BILL NUMBER: AB 2876 CHAPTERED 09/09/04 CHAPTER 434 FILED WITH SECRETARY OF STATE SEPTEMBER 9, 2004 APPROVED BY GOVERNOR SEPTEMBER 9, 2004 PASSED THE ASSEMBLY AUGUST 16, 2004 PASSED THE SENATE JULY 29, 2004 AMENDED IN SENATE JULY 21, 2004 AMENDED IN SENATE JUNE 22, 2004 AMENDED IN SENATE JUNE 8, 2004 AMENDED IN SENATE MAY 24, 2004 AMENDED IN ASSEMBLY MARCH 23, 2004 INTRODUCED BY Assembly Member Frommer FEBRUARY 20, 2004 An act to add Section 128766 to the Health and Safety Code, relating to health facilities. LEGISLATIVE COUNSEL'S DIGEST AB 2876, Frommer. Health facilities: information: disclosure. Under existing law, the State Department of Health Services regulates the licensure and operation of health facilities, including hospitals. Existing law requires health facilities to file reports with the Office of Statewide Health Planning and Development. These reports include a Hospital Discharge Abstract Data Record, an Emergency Care Data Record, and an Ambulatory Surgery Data Record, which contain information regarding each patient. Existing law requires the office to maintain a file containing these reports and, subject to any rules the office may prescribe, requires that these reports be produced and made available for inspection upon the demand of any person, with the exception of hospital discharge abstract data that is required to be made available unless the office determines that an individual patient's rights of confidentiality would be violated. This bill would require the office, notwithstanding any other provision of law, upon request, to disclose information contained in the above records to a California hospital and a local health department or local health officer. The bill would require the office to disclose that information to the National Center for Health Statistics or any other unit of the Centers for Disease Control and Prevention, or the Agency for Healthcare Research and Quality of the United States Department of Health and Human Services, for conducting a statutorily authorized activity. The bill would require that all disclosures be consistent with federal regulations regarding the privacy of health information. However, the bill would prohibit any disclosure if the director of the office has determined that the disclosure would create an unreasonable risk to patient privacy, and would require the director to provide a written explanation of the determination to the requester within 60 days. The bill would prohibit a hospital that receives the above information from disclosing that information to any person or entity, except in response to a court order, search warrant, or subpoena, or as otherwise required or permitted by federal medical privacy regulations. The bill would prohibit a hospital, contractor, or subcontractor from reidentifying or attempting to reidentify any health information received. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 128766 is added to the Health and Safety Code, to read: 128766. (a) Notwithstanding Section 128765 or any other provision of law, the office, upon request, shall disclose information collected pursuant to subdivision (g) of Section 128735 and Sections 128736 and 128737, to any California hospital and any local health department or local health officer in California as set forth in Part 3 (commencing with Section 101000) of Division 101. The office shall disclose this same information to the National Center for Health Statistics or any other unit of the Centers for Disease Control and Prevention, or the Agency for Healthcare Research and Quality of the United States Department of Health and Human Services, for the purposes of conducting a statutorily authorized activity. All disclosures made pursuant to this section shall be consistent with the standards and limitations applicable to the disclosure of limited data sets as provided in Section 164.514 of Part 164 of Title 45 of the Code of Federal Regulations, relating to the privacy of health information. (b) Any hospital that receives information pursuant to this section shall not disclose that information to any person or entity, except in response to a court order, search warrant, or subpoena, or as otherwise required or permitted by the federal medical privacy regulations contained in Parts 160 and 164 of Title 45 of the Code of Federal Regulations. In no case shall a hospital, contractor, or subcontractor reidentify or attempt to reidentify any information received pursuant to this section. (c) No disclosure shall be made pursuant to this section if the director of the office has determined that the disclosure would create an unreasonable risk to patient privacy. The director shall provide a written explanation of the determination to the requester within 60 days.