BILL NUMBER: SB 1096	AMENDED
	BILL TEXT

	AMENDED IN SENATE  MAY 23, 2008
	AMENDED IN SENATE  MAY 8, 2008
	AMENDED IN SENATE  APRIL 14, 2008

INTRODUCED BY   Senator Calderon

                        JANUARY 14, 2008

   An act to amend Section 56.10 of the Civil Code, relating to
medical information.


	LEGISLATIVE COUNSEL'S DIGEST


   SB 1096, as amended, Calderon. Medical information.
   The Confidentiality of Medical Information Act prohibits a
provider of health care, a health care service plan, contractor, or
corporation and its subsidiaries and affiliates from intentionally
sharing, selling, using for marketing, or otherwise using any medical
information, as defined, for any purpose not necessary to provide
health care services to a patient, except as expressly authorized by
the patient, enrollee, or subscriber, as specified, or as otherwise
required or authorized by law. Violations of these provisions are
subject to a civil action for compensatory and punitive damages, and,
if a violation results in economic loss or personal injury to a
patient, it is punishable as a misdemeanor.
   This bill would, under those provisions, allow a pharmacy to mail
specified written communications to a patient, without the patient's
authorization under specified conditions. Those conditions include,
among other things, that the written communication be written in the
same language as the prescription label, that it instruct the patient
when to contact the health care professional, that it shall pertain
only to the prescribed course of medical treatment, that it may not
mention any other pharmaceutical products, that it shall be limited
to specified diseases, that further written communication may not be
provided under certain circumstances, that a copy of each version
shall be submitted to the federal Food and Drug Administration,
 and  that it shall include specified disclosures
regarding whether the pharmacy receives direct or indirect
remuneration for making that written communication , and that the
patient   shall   receive   an
opportunity to opt out of the written communication  .
   Vote: majority. Appropriation: no. Fiscal committee: no.
State-mandated local program: no.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:

  SECTION 1.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b), (c), or (d).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
deaths, suspicious deaths, unknown deaths, or criminal deaths, or
when otherwise authorized by the decedent's representative. Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient. This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made. If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient. The information may also be disclosed to another provider of
health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to a person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would violate this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of a provider of health care
or health care service plan may be reviewed by a private or public
body responsible for licensing or accrediting the provider of health
care or health care service plan. However, no patient-identifying
medical information may be removed from the premises except as
expressly permitted or required elsewhere by law, nor shall that
information be further disclosed by the recipient in any way that
would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes. However, no information so disclosed shall be
further disclosed by the recipient in any way that would disclose
the identity of a patient or violate this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a lawsuit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan. Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator in the course of any investigation required or
authorized in a conservatorship proceeding under the
Guardianship-Conservatorship Law as defined in Section 1400 of the
Probate Code, or to a probate court investigator, probation officer,
or domestic relations investigator engaged in determining the need
for an initial guardianship or continuation of an existent
guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant. For the purpose of this paragraph, the terms "tissue bank"
and "tissue" have the same meaning as defined in Section 1635 of the
Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, including, but not limited
to, the voluntary reporting, either directly or indirectly, to the
federal Food and Drug Administration of adverse events related to
drug products or medical device problems.
   (15) Basic information, including the patient's name, city of
residence, age, sex, and general condition, may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would violate this part, including the
unauthorized manipulation of coded or encrypted medical information
that reveals individually identifiable medical information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows: (A) to an entity contracting
with a health care service plan or the health care service plan's
contractors to monitor or administer care of enrollees for a covered
benefit, if the disease management services and care are authorized
by a treating physician, or (B) to a disease management organization,
as defined in Section 1399.900 of the Health and Safety Code, that
complies fully with the physician authorization requirements of
Section 1399.902 of the Health and Safety Code, if the health care
service plan or its contractor provides or has provided a description
of the disease management services to a treating physician or to the
health care service plan's or contractor's network of physicians.
Nothing in this paragraph shall be construed to require physician
authorization for the care or treatment of the adherents of a
well-recognized church or religious denomination who depend solely
upon prayer or spiritual means for healing in the practice of the
religion of that church or denomination.
   (18) The information may be disclosed, as permitted by state and
federal law or regulation, to a local health department for the
purpose of preventing or controlling disease, injury, or disability,
including, but not limited to, the reporting of disease, injury,
vital events, including, but not limited to, birth or death, and the
conduct of public health surveillance, public health investigations,
and public health interventions, as authorized or required by state
or federal law or regulation.
   (19) The information may be disclosed, consistent with applicable
law and standards of ethical conduct, by a psychotherapist, as
defined in Section 1010 of the Evidence Code, if the psychotherapist,
in good faith, believes the disclosure is necessary to prevent or
lessen a serious and imminent threat to the health or safety of a
reasonably foreseeable victim or victims, and the disclosure is made
to a person or persons reasonably able to prevent or lessen the
threat, including the target of the threat.
   (20) The information may be disclosed as described in Section
56.103.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, use for marketing, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient. For purposes of this section, a written
communication mailed to a patient by a pharmacy shall be deemed to be
necessary to provide health care services to the patient and shall
not require prior authorization, if all of the following conditions
are met:
   (1) The written communication encourages the patient to adhere to
the prescribed course of medical treatment as prescribed by a
licensed health care professional and may include information about
that particular pharmaceutical drug as authorized in this section.
   (2) The communication is written in the same language as the
prescription label produced by the pharmacy when the medication was
dispensed.
   (3) The written communication instructs the patient to contact the
prescribing or dispensing health care professional if:
   (A) The patient has questions about the medication.
   (B) The patient is having difficulty adhering to the medication
due to adverse effects, dosing requirements, or other causes.
   (4) The written communication pertains only to the prescribed
course of medical treatment, and does not describe or mention any
other pharmaceutical products. The written communication shall be
limited to the following diseases:
   (A) Diabetes.
   (B) Osteoporosis.
   (C) Asthma.
   (D) Chronic obstructive pulmonary disease.
   (E) Cancer.
   (F) Gastric disorder.
   (G) Hypertension.
   (H) Cardiovascular disease.
   (I) Thyroid disorder.
   (J) Organ transplantation.
   (K) Chronic eye disorder.
   (L) Rheumatoid arthritis and osteoarthritis.
   (M) Renal disorders.
   (N) Parkinson's disease.
   (O) Seizures.
   (P) Multiple sclerosis.
   (Q) Depression.
   (R) Schizophrenia.
   (S) Bipolar disorder.
   (T) Anxiety disorders.
   (U) Attention deficit disorder.
   (5) Further written communication shall not be provided if there
are no refills remaining on the prescribed course of therapy and
there are no doses remaining on the final prescribed refill, or the
pharmacy has been notified by a health care provider that a
prescribed course of therapy has been discontinued or substituted
with a different drug.
   (6) All product-related information in the written communication
shall be consistent with the current federal Food and Drug
Administration (FDA) approved product package insert, and provide
fair and balanced information regarding the product's benefits and
risks in accordance with the FDA requirements and policies.
   (7) A copy of each written communication version shall be
submitted to the FDA Center for Drug Evaluation and Research,
Division of Drug Marketing, Advertising and Communications, prior to
program implementation.
   (8) Evidence-based or consensus-based practice guidelines shall be
the basis of any information that is provided to patients in order
to improve their overall health, prevent clinical exacerbations or
complications, or promote patient self-management strategies.
   (9) All personally identifiable medical information collected,
used, and disclosed pursuant to this subdivision shall be
confidential and shall be used solely to deliver the written
communication to the patient. Access to the information shall be
limited to authorized persons. Any entity that receives the
information pursuant to this subdivision shall comply with existing
requirements, including Sections 56.101 and 1798.84, concerning
confidentiality and security of information. The pharmacy must have a
written agreement with any entity that receives the information. The
written agreement shall require the entity to maintain the
confidentiality of the information it receives from the pharmacy and
prohibit the entity from disclosing or using the information for any
purpose other than to deliver to the patient the written
communication that is the subject of the written agreement.
   (10) If the written communication is paid for, in whole or in
part, by a manufacturer, distributer, or provider of a health care
product or service, the written communication shall disclose whether
the pharmacy receives direct or indirect remuneration, including, but
not limited to, gifts, fees, payments, subsidies, or other economic
benefits from a third party for making the written communication and
shall disclose, in a clear and conspicuous location, the source of
any sponsorship in a typeface no smaller than 14-point type. 

   (11) The communication contains instructions in a typeface no
smaller than 14-point type describing how the patient may opt out of
future communications by, for example, calling a toll-free number or
visiting a Web site, and no further sponsored message is made to the
individual after 30 calendar days from the date the individual makes
the opt out request.  
   (11) A pharmacy offers the patient, at the time the patient picks
up his or her initial prescription, an opportunity to opt out of
receiving a written communication from a pharmacy. If the patient
opts out, then no sponsored message shall be made to the patient. If,
at the time the patient picks up his or her initial prescription,
the patient does not opt out, then the written communication shall
contain instructions in a typeface no smaller than 14-point type
describing how the patient may opt out of future communications by,
for example, calling a toll-free telephone number or visiting an
Internet Web site, and no further sponsored message shall be made to
the patient after 30 calendar days from the date the individual makes
the opt out request. 
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.