BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2013-2014 Regular Session
SB 138 (Hernandez)
As Amended April 8, 2013
Hearing Date: April 16, 2013
Fiscal: Yes
Urgency: No
NR
SUBJECT
Confidentiality of Medical Information
DESCRIPTION
Existing federal law, the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), establishes certain
requirements related to the provision of health insurance and
the privacy protection of identifiable health information. The
Patient Protection and Affordable Care Act (ACA), is a United
States federal statute signed into law by President Obama in
2010. By January 1, 2014, the ACA requires plans and insurers
that offer dependent insurance coverage to make that coverage
available until the adult child reaches the age of 26.
Existing state law, the Confidentiality of Medical Information
Act (CMIA), provides that medical information, as defined, may
not be disclosed by providers of health care, health care
service plans, or contractors without the patient's written
authorization, as specified. This bill would declare the intent
of the Legislature to incorporate HIPAA standards into state law
and to clarify standards for protecting the confidentiality of
medical information in insurance transactions. Specifically,
this bill would prohibit a health plan or insurer from sending
insurance communications related to sensitive services provided
to an insured dependent who is under 26 years of age, unless the
carrier has received authorization to do so. This bill would
prohibit a carrier from sending communications related to
sensitive services for insured dependents over the age of 26 if
he or she has submitted a nondisclosure request, as defined.
This bill would also:
require a health care service plan or insurer to comply
(more)
SB 138 (Hernandez)
Page 2 of ?
with any and all communication requests related to
sensitive services and to comply with nondisclosure or
confidential communication requests for individuals who
claim that the disclosure of health information will
endanger them;
authorize health care providers to make alternative
payment arrangements with insured individuals; and
prohibit a health care service plan or health insurer
from conditioning enrollment or continuing coverage on the
provision of an authorization for insurance communications.
This bill would also define additional terms related to
insurance communications and maintaining confidentiality of
medical information.
BACKGROUND
The Health Insurance Portability and Accountability Act (HIPAA),
enacted in 1996, guarantees privacy protection for individuals
with regards to specific health information (Pub.L. 104-191, 110
Stat. 1936). Generally, protected health information (PHI) is
any information held by a covered entity which concerns health
status, provision of health care, or payment for health care
that can be connected to an individual. HIPAA privacy
regulations require health care providers and organizations to
develop and follow procedures that ensure the confidentiality
and security of PHI when it is transferred, received, handled,
or shared. HIPAA further requires reasonable efforts when
using, disclosing, or requesting PHI, to limit disclosure of
that information to the minimum amount necessary to accomplish
the intended purpose.
California's Confidentiality of Medical Information Act (CMIA)
(Civ. Code Sec. 56 et seq.) allows adult patients in California
to keep PHI confidential and decide whether and when to share
that information with their partners and parents. Adolescent
patients in California also have a right to keep certain health
information confidential and decide whether and when to share
that information with parents, including information about
sexual and reproductive health services, drug treatment, and
most mental health counseling. (Civ. Code Sec. 56.11(c)(1), Fam.
Code Secs. 6924-6929.)
With regards to insurance communications, HIPAA authorizes
insurers and providers to communicate PHI to alternate addresses
SB 138 (Hernandez)
Page 3 of ?
or by alternate means, such as telephone, and are required to
accommodate "reasonable requests" if the "individual clearly
states that the disclosure of all or part of the information
could endanger the individual (45 C.F.R. 164.522(b).) HIPAA
also permits patients to request that insurers or providers
restrict communications, for example, by asking that an
explanation of benefits not be mailed. California does not
further define these rights by statute.
The Patient Protection and Affordable Care Act (ACA), is a
United States federal statute signed into law by President Obama
in 2010 (Public Law 111-14, 124 Stat. 119). Among the goals of
the ACA is to increase the rate of health insurance coverage for
Americans thereby reducing the overall costs of health care. By
January 1, 2014, the ACA requires plans and insurers that offer
dependent insurance coverage to make that coverage available
until the adult child reaches the age of 26. Both married and
unmarried children will qualify for this coverage, even if they
have another offer of coverage through an employer.
A recent study by the Guttmacher Institute described the tension
between the important policies of maintaining appropriate health
plan and health insurer (carrier) communications to ensure
billing and payment transparency, and protecting patient
confidentiality:
Privacy concerns pertaining to health information can be
important for individuals of both genders in a wide range of
life circumstances. Confidentiality issues may arise for
married persons covered under a spouse's health insurance
policy or for couples who are separated or estranged; concerns
may come into play in relation to care obtained by the
children of divorced or separated parents. Similar issues may
arise for same-sex partners whose coverage is held by a
domestic partner. Finally, privacy issues are often seen as a
potentially significant impediment for minors and young adults
seeking care. Confidentiality can be a factor when individuals
are seeking a broad range of health care services. For
example, privacy concerns may be a barrier to individuals
seeking substance abuse treatment or mental health care. Lack
of confidentiality may lead individuals experiencing intimate
partner violence to hesitate in seeking care for fear their
abuser may be alerted?
Despite the widespread recognition of the importance of
maintaining patient confidentiality, billing and insurance
SB 138 (Hernandez)
Page 4 of ?
claims-processing procedures widely used in private health
insurance today-most notably the practice of sending
explanation of benefits forms (EOBs) to a policyholder
whenever care is provided under his or her policy- routinely
violate confidentiality for anyone, often a minor or a young
adult, insured as a dependent on someone else's
policy?Obviously, when the patient is the policyholder, no
issue arises from this disclosure. However, when the patient
is insured as a dependent on someone else's policy-such as
that of a parent, spouse or domestic partner-disclosure of
protected health information is possible, with potentially
serious consequences. (Guttmacher Institutes, Confidentiality
for Individuals Insured as Dependents: A Review of State Laws
and Policies, (July 2012) pp. 3-4.)
This bill would define and clarify terms related to insurance
communications and prohibit a carrier from sending insurance
communications related to sensitive services unless the carrier
has received an authorization from the insured individual who is
under 26 years of age and insured as a dependent on another
person's insurance policy. This bill would also prohibit a
carrier from sending communications related to sensitive
services for insured dependents over the age of 26 if he or she
has submitted a nondisclosure request. Finally, among other
provisions, this bill would require carriers to comply with
confidential communications requests and nondisclosure requests,
as specified, and authorize health care providers to make
arrangements with insured individuals for cost sharing and
communicate that arrangement with the carrier.
CHANGES TO EXISTING LAW
Existing law , the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. Art. I, Sec. 1.)
Existing federal law , the Health Insurance Portability and
Accountability Act (HIPAA), specifies privacy protections for
patients' protected health information and generally provides
that a covered entity, as defined (health plan, health care
provider, and health care clearing house), may not use or
disclose protected health information except as specified or as
authorized by the patient in writing. (45 C.F.R. Sec. 164.500
SB 138 (Hernandez)
Page 5 of ?
et seq.)
Existing law prohibits, under the State Confidentiality of
Medical Information Act (CMIA), providers of health care, health
care service plans, or contractors, as defined, from sharing
medical information without the patient's written authorization,
subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
Existing federal law the Patient Protection and Affordable Care
Act (ACA) authorizes certain individuals, including adult
children under the age of 26, to be insured as dependents on a
health insurance policy held in another person's name, as
specified. (Pub. Law 111-148, 124 Stat. 119.)
Existing law defines "medical information" to mean any
individually identifiable information, in electronic or physical
form, in possession of or derived from a provider of health
care, health care service plan, pharmaceutical company, or
contractor regarding a patient's medical history, mental or
physical condition, or treatment. Existing law defines
"individually identifiable" to mean that the medical information
includes or contains any element of personal identifying
information sufficient to allow identification of the
individual, such as the patient's name, address, electronic mail
address, telephone number, or social security number, or other
information that, alone or in combination with other publicly
available information, reveals the individual's identity. (Civ.
Code Sec. 56.05(g).)
Existing law authorizes minors, 12 years of age and older, to
consent to specified health care and determine whether to keep
it private, including sexual and reproductive health services,
drug treatment, and mental health treatment or counseling
services if, in the opinion of the attending professional
person, the minor is mature enough to participate intelligently
in the mental health treatment or counseling services. (Health
& Saf. Code Secs. 123115, 124260; Civ. Code Sec. 56.11(c)(1);
Fam. Code Secs. 6924-6929.)
Existing law provides that a plaintiff may bring an action
against any person or entity who has negligently released his or
her confidential information or records in violation of the CMIA
as follows:
nominal damages of $1,000; and
the amount of actual damages. (Civ. Code Sec. 56.36(b).)
SB 138 (Hernandez)
Page 6 of ?
This bill would prohibit a health care service plan or health
insurer from sending insurance communications related to
sensitive services for an insured individual who is under 26
years of age and insured as a dependent, unless the plan or
insurer has received an authorization for insurance
communications.
This bill would prohibit a health care service plan or health
insurer from sending insurance communications related to
sensitive services for insured individuals over the age of 26
who have submitted a nondisclosure request.
This bill would require a health care service plan or health
insurer comply with a confidential communications request
regarding sensitive services from an insured individual.
This bill would require a health insurer to comply with a
nondisclosure request or confidential communications request
from an insured individual who states that disclosure of the
health information will endanger the individual, and would not
allow the health insurer to require an explanation as to the
basis for the endangerment.
This bill would authorize health care providers to make
arrangements with insured individuals for the payment of benefit
cost sharing and communicate that arrangement with the health
care service plan or health insurer.
This bill would prohibit a health insurer from conditioning
enrollment or coverage in the health plan or health insurance
policy or eligibility on the authorization for insurance
communications.
This bill would define the following terms:
"sensitive services" means prevention, counseling, diagnosis,
and treatment related to sexual and reproductive health,
including HIV/AIDS, substance use, and mental health.
"authorization for insurance communications" means permission
from the individual, as specified, that specifies the medical
information and insurance transactions that may be disclosed
and the identity of the people to whom disclosures are
permitted, as part of an insurance communication.
"confidential communications request" means a request by an
insured individual that insurance communications be
communicated by a specific method, or to a specific mail,
SB 138 (Hernandez)
Page 7 of ?
email address, or telephone number, as designated by the
insured individual.
"endanger" to mean that the insured individual fears
harassment or abuse resulting from an insurance communication
sufficient to deter the patient from obtaining health care
absent confidentiality.
"insured individual" means a person entitled to coverage under
a health care service plan or other health plan carrier
including the policy holder and dependents.
"insurance communication" means any communication from the
health care service plan or other health plan carrier to
policy holders or insured individuals that discloses
individually identifiable medical information including, but
not limited to, explanation of benefits forms, scheduling
information, notices of denial, and notices of contested
claims.
"nondisclosure request" means a written request to withhold
insurance communications regarding specified medical
information or other information that should not be disclosed,
the identity of the person(s) from whom the information shall
be withheld, and contact information for the individual for
additional information or clarification necessary to satisfy
the request.
COMMENT
1.Stated need for the bill
According to the author:
Expansion of health insurance coverage to millions of
Californians under the Affordable Care Act (ACA) will
exacerbate an existing conflict between two important
policies: maintaining appropriate health plan and insurer
communications with a policy holder to ensure billing and
payment transparency versus protecting patient confidentiality
for insured dependents accessing sensitive services like
sexual and reproductive health care, mental health services
and drug and alcohol abuse treatment. The ACA will
dramatically expand the number of individuals insured as
dependents on a health insurance policy held in another
person's name. Dependents covered by a family member's
insurance policy are often young people (under the ACA, health
plans and insurers are required to offer dependent coverage
for children up to age 26) or spouses of the policy holder who
may not feel safe revealing that they have received sensitive
SB 138 (Hernandez)
Page 8 of ?
health care services.
2.Prohibits disclosure in insurance communications of sensitive
services for insured dependents under the age of 26
This bill would prohibit a health plan or insurer (carrier) from
sending insurance communications related to sensitive services
for an insured individual who is under 26 years of age and
insured as a dependent on another person's insurance policy,
unless the carrier has received authorization from the insured.
This bill would define sensitive services as prevention,
counseling, diagnosis, and treatment related to sexual and
reproductive health, including HIV/AIDS, substance use, and
mental health. Insurance communications would be defined as any
communication from the carrier to policy holders or insured
individuals that discloses individually identifiable medical
information including, but not limited to, explanation of
benefits forms, scheduling information, notices of denial, and
notices of contested claims.
In support of this bill, the National Health Law Program writes:
Individuals covered by a family member's insurance plan are
often young people and current or former spouses or partners
who may not feel safe having their personal and sensitive
health information shared with the policy holder through
Explanation of Benefits letters (EOBs) and other methods of
communication.
As a result, we know from research that some minors and adults
choose not to seek care for sensitive services such as STDs,
birth control, drug treatment and mental health services for
fear a parent or partner will find out.
The American Congress of Obstetricians and Gynecologists
(ACOG-IX), also in support of this bill, argue that increased
confidentiality protections may help reduce STDs. "ACOG-IX
recently surveyed our membership as part of efforts to reduce
Chlamydia infections. 53% of responding physicians strongly
agreed that a barrier to screening was the concern of patients
that billing statements could be sent and seen by household
members or policy holder. Chlamydia screening is essential as
it is the number one sexually transmitted disease in the United
States. Left untreated, Chlamydia can cause serious health
SB 138 (Hernandez)
Page 9 of ?
problems, including sterility. It can even be passed from a
woman to an infant during delivery. This is but one example of
harm."
Accordingly, by ensuring confidentiality, this bill may
encourage early and safe treatment related to sensitive services
that some insured dependents under the age of 26 might otherwise
forgo for fear of being discovered by a policy holder who is a
parent, spouse, or partner.
a. Authorization for insurance communications and
confidential communications requests
This bill would permit insured dependents to provide an
"authorization for insurance communications," thereby
authorizing the release of specified personal health
information (PHI) to a designated recipient(s). This has been
referred to as an "opt-in" provision by some stakeholders. The
Association of California Life & Health Insurance Companies,
while expressing appreciation for the intent of the bill,
raises concerns in their opposition letter regarding the
"opt-in" process for insured dependents under the age of 26.
[T]he bill gives no indication how the opt-in process would
work nor does it suggest how insurers would comply when
they have little contact with anyone other than the primary
policy holder. ? [W]e are concerned that insureds will not
be receiving important information such as: explanation of
benefits forms, scheduling information, notices of denial,
as well as notices of contested claims (which are critical
to ensuring that a patient fully understands the services
they have received), the appeal rights they may have if a
claim has been denied, and the potential financial
liability that exists related to the services they have
received.
SB 138, however, appears to give clear instruction regarding
how the "opt-in" process would work. Absent a signed
"authorization for insurance communications," carriers would
be prohibited from sending insurance communications to any
person, including a policy holder or the insured, related to
sensitive services for dependents under the age of 26.
Insureds who elect to submit an "authorization for insurance
communications" would be required to designate what specific
information is shared, and with whom. This bill would also
permit insured dependents to submit a "confidential
SB 138 (Hernandez)
Page 10 of ?
communications request" which would further instruct the
carrier in the event that the insured wishes to receive
insurance communications by a specific method, such as
telephone, email, or otherwise.
The author explains how the concern that insured dependents
would not receive important health information is similarly
mitigated. "Current federal law, HIPAA, allows for patients to
provide an alternative address for these types of
correspondence. Health plans should already have existing
systems in place to comply. SB 138 simply seeks to codify this
into California law and clarify related definitions. Our bill
also clarifies that providers can make arrangements directly
with the patient for payment."
Also in opposition, the California Association of Health Plans
writes that the "opt-in process would require plans to invest
a considerable amount of time and resources toward upgrading
all their IT systems in order to fully comply with this bill."
This argument is unpersuasive because an authorization for
insurance communications under this bill would appear to
require substantially similar information that a carrier must
receive and process when disclosing PHI to specified
individuals under existing law. (Civ. Code Sec.
56.11(a)-(c).) In addition, the opposition raises no concerns
regarding compliance with nondisclosure requests (see Comment
3) which are nearly identical in substance and treatment as
authorizations for insurance communications.
Thus, not only does SB 138 provide explicit guidance regarding
how insured dependents under the age of 26 may "opt-in" and
thereby receive insurance communications, carriers comply with
substantially similar requests under existing law.
1.Nondisclosure request
This bill would prohibit disclosure in insurance communications
related to sensitive services for insured dependents over the
age of 26 when he or she has submitted a nondisclosure request.
This bill would define nondisclosure request as a written
request to withhold insurance communications regarding specified
medical information, the identity of the person(s) from whom the
information shall be withheld, and the contact information for
the insured individual in the event that additional information
or clarification is necessary to satisfy the request.
SB 138 (Hernandez)
Page 11 of ?
In support of this bill, the California Partnership to End
Domestic Violence argues that, "privacy and confidentiality are
vital components of a survivor's safety. ?Individuals covered by
a family member's insurance plan are often children, spouses, or
domestic partners and may not feel safe or comfortable having
their personal and sensitive health information shared with the
plan holder. Breaches in patient confidentiality often occur
through Explanation of Benefits letters and other methods of
communication generated by health plans and insurers."
To that end, this bill would allow individuals such as spouses
or domestic partners to confidently access health care for
intensely personal and private issues such as mental health
counseling, drug or alcohol rehabilitation, or reproductive
issues, without fear of disclosure to the policy holder.
2.Cost sharing
This bill would authorize health care providers to make cost
sharing arrangements with an insured individual and communicate
that arrangement with the carrier. This provision would further
help ensure confidentiality for services where the carrier does
not fully cover the cost. A practitioner and insured individual
may agree to have the insured pay for the uncovered portion of
services up front, or for the insured to be privately billed
after the fact. They may also discuss how the insured will
cover costs in the event that a claim is denied in full or in
part. Thus, this bill provides insured dependents and
practitioners with an opportunity to work together and satisfy
financial obligations without risking a breach of
confidentiality.
3.Individuals who fear harassment or abuse
This bill would require a carrier to comply with any
nondisclosure request or confidential request from an insured
individual who states that disclosure of specified health
information would endanger the individual, and would prohibit
the carrier from requiring an explanation as to the basis for
the statement. This bill would also define "endanger" to mean
that the insured individual fears harassment or abuse resulting
from an insurance communication sufficient to deter the patient
from obtaining health care absent confidentiality.
Significantly, this provision offers the protection of
confidentiality for health care services which fall outside the
SB 138 (Hernandez)
Page 12 of ?
scope of "sensitive services" for all insured individuals who
fear a negative backlash if the policy holder or another person
were to discover that particular services had been rendered.
Family and relationship dynamics are unique to each particular
situation. While "sensitive services" are predictably services
that an insured individual may wish to keep private, it is
impossible to predict the multitude of circumstances for which
an individual may wish to keep other medical information
private. To that end, this provision enables all insured
individuals to protect the confidentiality of their medical
information in the event that his or her unique situation is not
covered explicitly by statute.
4.Prohibition against conditioning enrollment or coverage on
provision of authorization for insurance communications
This bill would prohibit a carrier from conditioning enrollment,
coverage, or eligibility for benefits on an insured dependent's
choice to authorize insurance communications, or "opt-in" (see
Comment 2(a)). This is significant as the ACA (see Background)
mandates that all carriers that offer dependent insurance
coverage make that coverage available until an adult child
reaches the age of 26. Both married and unmarried children will
qualify for this coverage, even if they have another offer of
coverage through an employer. A parent and live-in child
relationship is distinct from a parent and child relationship
where the child is married and lives with his or her spouse
independently. Both of the previously mentioned situations are
distinct from a domestic partnership or marriage.
Arguably, the individuals in each of these relationships should
be able to choose with whom their health information is shared.
Thus, under the provisions of this bill, policy holders and
insured dependents under the age of 26 will be able to make
decisions about what health information they want shared, and
how it should be communicated, regardless of whether a carrier
prefers a uniform approach.
Support : ACCESS Women's Health Justice; American Association of
University Women; American Civil Liberties Union; American
Congress of Obstetricians and Gynecologists, District IX
(California); California Adolescent Health Collaborative;
California Association of Marriage and Family Therapists;
California Family Health Council; California National
Organization for Women; California Partnership to End Domestic
SB 138 (Hernandez)
Page 13 of ?
Violence; California Primary Care Association; Center on
Reproductive Rights and Justice at UC Berkeley School of Law;
Citizens for Choice; Community Clinic Association of Los
Angeles; Los Angeles Trust for Children's Health; National
Center for Youth Law; National Council of Jewish Women; National
Health Law Program; Physicians for Reproductive Health; Planned
Parenthood Affiliates of California; Privacy Rights
Clearinghouse; Women's Community Clinic
Opposition : Association of California Life & Health Insurance
Companies; California Association of Health Plans
HISTORY
Source : California Family Health Council
Related Pending Legislation : None Known
Prior Legislation : None Known
Prior Vote : Senate Health Committee (Ayes 7, Noes 2)
**************