Amended in Senate April 9, 2013

Senate Bill No. 249

Introduced by Senator Leno

begin insert

(Principal coauthor: Assembly Member Stone)

end insert

February 12, 2013

An act to amend Sections 120975 begin delete and end delete begin insert , end insert 121010 begin insert , 121022, and 121025 end insert of, and to add Section begin delete 120986 end delete begin insert 121026 end insert to, the Health and Safety Code, relating to public health.

LEGISLATIVE COUNSEL’S DIGEST

SB 249, as amended, Leno. Public health: health records: confidentiality.

begin delete

Under the federal Patient Protection and Affordable Care Act (PPACA), each state is required to, by January 1, 2014, establish an American Health Benefit Exchange that makes available qualified health plans to qualified individuals and small employers. Existing state law establishes the California Health Benefit Exchange (Exchange) within state government, specifies the powers and duties of the board governing the Exchange, and requires the board to facilitate the purchase of qualified health plans through the Exchange by qualified individuals and small employers by January 1, 2014. Existing law also provides for the Medi-Cal program, which is administered by the State Department of Health Care Services, under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid Program provisions. Under the PPACA, beginning January 1, 2014, the state is authorized to expand Medi-Cal coverage to specified eligibility groups.

end delete begin insert

Existing law requires health care providers and laboratories to report cases of HIV infection to the local health officer using patient names on a form developed by the State Department of Public Health.

end insert begin insert

This bill would require laboratories, upon request by the department, to report cases of HIV infection by name directly to the department in addition to reports to the local health officer.

end insert begin insert

Existing law authorizes state public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff to disclose personally identifying information in public health records relating to HIV or AIDS to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her.

end insert begin insert

This bill would authorize local public health agency staff to further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care, for that purpose.

end insert

Existing law also provides specified health care coverage to individuals under the AIDS Drug Assistance Program (ADAP) and under federal Ryan White Act-funded programs, which are administered by the State Department of Public Health. Existing law, with some exceptions, prohibits the disclosure of the results of an HIV test to any 3rd party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply. Existing law also provides that public health records related to HIV or AIDS containing personal identifying information that were developed or acquired by a state or local public agency shall be confidential and shall not be disclosed, except as otherwise provided by law or pursuant to written authorization.

This bill would authorize the State Department of Public Health, subject to specified provisions, to share begin insert with qualified entities, as defined, end insert health records involving the diagnosis, care, and treatment of HIV or AIDS related to a beneficiary enrolled in federal Ryan White Act-funded programs who may be eligible for services under the begin delete PPACA with participating entities, as defined, in health care coverage expansions under the PPACA end delete begin insert federal Patient Protection and Affordable Care Act (PPACA), as specified end insert . begin insert The bill would provide that any willful, negligent, or malicious disclosure of those records in violation of that provision would be a misdemeanor. By establishing a new crime, this bill would impose a state-mandated local program. end insert The bill would make other related changes.

begin insert

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

end insert begin insert

This bill would provide that no reimbursement is required by this act for a specified reason.

end insert

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program:  begin delete no end delete begin insert yes end insert .

The people of the State of California do enact as follows:

SECTION 1.  

Section 120975 of the Health and Safety Code
is amended to read:

120975.  

To protect the privacy of individuals who are the
subject of testing for human immunodeficiency virus (HIV), the
following shall apply:

Except as provided in Section 1603.1, 1603.3, or 121022, no
person shall be compelled in any state, county, city, or other local
civil, criminal, administrative, legislative, or other proceedings to
identify or provide identifying characteristics that would identify
any individual who is the subject of an HIV test, as defined in
subdivision (c) of Section 120775 begin delete , to detect antibodies to HIV end delete .

begin delete

SEC. 2.  

Section 120986 is added to the Health and Safety Code,
to read:

120986.  

(a) Notwithstanding any other state law, for purposes
of implementing the federal Patient Protection and Affordable
Care Act (PPACA) (Public Law 111-148), as amended by the
Health Care and Education Reconciliation Act of 2010 (Public
Law 111-152), including, but not limited to, ensuring safe
transitions to Medi-Cal, the Medi-Cal Bridge Program, or any
insurance plan certified by the California Health Benefits Exchange
(Exchange) established pursuant to Title 22 (commencing with
Section 100500) of the Government Code, the State Department
of Public Health may share health records involving the diagnosis,
care, and treatment of human immunodeficiency virus (HIV) or
acquired immunodeficiency syndrome (AIDS) related to a
beneficiary enrolled in federal Ryan White Act-funded programs
who may be eligible for services under the PPACA, with entities
participating in health care coverage expansions under the PPACA,
and the participating entities may share health records relating to
persons diagnosed with HIV/AIDS with the State Department of
Public Health.

(b) The information provided by the State Department of Public
Health pursuant to this section shall not be further disclosed by a
participating entity, except to any or all of the following:

(1) The person who is the subject of the record or to his or her
guardian or conservator.

(2) The health care provider that provides care to the person
with HIV or AIDS to whom the information pertains.

(3) The Office of AIDS within the State Department of Public
Health.

(c) For purposes of this section, “participating entity” means
the State Department of Health Care Services, the Exchange,
Medi-Cal managed care plans, plans participating in the Medi-Cal
Bridge Program, qualified health plans offered through the
Exchange, county health departments, and any other entities
participating in health care coverage expansions under the PPACA.

(d) Information shared pursuant to this section shall be subject
to the confidentiality protections of subdivisions (d) and (e) of
Section 121025, as well as the Confidentiality of Medical
Information Act (Part 2.6 (commencing with Section 56) of
Division 1 of the Civil Code), and the federal Health Insurance
Portability and Accountability Act of 1996 (Public Law 104-191).

(e) This section shall only be implemented to the extent
permitted by federal law.

end delete

begin delete SEC. 3. end delete
begin insert SEC. 2. end insert   

Section 121010 of the Health and Safety Code is
amended to read:

121010.  

Notwithstanding Section 120975 or 120980, the results
of an HIV test, as defined in subdivision (c) of Section 120775, to
detect antibodies to the probable causative agent of AIDS may be
disclosed to any of the following persons without written
authorization of the subject of the test:

(a) To the subject of the test or the subject’s legal representative,
conservator, or to any person authorized to consent to the test
pursuant to subdivision (b) of Section 120990.

(b) To a test subject’s provider of health care, as defined in
subdivision (d) of Section 56.05 of the Civil Code, except that for
purposes of this section, “provider of health care” does not include
a health care service plan regulated pursuant to Chapter 2.2
(commencing with Section 1340) of Division 2.

(c) To an agent or employee of the test subject’s provider of
health care who provides direct patient care and treatment.

(d) To a provider of health care who procures, processes,
distributes, or uses a human body part donated pursuant to the
Uniform Anatomical Gift Act (Chapter 3.5 (commencing with
Section 7150) of Part 1 of Division 7).

(e) (1) To the designated officer of an emergency response
employee, and from that designated officer to an emergency
response employee regarding possible exposure to HIV or AIDS,
but only to the extent necessary to comply with provisions of the
begin insert federal end insert Ryan White Comprehensive AIDS Resources Emergency
Act of 1990 (Public Law 101-381; 42 U.S.C. Sec. 201).

(2) For purposes of this subdivision, “designated officer” and
“emergency response employee” have the same meaning as these
terms are used in the begin insert federal end insert Ryan White Comprehensive AIDS
Resources Emergency Act of 1990 (Public Law 101-381; 42 U.S.C.
Sec. 201).

(3) The designated officer shall be subject to the confidentiality
requirements specified in Section 120980, and may be personally
liable for unauthorized release of any identifying information about
the HIV results. Further, the designated officer shall inform the
exposed emergency response employee that the employee is also
subject to the confidentiality requirements specified in Section
120980, and may be personally liable for unauthorized release of
any identifying information about the HIV test results.

begin insert

begin insert SEC. 3. end insert   

end insert

begin insert Section 121022 of the end insert begin insert Health and Safety Code end insert begin insert is
amended to read: end insert

121022.  

(a) To ensure knowledge of current trends in the HIV
epidemic and to ensure that California remains competitive for
federal HIV and AIDS funding, health care providers and
laboratories shall report cases of HIV infection to the local health
officer using patient names on a form developed by the department.
begin insert Upon request by the department, laboratories shall report cases
of HIV infection by name directly to the department in a manner
consistent with subdivision (g) of Section 120130, in addition to
reports to the local health officer. end insert Local health officers shall report
unduplicated HIV cases by name to the department on a form
developed by the department.

(b) (1) Health care providers and local health officers shall
submit cases of HIV infection pursuant to subdivision (a) by courier
service, United States Postal Service express mail or registered
mail, other traceable mail, person-to-person transfer, facsimile, or
electronically by a secure and confidential electronic reporting
system established by the department.

(2) This subdivision shall be implemented using the existing
resources of the department.

(c) The department and local health officers shall ensure
continued reasonable access to anonymous HIV testing through
alternative testing sites, as established by Section 120890, and in
consultation with HIV planning groups and affected stakeholders,
including representatives of persons living with HIV and health
officers.

(d) The department shall promulgate emergency regulations to
conform the relevant provisions of Article 3.5 (commencing with
Section 2641.5) of Chapter 4 of Division 1 of Title 17 of the
California Code of Regulations, consistent with this chapter, by
April 17, 2007. Notwithstanding the Administrative Procedure
Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of
Division 3 of Title 2 of the Government Code), if the department
revises the form used for reporting pursuant to subdivision (a) after
consideration of the reporting guidelines published by the federal
Centers for Disease Control and Prevention, the revised form shall
be implemented without being adopted as a regulation, and shall
be filed with the Secretary of State and printed in Title 17 of the
California Code of Regulations.

(e) Pursuant to Section 121025, reported cases of HIV infection
shall not be disclosed, discoverable, or compelled to be produced
in any civil, criminal, administrative, or other proceeding.

(f) State and local health department employees and contractors
shall be required to sign confidentiality agreements developed by
the department that include information related to the penalties for
a breach of confidentiality and the procedures for reporting a breach
of confidentiality, prior to accessing confidential HIV-related
public health records. Those agreements shall be reviewed annually
by either the department or the appropriate local health department.

(g)  No person shall disclose identifying information reported
pursuant to subdivision (a) to the federal government, including,
but not limited to, any agency, employee, agent, contractor, or
anyone else acting on behalf of the federal government, except as
permitted under subdivision (b) of Section 121025.

(h) (1) Any potential or actual breach of confidentiality of
HIV-related public health records shall be investigated by the local
health officer, in coordination with the department, when
appropriate. The local health officer shall immediately report any
evidence of an actual breach of confidentiality of HIV-related
public health records at a city or county level to the department
and the appropriate law enforcement agency.

(2) The department shall investigate any potential or actual
breach of confidentiality of HIV-related public health records at
the state level, and shall report any evidence of such a breach of
confidentiality to an appropriate law enforcement agency.

(i) Any willful, negligent, or malicious disclosure of cases of
HIV infection reported pursuant to subdivision (a) shall be subject
to the penalties prescribed in Section 121025.

(j) Nothing in this section shall be construed to limit other
remedies and protections available under state or federal law.

begin insert

begin insert SEC. 4. end insert   

end insert

begin insert Section 121025 of the end insert begin insert Health and Safety Code end insert begin insert is
amended to read: end insert

121025.  

(a) Public health records relating to human
immunodeficiency virus (HIV) or acquired immunodeficiency
syndrome (AIDS), containing personally identifying information,
that were developed or acquired by a state or local public health
agency, or an agent of that agency, shall be confidential and shall
not be disclosed, except as otherwise provided by law for public
health purposes or pursuant to a written authorization by the person
who is the subject of the record or by his or her guardian or
conservator.

(b) In accordance with subdivision (g) of Section 121022, a
state or local public health agency, or an agent of that agency, may
disclose personally identifying information in public health records,
as described in subdivision (a), to other local, state, or federal
public health agencies or to corroborating medical researchers,
when the confidential information is necessary to carry out the
duties of the agency or researcher in the investigation, control, or
surveillance of disease, as determined by the state or local public
health agency.

(c) Except as provided in paragraphs (1) to (3), inclusive, any
disclosure authorized by subdivision (a) or (b) shall include only
the information necessary for the purpose of that disclosure and
shall be made only upon agreement that the information will be
kept confidential and will not be further disclosed without written
authorization, as described in subdivision (a).

(1) Notwithstanding any other provision of law, the following
disclosures shall be authorized for the purpose of enhancing
completeness of HIV/AIDS, tuberculosis, and sexually transmitted
disease coinfection reporting to the federal Centers for Disease
Control and Prevention (CDC):

(A) The local public health agency HIV surveillance staff may
further disclose the information to the health care provider who
provides HIV care to the HIV-positive person who is the subject
of the record for the purpose of assisting in compliance with
subdivision (a) of Section 121022.

(B) Local public health agency tuberculosis control staff may
further disclose the information to state public health agency
tuberculosis control staff, who may further disclose the information,
without disclosing patient identifying information, to the CDC, to
the extent the information is requested by the CDC and permitted
by subdivision (b), for purposes of the investigation, control, or
surveillance of HIV and tuberculosis coinfections.

(C) Local public health agency sexually transmitted disease
control staff may further disclose the information to state public
health agency sexually transmitted disease control staff, who may
further disclose the information, without disclosing patient
identifying information, to the CDC, to the extent it is requested
by the CDC, and permitted by subdivision (b), for the purposes of
the investigation, control, or surveillance of HIV and syphilis,
gonorrhea, or chlamydia coinfection.

(2) Notwithstanding any other provision of law, the following
disclosures shall be authorized for the purpose of facilitating
appropriate HIV/AIDS medical care and treatment:

(A) State public health agency HIV surveillance staff, AIDS
Drug Assistance Program staff, and care services staff may further
disclose the information to local public health agency staff, who
may further disclose the information to the HIV-positive person
who is the subject of the record, or the health care provider who
provides his or her HIV care, for the purpose of proactively offering
and coordinating care and treatment services to him or her.

(B) AIDS Drug Assistance Program staff and care services staff
in the State Department of Public Health may further disclose the
information directly to the HIV-positive person who is the subject
of the record or the health care provider who provides his or her
HIV care, for the purpose of proactively offering and coordinating
care and treatment services to him or her.

begin insert

(C) Local public health agency staff may further disclose
acquired or developed information to the HIV-positive person who
is the subject of the record or the health care provider who
provides his or her HIV care for the purpose of proactively offering
and coordinating care and treatment services to him or her.

end insert

(3) Notwithstanding any other provision of law, for the purpose
of facilitating appropriate medical care and treatment of persons
coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or
chlamydia, local public health agency sexually transmitted disease
control and tuberculosis control staff may further disclose the
information to state or local public health agency sexually
transmitted disease control and tuberculosis control staff, the
HIV-positive person who is the subject of the record, or the health
care provider who provides his or her HIV, tuberculosis, and
sexually transmitted disease care.

(4) For the purposes of paragraphs (2) and (3), “staff” begin delete does end delete begin insert shall end insert
not include nongovernmental entities begin insert , but shall include state and
local contracted employees end insert .

(d) No confidential public health record, as defined in
subdivision (c) of Section 121035, shall be disclosed, discoverable,
or compelled to be produced in any civil, criminal, administrative,
or other proceeding.

(e) (1) A person who negligently discloses the content of a
confidential public health record, as defined in subdivision (c) of
Section 121035, to any third party, except pursuant to a written
authorization, as described in subdivision (a), or as otherwise
authorized by law, shall be subject to a civil penalty in an amount
not to exceed five thousand dollars ($5,000), plus court costs, as
determined by the court, which penalty and costs shall be paid to
the person whose record was disclosed.

(2) Any person who willfully or maliciously discloses the
content of any confidential public health record, as defined in
subdivision (c) of Section 121035, to any third party, except
pursuant to a written authorization, or as otherwise authorized by
law, shall be subject to a civil penalty in an amount not less than
five thousand dollars ($5,000) and not more than twenty-five
thousand dollars ($25,000), plus court costs, as determined by the
court, which penalty and costs shall be paid to the person whose
confidential public health record was disclosed.

(3) Any person who willfully, maliciously, or negligently
discloses the content of any confidential public health record, as
defined in subdivision (c) of Section 121035, to any third party,
except pursuant to a written authorization, or as otherwise
authorized by law, that results in economic, bodily, or
psychological harm to the person whose confidential public health
record was disclosed, is guilty of a misdemeanor, punishable by
imprisonment in a county jail for a period not to exceed one year,
or a fine of not to exceed twenty-five thousand dollars ($25,000),
or both, plus court costs, as determined by the court, which penalty
and costs shall be paid to the person whose confidential public
health record was disclosed.

(4) Any person who commits any act described in paragraph
(1), (2), or (3), shall be liable to the person whose confidential
public health record was disclosed for all actual damages for
economic, bodily, or psychological harm that is a proximate result
of the act.

(5) Each violation of this section is a separate and actionable
offense.

(6) Nothing in this section limits or expands the right of an
injured person whose confidential public health record was
disclosed to recover damages under any other applicable law.

(f) In the event that a confidential public health record, as
defined in subdivision (c) of Section 121035, is disclosed, the
information shall not be used to determine employability, or
insurability of any person.

begin insert

begin insert SEC. 5. end insert   

Section 121026 is added to the Health and Safety Code,
to read:

begin insert 121026. end insert   

(a) Notwithstanding subdivision (f) of Section 120980,
Section 121010, subdivision (g) of Section 121022, subdivision (f)
of Section 121025, Section 121115, and Section 121280, the State
Department of Public Health may share with qualified entities
health records involving the diagnosis, care, and treatment of
human immunodeficiency virus (HIV) or acquired
immunodeficiency syndrome (AIDS) related to a beneficiary
enrolled in federal Ryan White Act funded programs who may be
eligible for services under the federal Patient Protection and
Affordable Care Act (PPACA) (Public Law 111-148), as amended
by the Health Care and Education Reconciliation Act of 2010
(Public Law 111-152). The qualified entities may share health
records relating to persons diagnosed with HIV/AIDS with the
State Department of Public Health for the purpose of proactively
offering and coordinating care and treatment services offered by
new health coverage options offered under the PPACA, including,
but not limited to, ensuring safe transitions to Medi-Cal, the bridge
programs, Medicaid expansion programs, and any insurance plan
certified by the California Health Benefit Exchange (Exchange)
established pursuant to Title 22 (commencing with Section 100500)
of the Government Code.

(b) The information provided by the State Department of Public
Health pursuant to this section shall be limited to only the
information necessary for the purposes of this section and shall
not be further disclosed by a qualified entity, except to any or all
of the following:

(1) The person who is the subject of the record or to his or her
guardian or conservator.

(2) The provider of health care for the person with HIV or AIDS
to whom the information pertains.

(3) The Office of AIDS within the State Department of Public
Health.

(c) For purposes of this section, the following definitions shall
apply:

(1) “Contractor” means any person or entity that is a medical
group, independent practice association, pharmaceutical benefits
manager, or a medical service organization and is not a health
care service plan or provider of health care. “Contractor” does
not include insurance institutions as defined in subdivision (k) of
Section 791.02 of the Insurance Code or pharmaceutical benefits
managers licensed pursuant to the Knox-Keene Health Care
Service Plan Act of 1975 (Chapter 2.2 (commencing with Section
1340) of Division 2 of the Health and Safety Code).

(2) “Provider of health care” means any person licensed or
certified pursuant to Division 2 (commencing with Section 500)
of the Business and Professions Code; any person licensed
pursuant to the Osteopathic Initiative Act or the Chiropractic
Initiative Act; any person certified pursuant to Division 2.5
(commencing with Section 1797) of the Health and Safety Code;
any clinic, health dispensary, or health facility licensed pursuant
to Division 2 (commencing with Section 1200) of the Health and
Safety Code. “Provider of health care“ does not include insurance
institutions as defined in subdivision (k) of Section 791.02 of the
Insurance Code.

(3) “Qualified entity” means health care providers and
administrative staff for one of the following, who are HIPAA
trained and who have legal access to confidential HIV-related
medical records:

(A) The State Department of Health Care Services.

(B) The California Health Benefit Exchange (Exchange)
established pursuant to Title 22 (commencing with Section 100500)
of the Government Code.

(C) Medi-Cal managed care plans.

(D) Health plans participating in the Bridge Program.

(E) Health plans offered through the Exchange.

(F) County health care services.

(G) Any other medical coverage option provided pursuant to
the PPACA.

(H) The Department of Managed Health Care.

(d) Information shared pursuant to this section shall not be
disclosed, discoverable, or compelled to be produced in any civil,
criminal, administrative, or other proceeding.

(e) All employees and contractors of a qualified entity who have
legal access to confidential HIV-related medical records shall be
required to sign confidentiality agreements developed by the State
Department of Public Health that include information related to
the penalties for a breach of confidentiality and the procedures
for reporting a breach of confidentiality, prior to accessing
confidential HIV-related medical records. Those agreements shall
be reviewed annually by either the State Department of Public
Health or the appropriate local health department.

(f) (1) Any potential or actual breach of confidentiality of
HIV-related public health records shall be investigated by the
local health officer, in coordination with the department, when
appropriate. The local health officer shall immediately report any
evidence of an actual breach of confidentiality of HIV-related
public health records at a city or county level to the department
and the appropriate law enforcement agency as required by Section
121022. Any potential or actual breach of confidentiality of
HIV-related public health records shall be subject to subdivision
(h) of Section 121022.

(2) The department shall investigate any potential or actual
breach of confidentiality of HIV-related public health records at
the state level, and shall report any evidence of such a breach of
confidentiality to an appropriate law enforcement agency.

(g) Any willful, negligent, or malicious disclosure of reported
cases of HIV infection in violation of subdivision (a) shall be
subject to the penalties prescribed in Section 121025.

(h) Nothing in this section shall be construed to limit other
remedies and protections available under state or federal law,
including, but not limited to, the federal Health Insurance
Portability and Accountability Act of 1996 (Public Law 104-191).

(i) If a confidential public health record, as defined in
subdivision (c) of Section 121035, is disclosed, the information
shall not be used to determine employability, or insurability of any
person as provided under subdivision (f) of Section 120980,
subdivision (f) of Section 121025, Section 121115, and Section
121280.

(j) This section shall only be implemented to the extent permitted
by federal law.

end insert

begin insert

begin insert SEC. 6. end insert   

No reimbursement is required by this act pursuant to
Section 6 of Article XIII B of the California Constitution because
the only costs that may be incurred by a local agency or school
district will be incurred because this act creates a new crime or
infraction, eliminates a crime or infraction, or changes the penalty
for a crime or infraction, within the meaning of Section 17556 of
the Government Code, or changes the definition of a crime within
the meaning of Section 6 of Article XIII B of the California
Constitution.

end insert