BILL NUMBER: SB 1492 ENROLLED
BILL TEXT
PASSED THE SENATE AUGUST 27, 2004
PASSED THE ASSEMBLY AUGUST 25, 2004
AMENDED IN ASSEMBLY AUGUST 23, 2004
AMENDED IN ASSEMBLY JUNE 30, 2004
AMENDED IN ASSEMBLY JUNE 9, 2004
AMENDED IN SENATE MAY 25, 2004
AMENDED IN SENATE MAY 11, 2004
AMENDED IN SENATE APRIL 12, 2004
INTRODUCED BY Senator Dunn
FEBRUARY 19, 2004
An act to add Chapter 6.5 (commencing with Section 56.32) to Part
2.6 of Division 1 of the Civil Code, relating to confidential
information.
LEGISLATIVE COUNSEL'S DIGEST
SB 1492, Dunn. Confidential information.
Existing law prohibits a health care provider, health care service
plan, or contractor from disclosing medical information regarding
any patient of the health care provider or enrollee or subscriber of
the health care service plan without first obtaining an
authorization, except as specified. Existing law makes a violation
of this provision, and related provisions relating to the handling of
confidential medical information, subject to administrative, civil,
and criminal penalties.
This bill would prohibit a health care business, as defined, from
transmitting individually identifiable health information, as
defined, to a site outside the United States, unless specified notice
and authorization requirements are satisfied. The bill would also
require a person or entity that has contracted or subcontracted with
a health care business to receive individually identifiable health
information to disclose to the business if any of the information
will be transferred outside the United States. The bill would
further require specified persons and entities to make those
disclosures to their patients, upon request. The bill would prohibit
a health care business from discriminating against an individual or
denying an individual health care service because the individual has
not consented to the transfer of individually identifiable
information outside the United States. This bill would create a
state-mandated local program by imposing the above-described
penalties on persons who violate this provision.
The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that no reimbursement is required by this
act for a specified reason.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Chapter 6.5 (commencing with Section 56.32) is added to
Part 2.6 of Division 1 of the Civil Code, to read:
CHAPTER 6.5. DISCLOSURE OF MEDICAL INFORMATION BY HEALTH CARE
BUSINESSES
56.32. (a) For purposes of this chapter, a "health care business"
means any person or entity, whether established to make a profit or
not, that collects or retains individually identifiable health
information about individuals in relation to medical care, that is
described below:
(1) A health care facility or health care plan licensed pursuant
to Division 2 (commencing with Section 1200) of the Health and Safety
Code, other than an entity described in paragraph (2).
(2) An entity offering health insurance, as defined in subdivision
(b) of Section 106 of the Insurance Code.
(b) For purposes of this chapter, "individually identifiable
health information" has the same meaning as the term "medical
information" in subdivision (g) of Section 56.05.
56.33. (a) A person or entity that has contracted or
subcontracted with a health care business, physician and surgeon, or
entity identified pursuant to subdivision (f) or (g) of Section
1375.4 of the Health and Safety Code, to receive individually
identifiable health information shall disclose to the health care
business if any of the information will be transferred to a site
outside the United States.
(b) No health care business, or person or entity that has
contracted or subcontracted with a health care business, shall
transmit individually identifiable health information to a site
outside the United States unless all of the following apply:
(1) The health care business discloses to the individual at the
time of enrollment and reenrollment, or in the case of a health
facility upon admission or as soon as practical after admission, that
his or her individually identifiable health information may be
transmitted to a site outside the United States.
(2) The health care business obtains a consent acknowledgment
pursuant to Section 56.34 from the individual whose health
information is identifiable that his or her individually identifiable
health information may be transmitted to a site outside the United
States.
(3) The consent of the individual has been granted or renewed on
at least an annual basis.
(4) The individual may revoke his or her consent in writing to the
health care business at any time.
(5) The obligations imposed on a health care business by this
section are undertaken by the business itself and are not delegated
to a physician and surgeon employed by, or contracted with, the
health care business.
56.33.5. A health care business, physician and surgeon, or entity
identified pursuant to subdivision (f) or (g) of Section 1375.4 of
the Health and Safety Code, shall disclose to the patient, upon the
patient's request, if individually identifiable health information is
transmitted to a site outside of the United States.
56.34. Except for a request for health care services initiated by
an individual seeking diagnosis or treatment outside of the United
States, a health care business shall utilize a form, statement, or
writing to obtain consent to transmit individually identifiable
health information to a site outside the United States. The form,
statement, or writing shall meet the following criteria:
(a) It shall be a separate document, and it shall not be attached
to any other document.
(b) It shall be dated and signed by the individual whose health
care information is identifiable.
(c) It shall clearly and conspicuously disclose all of the
following:
(1) By signing, the individual is consenting to the transmission
of his or her individually identifiable health information to a site
outside the United States.
(2) The consent of the individual must be renewed on at least an
annual basis.
(3) The individual may revoke his or her consent at any time.
(4) The procedure by which consent may be revoked.
56.34.5. A health care business shall not discriminate against an
individual or deny an individual health care service because the
individual has not provided his or her consent pursuant to Sections
56.33 and 56.34.
SEC. 2. No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution because
the only costs that may be incurred by a local agency or school
district will be incurred because this act creates a new crime or
infraction, eliminates a crime or infraction, or changes the penalty
for a crime or infraction, within the meaning of Section 17556 of the
Government Code, or changes the definition of a crime within the
meaning of Section 6 of Article XIII B of the California
Constitution.