BILL ANALYSIS                                                                                                                                                                                                    






                             SENATE JUDICIARY COMMITTEE
                             Senator Noreen Evans, Chair
                              2013-2014 Regular Session


          SB 138 (Hernandez)
          As Amended April 8, 2013
          Hearing Date: April 16, 2013
          Fiscal: Yes
          Urgency: No
          NR
                    

                                        SUBJECT
                                           
                       Confidentiality of Medical Information

                                      DESCRIPTION  

          Existing federal law, the Health Insurance Portability and  
          Accountability Act of 1996 (HIPAA), establishes certain  
          requirements related to the provision of health insurance and  
          the privacy protection of identifiable health information. The  
          Patient Protection and Affordable Care Act (ACA), is a United  
          States federal statute signed into law by President Obama in  
          2010.  By January 1, 2014, the ACA requires plans and insurers  
          that offer dependent insurance coverage to make that coverage  
          available until the adult child reaches the age of 26.  

          Existing state law, the Confidentiality of Medical Information  
          Act (CMIA), provides that medical information, as defined, may  
          not be disclosed by providers of health care, health care  
          service plans, or contractors without the patient's written  
          authorization, as specified.  This bill would declare the intent  
          of the Legislature to incorporate HIPAA standards into state law  
          and to clarify standards for protecting the confidentiality of  
          medical information in insurance transactions. Specifically,  
          this bill would prohibit a health plan or insurer from sending  
          insurance communications related to sensitive services provided  
          to an insured dependent who is under 26 years of age, unless the  
          carrier has received authorization to do so.  This bill would  
          prohibit a carrier from sending communications related to  
          sensitive services for insured dependents over the age of 26 if  
          he or she has submitted a nondisclosure request, as defined.   
          This bill would also:
                 require a health care service plan or insurer to comply  
                                                                (more)



          SB 138 (Hernandez)
          Page 2 of ?



               with any and all communication requests related to  
               sensitive services and to comply with nondisclosure or  
               confidential communication requests for individuals who  
               claim that the disclosure of health information will  
               endanger them; 
                 authorize health care providers to make alternative  
               payment arrangements with insured individuals; and 
                 prohibit a health care service plan or health insurer  
               from conditioning enrollment or continuing coverage on the  
               provision of an authorization for insurance communications.  


          This bill would also define additional terms related to  
          insurance communications and maintaining confidentiality of  
          medical information. 

                                      BACKGROUND  

          The Health Insurance Portability and Accountability Act (HIPAA),  
          enacted in 1996, guarantees privacy protection for individuals  
          with regards to specific health information (Pub.L. 104-191, 110  
          Stat. 1936).  Generally, protected health information (PHI) is  
          any information held by a covered entity which concerns health  
          status, provision of health care, or payment for health care  
          that can be connected to an individual. HIPAA privacy  
          regulations require health care providers and organizations to  
          develop and follow procedures that ensure the confidentiality  
          and security of PHI when it is transferred, received, handled,  
          or shared.  HIPAA further requires reasonable efforts when  
          using, disclosing, or requesting PHI, to limit disclosure of  
          that information to the minimum amount necessary to accomplish  
          the intended purpose.  

          California's Confidentiality of Medical Information Act (CMIA)  
          (Civ. Code Sec. 56 et seq.) allows adult patients in California  
          to keep PHI confidential and decide whether and when to share  
          that information with their partners and parents.  Adolescent  
          patients in California also have a right to keep certain health  
          information confidential and decide whether and when to share  
          that information with parents, including information about  
          sexual and reproductive health services, drug treatment, and  
          most mental health counseling. (Civ. Code Sec. 56.11(c)(1), Fam.  
          Code Secs. 6924-6929.)

          With regards to insurance communications, HIPAA authorizes  
          insurers and providers to communicate PHI to alternate addresses  
                                                                      



          SB 138 (Hernandez)
          Page 3 of ?



          or by alternate means, such as telephone, and are required to  
          accommodate "reasonable requests" if the "individual clearly  
          states that the disclosure of all or part of the information  
          could endanger the individual (45 C.F.R.  164.522(b).)  HIPAA  
          also permits patients to request that insurers or providers  
          restrict communications, for example, by asking that an  
          explanation of benefits not be mailed.  California does not  
          further define these rights by statute.

          The Patient Protection and Affordable Care Act (ACA), is a  
          United States federal statute signed into law by President Obama  
          in 2010 (Public Law 111-14, 124 Stat. 119). Among the goals of  
          the ACA is to increase the rate of health insurance coverage for  
          Americans thereby reducing the overall costs of health care. By  
          January 1, 2014, the ACA requires plans and insurers that offer  
          dependent insurance coverage to make that coverage available  
          until the adult child reaches the age of 26.  Both married and  
          unmarried children will qualify for this coverage, even if they  
          have another offer of coverage through an employer.

          A recent study by the Guttmacher Institute described the tension  
          between the important policies of maintaining appropriate health  
          plan and health insurer (carrier) communications to ensure  
          billing and payment transparency, and protecting patient  
          confidentiality: 

            Privacy concerns pertaining to health information can be  
            important for individuals of both genders in a wide range of  
            life circumstances. Confidentiality issues may arise for  
            married persons covered under a spouse's health insurance  
            policy or for couples who are separated or estranged; concerns  
            may come into play in relation to care obtained by the  
            children of divorced or separated parents. Similar issues may  
            arise for same-sex partners whose coverage is held by a  
            domestic partner. Finally, privacy issues are often seen as a  
            potentially significant impediment for minors and young adults  
            seeking care. Confidentiality can be a factor when individuals  
            are seeking a broad range of health care services. For  
            example, privacy concerns may be a barrier to individuals  
            seeking substance abuse treatment or mental health care. Lack  
            of confidentiality may lead individuals experiencing intimate  
            partner violence to hesitate in seeking care for fear their  
            abuser may be alerted?

            Despite the widespread recognition of the importance of  
            maintaining patient confidentiality, billing and insurance  
                                                                      



          SB 138 (Hernandez)
          Page 4 of ?



            claims-processing procedures widely used in private health  
            insurance today-most notably the practice of sending  
            explanation of benefits forms (EOBs) to a policyholder  
            whenever care is provided under his or her policy- routinely  
            violate confidentiality for anyone, often a minor or a young  
            adult, insured as a dependent on someone else's  
            policy?Obviously, when the patient is the policyholder, no  
            issue arises from this disclosure. However, when the patient  
            is insured as a dependent on someone else's policy-such as  
            that of a parent, spouse or domestic partner-disclosure of  
            protected health information is possible, with potentially  
            serious consequences. (Guttmacher Institutes, Confidentiality  
            for Individuals Insured as Dependents: A Review of State Laws  
            and Policies, (July 2012) pp. 3-4.) 

          This bill would define and clarify terms related to insurance  
          communications and prohibit a carrier from sending insurance  
          communications related to sensitive services unless the carrier  
          has received an authorization from the insured individual who is  
          under 26 years of age and insured as a dependent on another  
          person's insurance policy. This bill would also prohibit a  
          carrier from sending communications related to sensitive  
          services for insured dependents over the age of 26 if he or she  
          has submitted a nondisclosure request.  Finally, among other  
          provisions, this bill would require carriers to comply with  
          confidential communications requests and nondisclosure requests,  
          as specified, and authorize health care providers to make  
          arrangements with insured individuals for cost sharing and  
          communicate that arrangement with the carrier. 

                                           


                               CHANGES TO EXISTING LAW
           
           Existing law  , the California Constitution, provides that all  
          people have inalienable rights, including the right to pursue  
          and obtain privacy.  (Cal. Const. Art. I, Sec. 1.)
           
          Existing federal law  , the Health Insurance Portability and  
          Accountability Act (HIPAA), specifies privacy protections for  
          patients' protected health information and generally provides  
          that a covered entity, as defined (health plan, health care  
          provider, and health care clearing house), may not use or  
          disclose protected health information except as specified or as  
          authorized by the patient in writing.  (45 C.F.R. Sec. 164.500  
                                                                      



          SB 138 (Hernandez)
          Page 5 of ?



          et seq.)  

           Existing law  prohibits, under the State Confidentiality of  
          Medical Information Act (CMIA), providers of health care, health  
          care service plans, or contractors, as defined, from sharing  
          medical information without the patient's written authorization,  
          subject to certain exceptions.  (Civ. Code Sec. 56 et seq.) 
           
          Existing federal law  the Patient Protection and Affordable Care  
          Act (ACA) authorizes certain individuals, including adult  
          children under the age of 26, to be insured as dependents on a  
          health insurance policy held in another person's name, as  
          specified.  (Pub. Law 111-148, 124 Stat. 119.) 
           
          Existing law  defines "medical information" to mean any  
          individually identifiable information, in electronic or physical  
          form, in possession of or derived from a provider of health  
          care, health care service plan, pharmaceutical company, or  
          contractor regarding a patient's medical history, mental or  
          physical condition, or treatment.  Existing law defines  
          "individually identifiable" to mean that the medical information  
          includes or contains any element of personal identifying  
          information sufficient to allow identification of the  
          individual, such as the patient's name, address, electronic mail  
          address, telephone number, or social security number, or other  
          information that, alone or in combination with other publicly  
          available information, reveals the individual's identity.  (Civ.  
          Code Sec. 56.05(g).)

           Existing law  authorizes minors, 12 years of age and older, to  
          consent to specified health care and determine whether to keep  
          it private, including sexual and reproductive health services,  
          drug treatment, and mental health treatment or counseling  
          services if, in the opinion of the attending professional  
          person, the minor is mature enough to participate intelligently  
          in the mental health treatment or counseling services.  (Health  
          & Saf. Code Secs. 123115, 124260; Civ. Code Sec. 56.11(c)(1);  
          Fam. Code Secs. 6924-6929.)
          
           Existing law  provides that a plaintiff may bring an action  
          against any person or entity who has negligently released his or  
          her confidential information or records in violation of the CMIA  
          as follows:
           nominal damages of $1,000; and 
           the amount of actual damages.  (Civ. Code Sec. 56.36(b).)

                                                                      



          SB 138 (Hernandez)
          Page 6 of ?




           This bill  would prohibit a health care service plan or health  
          insurer from sending insurance communications related to  
          sensitive services for an insured individual who is under 26  
          years of age and insured as a dependent, unless the plan or  
          insurer has received an authorization for insurance  
          communications. 

           This bill  would prohibit a health care service plan or health  
          insurer from sending insurance communications related to  
          sensitive services for insured individuals over the age of 26  
          who have submitted a nondisclosure request. 

           This bill  would require a health care service plan or health  
          insurer comply with a confidential communications request  
          regarding sensitive services from an insured individual. 

           This bill  would require a health insurer to comply with a  
          nondisclosure request or confidential communications request  
          from an insured individual who states that disclosure of the  
          health information will endanger the individual, and would not  
          allow the health insurer to require an explanation as to the  
          basis for the endangerment. 

           This bill  would authorize health care providers to make  
          arrangements with insured individuals for the payment of benefit  
          cost sharing and communicate that arrangement with the health  
          care service plan or health insurer. 

           This bill  would prohibit a health insurer from conditioning  
          enrollment or coverage in the health plan or health insurance  
          policy or eligibility on the authorization for insurance  
          communications. 

           This bill  would define the following terms: 
           "sensitive services" means prevention, counseling, diagnosis,  
            and treatment related to sexual and reproductive health,  
            including HIV/AIDS, substance use, and mental health. 
           "authorization for insurance communications" means permission  
            from the individual, as specified, that specifies the medical  
            information and insurance transactions that may be disclosed  
            and the identity of the people to whom disclosures are  
            permitted, as part of an insurance communication. 
           "confidential communications request" means a request by an  
            insured individual that insurance communications be  
            communicated by a specific method, or to a specific mail,  
                                                                      



          SB 138 (Hernandez)
          Page 7 of ?



            email address, or telephone number, as designated by the  
            insured individual. 
           "endanger" to mean that the insured individual fears  
            harassment or abuse resulting from an insurance communication  
            sufficient to deter the patient from obtaining health care  
            absent confidentiality. 
           "insured individual" means a person entitled to coverage under  
            a health care service plan or other health plan carrier  
            including the policy holder and dependents.
           "insurance communication" means any communication from the  
            health care service plan or other health plan carrier to  
            policy holders or insured individuals that discloses  
            individually identifiable medical information including, but  
            not limited to, explanation of benefits forms, scheduling  
            information, notices of denial, and notices of contested  
            claims. 
           "nondisclosure request" means a written request to withhold  
            insurance communications regarding specified medical  
            information or other information that should not be disclosed,  
            the identity of the person(s) from whom the information shall  
            be withheld, and contact information for the individual for  
            additional information or clarification necessary to satisfy  
            the request. 

                                        COMMENT
           
           1.Stated need for the bill
           
          According to the author:

            Expansion of health insurance coverage to millions of  
            Californians under the Affordable Care Act (ACA) will  
            exacerbate an existing conflict between two important  
            policies: maintaining appropriate health plan and insurer  
            communications with a policy holder to ensure billing and  
            payment transparency versus protecting patient confidentiality  
            for insured dependents accessing sensitive services like  
            sexual and reproductive health care, mental health services  
            and drug and alcohol abuse treatment.  The ACA will  
            dramatically expand the number of individuals insured as  
            dependents on a health insurance policy held in another  
            person's name.  Dependents covered by a family member's  
            insurance policy are often young people (under the ACA, health  
            plans and insurers are required to offer dependent coverage  
            for children up to age 26) or spouses of the policy holder who  
            may not feel safe revealing that they have received sensitive  
                                                                      



          SB 138 (Hernandez)
          Page 8 of ?



            health care services.   

           2.Prohibits disclosure in insurance communications of sensitive  
            services for insured dependents under the age of 26
           
          This bill would prohibit a health plan or insurer (carrier) from  
          sending insurance communications related to sensitive services  
          for an insured individual who is under 26 years of age and  
          insured as a dependent on another person's insurance policy,  
          unless the carrier has received authorization from the insured.   


          This bill would define sensitive services as prevention,  
          counseling, diagnosis, and treatment related to sexual and  
          reproductive health, including HIV/AIDS, substance use, and  
          mental health.  Insurance communications would be defined as any  
          communication from the carrier to policy holders or insured  
          individuals that discloses individually identifiable medical  
          information including, but not limited to, explanation of  
          benefits forms, scheduling information, notices of denial, and  
          notices of contested claims. 
          In support of this bill, the National Health Law Program writes:  


            Individuals covered by a family member's insurance plan are  
            often young people and current or former spouses or partners  
            who may not feel safe having their personal and sensitive  
            health information shared with the policy holder through  
            Explanation of Benefits letters (EOBs) and other methods of  
            communication. 

            As a result, we know from research that some minors and adults  
            choose not to seek care for sensitive services such as STDs,  
            birth control, drug treatment and mental health services for  
            fear a parent or partner will find out. 

          The American Congress of Obstetricians and Gynecologists  
          (ACOG-IX), also in support of this bill, argue that increased  
          confidentiality protections may help reduce STDs. "ACOG-IX  
          recently surveyed our membership as part of efforts to reduce  
          Chlamydia infections.  53% of responding physicians strongly  
          agreed that a barrier to screening was the concern of patients  
          that billing statements could be sent and seen by household  
          members or policy holder.  Chlamydia screening is essential as  
          it is the number one sexually transmitted disease in the United  
          States.  Left untreated, Chlamydia can cause serious health  
                                                                      



          SB 138 (Hernandez)
          Page 9 of ?



          problems, including sterility.  It can even be passed from a  
          woman to an infant during delivery.  This is but one example of  
          harm." 

          Accordingly, by ensuring confidentiality, this bill may  
          encourage early and safe treatment related to sensitive services  
          that some insured dependents under the age of 26 might otherwise  
          forgo for fear of being discovered by a policy holder who is a  
          parent, spouse, or partner. 

              a.   Authorization for insurance communications and  
               confidential communications requests

             This bill would permit insured dependents to provide an  
            "authorization for insurance communications," thereby  
            authorizing the release of specified personal health  
            information (PHI) to a designated recipient(s).  This has been  
            referred to as an "opt-in" provision by some stakeholders. The  
            Association of California Life & Health Insurance Companies,  
            while expressing appreciation for the intent of the bill,  
            raises concerns in their opposition letter regarding the  
            "opt-in" process for insured dependents under the age of 26.  

               [T]he bill gives no indication how the opt-in process would  
               work nor does it suggest how insurers would comply when  
               they have little contact with anyone other than the primary  
               policy holder.  ? [W]e are concerned that insureds will not  
               be receiving important information such as: explanation of  
               benefits forms, scheduling information, notices of denial,  
               as well as notices of contested claims (which are critical  
               to ensuring that a patient fully understands the services  
               they have received), the appeal rights they may have if a  
               claim has been denied, and the potential financial  
               liability that exists related to the services they have  
               received. 

            SB 138, however, appears to give clear instruction regarding  
            how the "opt-in" process would work.  Absent a signed  
            "authorization for insurance communications," carriers would  
            be prohibited from sending insurance communications to any  
            person, including a policy holder or the insured, related to  
            sensitive services for dependents under the age of 26.   
            Insureds who elect to submit an "authorization for insurance  
            communications" would be required to designate what specific  
            information is shared, and with whom.  This bill would also  
            permit insured dependents to submit a "confidential  
                                                                      



          SB 138 (Hernandez)
          Page 10 of ?



            communications request" which would further instruct the  
            carrier in the event that the insured wishes to receive  
            insurance communications by a specific method, such as  
            telephone, email, or otherwise. 

            The author explains how the concern that insured dependents  
            would not receive important health information is similarly  
            mitigated. "Current federal law, HIPAA, allows for patients to  
            provide an alternative address for these types of  
            correspondence. Health plans should already have existing  
            systems in place to comply. SB 138 simply seeks to codify this  
            into California law and clarify related definitions. Our bill  
            also clarifies that providers can make arrangements directly  
            with the patient for payment." 

            Also in opposition, the California Association of Health Plans  
            writes that the "opt-in process would require plans to invest  
                                           a considerable amount of time and resources toward upgrading  
            all their IT systems in order to fully comply with this bill."
            This argument is unpersuasive because an authorization for  
            insurance communications under this bill would appear to  
            require substantially similar information that a carrier must  
            receive and process when disclosing PHI to specified  
            individuals under existing law.  (Civ. Code Sec.  
            56.11(a)-(c).)  In addition, the opposition raises no concerns  
            regarding compliance with nondisclosure requests (see Comment  
            3) which are nearly identical in substance and treatment as  
            authorizations for insurance communications. 

            Thus, not only does SB 138 provide explicit guidance regarding  
            how insured dependents under the age of 26 may "opt-in" and  
            thereby receive insurance communications, carriers comply with  
            substantially similar requests under existing law. 

           1.Nondisclosure request 

           This bill would prohibit disclosure in insurance communications  
          related to sensitive services for insured dependents over the  
          age of 26 when he or she has submitted a nondisclosure request.   
          This bill would define nondisclosure request as a written  
          request to withhold insurance communications regarding specified  
          medical information, the identity of the person(s) from whom the  
          information shall be withheld, and the contact information for  
          the insured individual in the event that additional information  
          or clarification is necessary to satisfy the request.

                                                                      



          SB 138 (Hernandez)
          Page 11 of ?



          In support of this bill, the California Partnership to End  
          Domestic Violence argues that, "privacy and confidentiality are  
          vital components of a survivor's safety. ?Individuals covered by  
          a family member's insurance plan are often children, spouses, or  
          domestic partners and may not feel safe or comfortable having  
          their personal and sensitive health information shared with the  
          plan holder.  Breaches in patient confidentiality often occur  
          through Explanation of Benefits letters and other methods of  
          communication generated by health plans and insurers."

          To that end, this bill would allow individuals such as spouses  
          or domestic partners to confidently access health care for  
          intensely personal and private issues such as mental health  
          counseling, drug or alcohol rehabilitation, or reproductive  
          issues, without fear of disclosure to the policy holder.  

           2.Cost sharing  
           
           This bill would authorize health care providers to make cost  
          sharing arrangements with an insured individual and communicate  
          that arrangement with the carrier.  This provision would further  
          help ensure confidentiality for services where the carrier does  
          not fully cover the cost.  A practitioner and insured individual  
          may agree to have the insured pay for the uncovered portion of  
          services up front, or for the insured to be privately billed  
          after the fact.  They may also discuss how the insured will  
          cover costs in the event that a claim is denied in full or in  
          part.  Thus, this bill provides insured dependents and  
          practitioners with an opportunity to work together and satisfy  
          financial obligations without risking a breach of  
          confidentiality. 

           3.Individuals who fear harassment or abuse

           This bill would require a carrier to comply with any  
          nondisclosure request or confidential request from an insured  
          individual who states that disclosure of specified health  
          information would endanger the individual, and would prohibit  
          the carrier from requiring an explanation as to the basis for  
          the statement.  This bill would also define "endanger" to mean  
          that the insured individual fears harassment or abuse resulting  
          from an insurance communication sufficient to deter the patient  
          from obtaining health care absent confidentiality. 

          Significantly, this provision offers the protection of  
          confidentiality for health care services which fall outside the  
                                                                      



          SB 138 (Hernandez)
          Page 12 of ?



          scope of "sensitive services" for all insured individuals who  
          fear a negative backlash if the policy holder or another person  
          were to discover that particular services had been rendered.  
          Family and relationship dynamics are unique to each particular  
          situation.  While "sensitive services" are predictably services  
          that an insured individual may wish to keep private, it is  
          impossible to predict the multitude of circumstances for which  
          an individual may wish to keep other medical information  
          private. To that end, this provision enables all insured  
          individuals to protect the confidentiality of their medical  
          information in the event that his or her unique situation is not  
          covered explicitly by statute. 

           4.Prohibition against conditioning enrollment or coverage on  
            provision of authorization for insurance communications
           
          This bill would prohibit a carrier from conditioning enrollment,  
          coverage, or eligibility for benefits on an insured dependent's  
          choice to authorize insurance communications, or "opt-in" (see  
          Comment 2(a)). This is significant as the ACA (see Background)  
          mandates that all carriers that offer dependent insurance  
          coverage make that coverage available until an adult child  
          reaches the age of 26.  Both married and unmarried children will  
          qualify for this coverage, even if they have another offer of  
          coverage through an employer. A parent and live-in child  
          relationship is distinct from a parent and child relationship  
          where the child is married and lives with his or her spouse  
          independently.  Both of the previously mentioned situations are  
          distinct from a domestic partnership or marriage. 

          Arguably, the individuals in each of these relationships should  
          be able to choose with whom their health information is shared.  
          Thus, under the provisions of this bill, policy holders and  
          insured dependents under the age of 26 will be able to make  
          decisions about what health information they want shared, and  
          how it should be communicated, regardless of whether a carrier  
          prefers a uniform approach. 


           Support  : ACCESS Women's Health Justice; American Association of  
          University Women; American Civil Liberties Union; American  
          Congress of Obstetricians and Gynecologists, District IX  
          (California); California Adolescent Health Collaborative;  
          California Association of Marriage and Family Therapists;  
          California Family Health Council; California National  
          Organization for Women; California Partnership to End Domestic  
                                                                      



          SB 138 (Hernandez)
          Page 13 of ?



          Violence; California Primary Care Association; Center on  
          Reproductive Rights and Justice at UC Berkeley School of Law;  
          Citizens for Choice; Community Clinic Association of Los  
          Angeles; Los Angeles Trust for Children's Health; National  
          Center for Youth Law; National Council of Jewish Women; National  
          Health Law Program; Physicians for Reproductive Health; Planned  
          Parenthood Affiliates of California; Privacy Rights  
          Clearinghouse; Women's Community Clinic

           Opposition  :  Association of California Life & Health Insurance  
          Companies; California Association of Health Plans

                                           




                                       HISTORY
           
           Source  :  California Family Health Council

           Related Pending Legislation  : None Known

           Prior Legislation  : None Known

           Prior Vote  :  Senate Health Committee (Ayes 7, Noes 2)

                                   **************