BILL ANALYSIS Ó
SB 138
Page 1
Date of Hearing: June 25, 2013
ASSEMBLY COMMITTEE ON JUDICIARY
Bob Wieckowski, Chair
SB 138 (Hernandez) - As Amended: May 28, 2013
SENATE VOTE : 26-11
SUBJECT : Confidentiality of Medical Information
KEY ISSUE : Should a dependent covered by another person's
insurance policy be permitted to protect the confidentiality of
treatments for "sensitive services" by, among other things,
requesting that insurance communications be sent to A designated
address?
FISCAL EFFECT : As currently in print this bill is keyed fiscal.
SYNOPSIS
As part of the expansion of health care coverage under the
Affordable Care Act (ACA), it is anticipated that a growing
number of young adults will avail themselves of the opportunity
to be covered under a parent's health insurance policy until the
age of 26. As such, according to the author, ACA will expand
the number of young adults who may have compelling reasons for
not revealing to the primary policy holder (typically a parent,
guardian, or spouse) that they have been treated for certain
"sensitive services," such as mental health treatment, drug or
alcohol treatment, testing for HIV or other sexually-transmitted
diseases, or reproductive health services. Some studies suggest
that young people, in particular, may forgo these preventive and
even life-saving services for fear that a parent or spouse, as
the notified policy holder, may find out. Federal law already
provides some protections in this regard by, for example,
permitting a dependent, under certain circumstances, to request
that insurance communications be sent to an alternate address.
This bill would codify a somewhat stronger version of those
federal protections into state law. In order to address
opposition concerns about the precise mechanism by which an
insured dependent would communicate his or her preferences about
how the insurer should handle communications about sensitive
services, the author has agreed, in principle, to take the
amendments listed at the end of this analysis. However, because
SB 138
Page 2
of timing issues, these amendments will be formally taken in the
Assembly Health Committee, which will hear this bill if it moves
out of this Committee. The following analysis reflects the
proposed amendments. While the proposed amendments appear to
address the most significant concerns raised by the opposition,
it is not clear whether the amendments will remove the
opposition entirely.
SUMMARY : Requires a health care service plan or health insurer
to take certain steps to protect the confidentiality of an
insured individual's medical information. Specifically, this
bill :
1)Declares the intent of the Legislature to incorporate HIPAA
standards into state law and to clarify standards for
protecting the confidentiality of medical information in
insurance transactions.
2)Requires a health care service plan or health insurer
(insurer), to the extent permitted by federal law, to take the
following steps to protect the confidentiality of an insured
individual's medical information as follows:
a) For an insured individual who is insured as a dependent
on another person's insurance policy, an insurer shall not
send insurance communications relating to sensitive
services, as defined, unless a communication is required by
federal law.
b) Where a communication is required by federal law, the
insurer must do one of the following:
(1) Send the required information to the insured
individual in compliance with a confidential
communications request that was sent to the insurer by
the insured.
(2) Where the insurer has not received a
confidential communication request, it must send the
required communication to the insured individual and
may send it to the address furnished by the policy
holder.
3)Requires the insurer, for communications pertaining to
non -sensitive services, to comply with a confidential
communications request or a nondisclosure request from an
insured individual who states that disclosure of medical
SB 138
Page 3
information will endanger the individual, and specifies that
the insurer shall not require an explanation as to the basis
for the insured individual's statement that disclosure will
endanger the individual.
4)Provides that a confidential communications request or
nondisclosure request is deemed received by the insurer within
24 hours of electronic transmission or 72 hours of posting by
first class mail.
5)Authorizes a provider of health care to make arrangements with
the insured individual for the payment of benefit cost-sharing
arrangements and to communicate those arrangements to the
insurer.
6)Prohibits an insurer from conditioning enrollment in the plan
or eligibility for benefits upon a waiver of the right to
submit a confidential communication request or nondisclosure
request.
7)Defines "confidential communications request" to mean a
request submitted by an insured individual to an insurer that
insurance communications be communicated by a specific method,
such as by telephone, e-mail, or in a covered envelope rather
than a postcard, or to a specific mail or e-mail address or
specific telephone number, as designated by the insured
individual.
8)Defines "nondisclosure request" to mean a written request to
withhold insurance communications that includes the insured
individual's name and address, a description of the medical or
other information that shall not be disclosed, the identity of
persons from whom information shall be withheld, and the
contact information for additional information or
clarification necessary to satisfy the request.
EXISTING LAW :
1)Sets forth, under the federal Health Insurance Portability and
Accountability Act (HIPAA), various privacy protections for
patients' personal health information and generally provides
that a covered entity (health plan, health care provider, and
health care clearing house) may not use or disclose protected
health information except as specified or as authorized by the
patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
SB 138
Page 4
2)Prohibits, under the California Confidentiality of Medical
Information Act (CMIA), health care providers, health care
service plans, or contractors from sharing medical information
without the patient's written authorization, subject to
certain mandatory and permissive exceptions. (Civil Code
Section 56.10 et seq.)
3)Permits, under the Patient Protection and Affordable Care Act
(ACA), adult children under the age of 26 to be insured as
dependents on a health insurance policy held in another
person's name. (Public Law 111-148, 124 Stat. 119.)
4)Defines "medical information" to mean any individually
identifiable information, in electronic or physical form, in
possession of or derived from a provider of health care,
health care service plan, pharmaceutical company, or
contractor regarding a patient's medical history, mental or
physical condition, or treatment. Existing law defines
"individually identifiable" to mean that the medical
information includes or contains any element of personal
identifying information sufficient to allow identification of
the individual, such as the patient's name, address,
electronic mail address, telephone number, or social security
number, or other information that, alone or in combination
with other publicly available information, reveals the
individual's identity. (Civil Code Section 56.05(g).)
5)Permits minors to consent to certain health care treatments,
including sexual and reproductive health services, drug
treatment, and mental health treatment or counseling services
if, in the opinion of the attending professional, the minor is
mature enough to participate intelligently in treatment or
counseling services. (Health & Safety Code Sections 123115
and 124260; Civil Code Section 56.11(c)(1); Family Code
Sections 6924-6929.)
6)Requires an insurer that makes a decision to deny or contest a
health care service claim to provide a notice explaining the
decision to both the insured who received services and to the
health care provider that provided the services. The notice
shall advise both the provider and the insured that either may
seek a review of the contested or denied claim, and the notice
shall include the address, Internet Web site address, and
telephone number of the unit that performs this review
SB 138
Page 5
function. (Insurance Code Sections 10169(b) and 10123.13(a).)
7)Requires, under federal law, a health care service plan to
provide the insured with a notice that sets forth the specific
reasons for a denial of benefits and to inform the insured of
his or her right to receive a full and fair review of the
denial by the plan administrator. Specifies that, at a
minimum, the denial notice must include the specific reason or
reasons for the denial; a specific reference to pertinent plan
provisions upon which a denial is based; and information on
the steps to be taken if the insured wishes to submit a claim
for review. (29 USC Section 1133; 29 CFR Section 2560.503-1
(f).)
COMMENTS : The Patient Protection and Affordable Care Act (ACA),
as signed into law by President Obama in 2010, is part of a
larger joint federal-state effort to expand health care coverage
to the uninsured in a variety of new ways, from permitting small
businesses and persons who are not provided insurance through
their employers to seek low-cost insurance through an exchange,
to requiring all persons to obtain health care insurance either
through an employer, an exchange, or the private market.
Less publicized perhaps, is the ACA provision extending coverage
to more people by permitting young people to remain on the
insurance policies of their parents or guardians for a longer
period of time. Specifically, by January 1, 2014, ACA requires
all plans and insurers that offer dependent insurance coverage
to make that coverage available until the adult child reaches
the age of 26. Both married and unmarried children will qualify
for this coverage, even if they have another offer of coverage
through an employer. While this new policy will usefully extend
health insurance to young adults - one of the most underinsured
segments of the population - the author and sponsor believe that
it will also pose new challenges for protecting the
confidentiality of medical information. Specifically, many
covered minor or adult children may have compelling reasons for
not revealing to the primary policy holder (typically a parent,
guardian, or spouse) that they have received treatment for
certain "sensitive services," such as mental health treatment,
drug or alcohol treatment, testing for HIV or other
sexually-transmitted diseases, or reproductive health services.
The author and sponsor contend that young adults, in particular,
sometimes forgo these preventive and even life-saving services
SB 138
Page 6
for fear that a parent or spouse, as the notified policy holder,
might find out. For example, a 2012 study by the Guttmacher
Institute lends support to this contention by finding that:
[P]rivacy issues are often seen as a potentially significant
impediment for minors and young adults seeking care.
Confidentiality can be a factor when individuals are seeking
a broad range of health care services. For example, privacy
concerns may be a barrier to individuals seeking substance
abuse treatment or mental health care. Lack of
confidentiality may lead individuals experiencing intimate
partner violence to hesitate in seeking care for fear their
abuser may be alerted . . . Despite the widespread
recognition of the importance of maintaining patient
confidentiality, billing and insurance claim -most notably
the practice of sending explanation of benefits forms (EOBs)
to a policyholder whenever care is provided under his or her
policy- routinely violate confidentiality for anyone, often
a minor or a young adult, insured as a dependent on someone
else's policy?Obviously, when the patient is the
policyholder, no issue arises from this disclosure.
However, when the patient is insured as a dependent on
someone else's policy-such as that of a parent, spouse or
domestic partner-disclosure of protected health information
is possible, with potentially serious consequences.
(Guttmacher Institute, Confidentiality for Individuals
Insured as Dependents: A Review of State Laws and Policies,
(July 2012) pp. 3-4.)
The federal Health Insurance Portability and Accountability Act
(HIPAA) recognizes the fact that insured dependents may
sometimes wish to prevent the unintended disclosure of
confidential medical information through insurance
communications to the policy holder. HIPPA's overall purpose is
to prohibit covered entities - health plans, health care
providers, and health care clearing houses - from disclosing
personal health information unless the disclosure is authorized
by the patient in writing or is subject to an express statutory
exemption. (45 C.F.R. Sec. 164.500 et seq.) Of particular
relevance to this bill, one provision of HIPAA authorizes
insurers to send communications that might contain confidential
medical information to alternate addresses or to send them by
alternate means, such as to a designated telephone number or
e-mail address, as opposed to sending the communication by
regular mail to the address of the policy holder. Under HIPPA,
SB 138
Page 7
insurers are required to accommodate "reasonable requests" for
these alternate means of communication, but only if the
"individual clearly states that the disclosure of all or part of
the information could endanger the individual" (45 C.F.R.
164.522(b)). HIPAA also permits patients to request that
insurers restrict communications in other ways, for example, by
asking that an explanation of benefits not be mailed to certain
identified persons.
This bill seeks to codify a parallel version of the HIPPA rules
into California law. Specifically, as proposed to be amended,
this bill would require a health care service plan or health
insurer to take certain steps when sending insurance
communications (including an explanation of benefits) pertaining
to "sensitive services" that the insured dependent may have
received. The bill would permit an insured dependent to submit
a "confidential communication request" that would, in most
instances, require the insurer to send a communication
pertaining to a sensitive service to an alternate address or by
alternate means. The bill would also permit an insured
dependent to send either a "confidential communication request"
or a "non-disclosure request" for any other medical services
(i.e. not one of the designated a "sensitive service") if the
insured believes that he or she will be endangered by the
communication of medical information. The bill specifies that
this statement shall be sufficient by itself, and that the
insurer shall not require any further explanation for the reason
for the request. While there would potentially be overlap
between the contents of a "confidential communication request"
and a "nondisclosure request," the principle difference is that
the former merely specifies an alternate address or method of
communication, while the latter would request the exclusion of
certain kinds of personal or medical information from the
content of the communication.
The bill defines "sensitive services" to include reproductive
health services, mental health services, treatment of sexual
assault, testing or treatment for sexually transmitted diseases,
and treatment for drug or alcohol abuse. In an earlier version,
this bill would have prohibited an insurer from sending a
communication relating to sensitive services provided to a
dependent who is under 26 years of age unless that under-26
dependent had provided the insurer with prior authorization to
send the communication. Unlike HIPPA rules, which require the
insured to initiate contact with the insurer in order to
SB 138
Page 8
restrict communications that are otherwise automatically sent,
an earlier version of this bill would have required the insured
to notify the insurer before the insurer could send anything to
any address if the claim was for a "sensitive service."
However, an insured who may have no interest in restricting
communications would probably not think that he or she would
need to affirmatively authorize the insurer to send
communications, since this is the normal practice. As such, the
prior authorization requirement would have put the insurer in a
quandary: it would be required by federal and state law to send
an explanation of benefits whenever it does not pay the full
amount of the service, but if the under-26 ensured has not
bothered to send either a prior authorization or an alternate
address, the insurer would not be able to send any communication
to any address. The insurer would have been compelled to either
violate federal or state law requiring a communication, or to
violate the provisions of this bill if the insured had not
provided a prior authorization or an alternate address. After
several discussions between the author, sponsor, opponents, and
Committee staff, the bill as proposed to be amended addresses
this mechanical difficulty as follows:
If the insured is a dependent on another person's
policy, the insurer shall not send a communication relating
to sensitive services unless it is required to do so under
federal law (that is, where the insurer does not pay the
full amount of the service). If the insurer is required to
send a communication under federal law, then the insurer
must do one of the following: if the insured has submitted
a confidential communication request, then the insurer must
send the communication in compliance with that request; if
the insured has not submitted a confidential communication
request or alternate address, then the insurer may send the
communication to the policy holder.
Where a communication does not pertain to a sensitive
service (i.e. any other health care service) the insurer
must comply with a confidential communication or
nondisclosure request that is submitted by any insured who
states that disclosure of medical information will endanger
the insured, and the insurer shall not require any further
explanation for the insured 's statement.
In addition, this measure will specify that any confidential
communication or nondisclosure request shall be deemed received
SB 138
Page 9
within 24 hours of sending an electronic request and within 72
hours of posting a request by first class mail. The bill would
also prohibit an insurer from conditioning eligibility for
benefits upon waiver of the right to submit a confidential
communication or nondisclosure request.
This bill would offer more protection than HIPPA currently does
by permitting an insured dependent to request that
communications regarding sensitive services be sent to an
alternate address or by alternate means, without having to
provide a statement that communication will somehow "endanger"
the insured, as is required by HIPPA. However, requests for
non-sensitive services under this bill, as under HIPPA, would
still require such a statement.
ARGUMENTS IN SUPPORT : According to the author, "SB 138 will
bring clarity to an existing patchwork of state and federal
statutes and regulations related to the sharing of patient
information in order to protect patient confidentiality for
insured dependents accessing services related to sexual and
reproductive health, HIV/AIDS, substance abuse and mental health
care or any other health care service when disclosure could
cause harm." The author believes that the need for this bill is
especially great now that ACA will expand the number of insured
dependents who may have valid reasons for not disclosing
sensitive medical information to the policy holder. For
example, the author writes that the expansion of coverage under
ACA "will exacerbate an existing conflict between two important
policies: maintaining appropriate health plan and insurer
communications with a policy holder to ensure billing and
payment transparency versus protecting patient confidentiality
for insured dependents accessing sensitive services like sexual
and reproductive health care, mental health services and drug
and alcohol abuse treatment. The ACA will dramatically expand
the number of individuals insured as dependents on a health
insurance policy held in another person's name. Dependents
covered by a family member's insurance policy are often young
people (under the ACA, health plans and insurers are required to
offer dependent coverage for children up to age 26) or spouses
of the policy holder who may not feel safe revealing that they
have received sensitive health care services." The author
believes that SB 138, as proposed to be amended, will strike an
appropriate balance between potentially conflicting goals of
promoting full communication and protecting patient privacy.
SB 138
Page 10
According to the California Family Health Council (CFHC), the
bill's sponsor, while the expansion of coverage under ACA is "a
momentous step forward, individuals covered by a family member's
plan are often children, spouses, or domestic partners and may
not feel safe or comfortable having their personal and sensitive
health information shared with the plan holder." CFHC contends
that breaches in patient confidentiality "often occur through
the Explanation of Benefits (EOBs) and other methods of
communication generated by health plans and insurers. . . The
inability to guarantee confidential access to services can lead
to harm," as "some minors and adults may choose not to seek care
for sensitive services such as STDs, birth control, drug
treatment and mental health services for fear a parent or
partner will find out." CFHC believes that "SB 138 will close
loopholes and clarify definitions" in existing state and federal
law and thereby "help insured dependents feel safe and
comfortable using their private health insurance to assess the
health care services they need. This is good for public health
and will help save state dollars." For substantially the same
reasons as those given by CFHC, this bill is supported by
several other groups, including ACLU, Planned Parenthood, the
California Partnership to End Domestic Violence, the California
Primary Care Association, the California National Organization
of Women, and several other medical, women's, and child and teen
advocacy groups.
ARGUMENTS IN OPPOSITION : The California Association of Health
Plans (CAHP) opposes this bill primarily because of concerns
about the mechanics by which an insured would communicate his or
her desires to the insurer, as well as practical problems that
insurers may face in attempting to honor these requests -
especially in light of state and federal laws and regulations
that require to send notices whenever the insurer does not cover
all of the costs. CAHP writes:
We understand the intent of SB 138 and its focus on
protecting the privacy of those receiving defined
"sensitive services." However, we do have significant
implementation and workability concerns. While the bill
offers similar protections already afforded under federal
laws, it goes further by creating a new process where
dependents under the age of 26 must opt-in before
receiving any communications related to sensitive services
from their plan.
SB 138
Page 11
Complying with this proposed law would be difficult
because health plans have little initial contact with
anyone other than the primary contract holder. Most other
communications related to medical services occur at the
doctor-patient level that health plans do not control.
Additionally, this opt-in process would require plans to
invest a considerable amount of time and resources toward
upgrading all their IT systems in order to fully comply
with this bill.
We are concerned that health plan premium payers and
enrollees, including those covered by Preferred Provider
Organizations regulated by the Department of Managed
Health Care, will not be receiving important information
such as: explanation of benefits forms, scheduling
information, notices of denial, as well as notices of
contested claims, the appeal rights they may have if a
claim has been denied, and the potential financial
liability that exists related to the services they have
received.
Given that CAHP's primary opposition appears to concern what
it calls the "opt in" requirement - that is, the provisions
in an earlier version of the bill that prohibited the insurer
from sending any communications pertaining to sensitive
services unless the insured had provided prior authorization
- it is unclear whether the bill as proposed to be amended
will address all of CAHP's concerns. The bill is opposed by
the Association of California Life & Health Insurance
Companies (ACLHIC) for the same reasons as those articulated
by CAHP, and it is equally unclear whether the proposed
amendments will remove ACLHIC's opposition.
Finally, the SB 138 is opposed by the California Right to
Life Committee (CLRC). First, CLRC argues that the law is
"redundant" in that both HIPPA and state law already provide
substantially similar privacy protections. Second, CLRC
argues that this bill fails to protect "the conscience rights
of policy holders" who may object to their insurance policies
being used to fund procedures (such as abortions) to which
they are morally opposed. Finally, CLRC asserts that this
bill "allows law enforcement and the medical establishment
access to the private health information of minor children,
while denying the same information to the parents of the
SB 138
Page 12
child." [NOTE: Committee staff notes that this criticism
may be more aptly applied to existing law, insofar as
existing law, in limited situations, permits minors to have
certain medical procedures without the consent of a parent or
guardian if, in the opinion of the attending medical
professional, the minor is mature enough to participate in
the treatment, or, in the case of an abortion, if the minor
petitions the juvenile court and the court makes specified
findings.]
PROPSOSED AMENDMENTS (To be taken in Assembly Health Committee)
Amendment #1:
- On page 3 lines 26-31 delete subdivision (b) and
re-letter remaining subdivisions accordingly.
Amendment #2:
- Beginning on page 8 line 35 through page 9 line 26
delete SEC. 4 in its entirety and replace with the
following.
SEC. 4. Section 56.107 is added to the Civil Code, to read: Line 2
56.107.(a)
(a) Notwithstanding any other law, and to the extent permitted by
federal law, a health care service plan or health insurer shall
take the following steps to protect the confidentiality of an
insured individual's medical information as follows:
(1 ) For an insured individual who is insured as a dependent on
another person's insurance policy, a health care service plan or
health insurer shall not send insurance communications relating to
sensitive services, except as required by federal law. Where an
insurance communication is required by federal law:
(A) The health service plan or health insurer must send the
required communication to the insured individual in compliance with
a confidential communications request received from the insured
individual.
(B) Where the health service plan or health insurer has not
received a confidential communications request, it must send the
required communication to the insured individual and may do so at
the address furnished by the policy holder.
SB 138
Page 13
(2) For insurance communications not addressed in paragraph (1) of
subdivision (a), a health care service plan or health insurer shall
comply with a nondisclosure request or a confidential
communications request from an insured individual who states that
disclosure of medical information will endanger the individual, and
shall not require an explanation as to the basis for the insured
individual's statement that disclosure will endanger the
individual.
(3) A confidential communications request or nondisclosure request
is deemed received by the health service plan or health insurer
within 24 hours of electronic transmission or 72 hours of posting
by first class mail.
(b) Notwithstanding subdivision (a), the provider of health care
may make arrangements with the insured individual for the payment
of benefit cost sharing and communicate that arrangement with the
health care service plan or health insurer.
(c) A health care service plan or health insurer shall not
condition enrollment or coverage in the health plan or health
insurance policy or eligibility for benefits upon a waiver of the
right to submit confidential communications and nondisclosure
requests.
REGISTERED SUPPORT / OPPOSITION :
Support
California Family Health Council (sponsor)
ACCESS Women's Health Justice
American Civil Liberties Union
American Congress of Obstetricians and Gynecologists, District
IX (California)
California Adolescent Health Collaborative
California Association of Marriage and Family Therapists
California National Organization of Women
California Partnership to End Domestic Violence
California Primary Care Association
California Psychological Association
California Women's Law Center
Center on Reproductive Rights and Justice at UC Berkeley School
of Law
Citizens for Choice
SB 138
Page 14
Los Angeles Trust for Children's Health
National Center for Youth Law
National Council of Jewish Women
National Health Law Program
Physicians for Reproductive Health
Planned Parenthood
Privacy Rights Clearinghouse
Women's Community Clinic
Opposition
Association of California Life and Health Insurance Companies
California Association of Health Plans
California Right to Life Committee
Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334