription medicine in limited supply in the United States. (4) Response to an inquiry from the patient communicated in writing, by telephone, or by electronic mail. (b) Except as provided in subdivision (a) or Section 56.10, a pharmaceutical company may not disclose medical information provided to it without first obtaining a valid authorization from the patient. SEC. 4. Section 56.11 of the Civil Code is amended to read: 56.11. Any person or entity that wishes to obtain medical information pursuant to subdivision (a) of Section 56.10, other than a person or entity authorized to receive medical information pursuant to subdivision (b) or (c) of Section 56.10, shall obtain a valid authorization for the release of this information. An authorization for the release of medical information by a provider of health care, health care service plan, pharmaceutical company, or contractor shall be valid if it: (a) Is handwritten by the person who signs it or is in typeface no smaller than 8-point type. (b) Is clearly separate from any other language present on the same page and is executed by a signature which serves no other purpose than to execute the authorization. (c) Is signed and dated by one of the following: (1) The patient. A patient who is a minor may only sign an authorization for the release of medical information obtained by a provider of health care, health care service plan, pharmaceutical company, or contractor in the course of furnishing services to which the minor could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60). (2) The legal representative of the patient, if the patient is a minor or an incompetent. However, authorization may not be given under this subdivision for the disclosure of medical information obtained by the provider of health care, health care service plan, pharmaceutical company, or contractor in the course of furnishing services to which a minor patient could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60). (3) The spouse of the patient or the person financially responsible for the patient, where the medical information is being sought for the sole purpose of processing an application for health insurance or for enrollment in a nonprofit hospital plan, a health care service plan, or an employee benefit plan, and where the patient is to be an enrolled spouse or dependent under the policy or plan. (4) The beneficiary or personal representative of a deceased patient. (d) States the specific uses and limitations on the types of medical information to be disclosed. (e) States the name or functions of the provider of health care, health care service plan, pharmaceutical company, or contractor that may disclose the medical information. (f) States the name or functions of the persons or entities authorized to receive the medical information. (g) States the specific uses and limitations on the use of the medical information by the persons or entities authorized to receive the medical information. (h) States a specific date after which the provider of health care, health care service plan, pharmaceutical company, or contractor is no longer authorized to disclose the medical information. (i) Advises the person signing the authorization of the right to receive a copy of the authorization. SEC. 5. Section 56.12 of the Civil Code is amended to read: 56.12. Upon demand by the patient or the person who signed an authorization, a provider of health care, health care service plan, pharmaceutical company, or contractor possessing the authorization shall furnish a true copy thereof. SEC. 6. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.