BILL ANALYSIS �
AB 1428
Page 1
CONCURRENCE IN SENATE AMENDMENTS
AB 1428 (Conway)
As Amended August 27, 2013
2/3 vote. Urgency
-----------------------------------------------------------------
|ASSEMBLY: |77-0 |(August 8, |SENATE: |37-0 |(September 3, |
| | |2013) | | |2013) |
-----------------------------------------------------------------
Original Committee Reference: HEALTH
SUMMARY : Revises provisions that require the California Health
Benefit Exchange (Exchange), known as Covered California, to
require all employees, prospective employees, contractors,
subcontractors, and vendors who facilitate enrollment in the
Exchange and have access to the financial or medical information
of enrollees or potential enrollees of the Exchange to be
fingerprinted for the purpose of obtaining criminal history
information by inserting a reference to Minimum Risk Standards
for Exchanges (MARS-E), a specific federal document relating to
health exchange privacy and security. Contains an urgency
clause in order to become effective immediately upon enactment.
The Senate amendments are technical and clarifying.
FISCAL EFFECT : According to the Senate Appropriations
Committee, pursuant to Senate Rule 28.8, negligible state costs.
COMMENTS : This bill is intended as a companion measure to SB
509 (DeSaulnier), Chapter 10, Statutes of 2013. SB 509 was
chaptered on June 17, 2013, as an urgency statute in order for
Covered California to begin hiring call center employees. As SB
509 moved through the legislative process, its provisions did
not mention the MARS-E but instead referenced "federal guidance
applicable to state-based exchanges." Covered California's
board determined compliance with the MARS-E was important but
because SB 509's proponents did not want to delay call center
hiring, SB 509 moved forward with an agreement that clarifying
language, including specific reference to the MARS-E, would
follow in this bill.
The author states that the Exchange will hire over 20,000
individuals to promote the Exchange and enroll the public. The
author states that it is estimated that the Assisters and
AB 1428
Page 2
Navigators will guide over four million Californians to enroll
in the new state Exchange. The author further states that these
Assisters and Navigators will have access to millions of
enrollees' most sensitive personal identifying information (PII)
including: home addresses; Social Security Numbers (SSNs);
state and federal tax information (FTI); and personal health
information (PHI). According to the author, federal privacy and
security guidelines require state Exchanges to perform
fingerprint-based criminal background checks prior to hiring any
person whose position will have access to personal information
for applicants and enrollees. The author points out that the
guidance also requires periodic rescreening of employees with
access to this information.
Verification of eligibility will require that many Covered
California employees, prospective employees, contractors,
subcontractors, volunteers, and vendors have access to applicant
or enrollee PII, PHI, and/or FTI. For example, Covered
California will request tax return data regarding Modified
Adjusted Gross Income and family size from the federal
Department of Health and Human Services (DHHS) through a data
hub if they have a SSN or Taxpayer Identification Number and
will use it to verify information provided by the applicant.
Federal guidance requires that Covered California protect and
safeguard customers from unauthorized and illegal access to or
disclosure of this information.
Based on federal guidance, Covered California has determined the
Exchange must meet MARS-E, one of three on Exchange privacy and
security standards. According to documents provided by Covered
California, the MARS-E requires all individuals associated with
the Exchange who would have access to sensitive information such
as PII, PHI, and FTI to be screened before they may be
authorized to obtain access to the information system and
devices containing such information. To meet these
requirements, Covered California must perform a background check
for all persons prior to authorizing access and require
appropriate personnel to obtain and hold a moderate-risk
security clearance as defined in the federal DHHS Personnel
Security/Suitability Handbook. The MARS-E also requires
periodic rescreening of individuals, consistent with the
criticality or sensitivity rating of the position. Furthermore,
according to Covered California, the Internal Revenue Service
Security Guidelines require screening and consideration of an
individual's background and security clearance when designating
AB 1428
Page 3
personnel who are authorized to access FTI.
Covered California is in the process of establishing an
Assisters Program that will include assister enrollment entities
(AEE) and individual entities. AEEs are entities and
organizations eligible to be trained and registered to provide
in-person assistance to consumers and help them apply for
Covered California programs, particularly entities that have
access to Covered California's targeted population. Individual
AEEs are individuals who are employed, trained, certified, and
linked to AEEs to provide in-person assistance to consumers and
help them apply for Covered California programs and are
individuals who can provide assistance in a culturally and
linguistically appropriate manner to consumers.
Analysis Prepared by : Marjorie Swartz / HEALTH / (916)
319-2097
FN: 0002261