Amended in Assembly June 17, 2013

Amended in Senate April 16, 2013

Amended in Senate April 9, 2013

Senate BillNo. 249


Introduced by Senator Leno

(Principal coauthor: Assembly Member Stone)

February 12, 2013


An act to amend Sections 120975, 121010, 121022, and 121025 of, and to add Section 121026 to, the Health and Safety Code, relating to public health.

LEGISLATIVE COUNSEL’S DIGEST

SB 249, as amended, Leno. Public health: health records: confidentiality.

Existing law requires health care providers and laboratories to report cases of HIV infection to the local health officer using patient names on a form developed by the State Department of Public Health.

This bill would require laboratories, upon request by the department, to report cases of HIV infection by name directly to the department in addition to reports to the local health officer.

begin delete

Existing law authorizes state public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff to disclose personally identifying information in public health records relating to HIV or AIDS to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her.

end delete
begin delete

This bill would authorize local public health agency staff to further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care, for that purpose.

end delete

Existing law also provides specified health care coverage to individuals under the AIDS Drug Assistance Program (ADAP) and under federal Ryan Whitebegin delete Act-fundedend deletebegin insert Act fundedend insert programs, which are administered by the State Department of Public Health. Existing law, with some exceptions, prohibits the disclosure of the results of an HIV test to any 3rd party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply. Existing law also provides that public health records related to HIV or AIDS containing personal identifying information that were developed or acquired by a state or local public agency shall be confidential and shall not be disclosed, except as otherwise provided by law or pursuant to written authorization.

This bill would authorize the State Department of Public Health, subject to specified provisions,begin delete to share withend deletebegin insert andend insert qualified entities, as defined,begin insert to share with each otherend insert health records involving the diagnosis, care, and treatment of HIV or AIDS related to a beneficiary enrolled in federal Ryan Whitebegin delete Act-fundedend deletebegin insert Act fundedend insert programs who may be eligible for services under the federal Patient Protection and Affordable Care Act (PPACA), as specified. The bill would make other related changes.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

P2    1

SECTION 1.  

Section 120975 of the Health and Safety Code
2 is amended to read:

3

120975.  

To protect the privacy of individuals who are the
4subject of testing for human immunodeficiency virus (HIV), the
5following shall apply:

6Except as provided in Section 1603.1, 1603.3, or 121022, no
7person shall be compelled in any state, county, city, or other local
8civil, criminal, administrative, legislative, or other proceedings to
9identify or provide identifying characteristics that would identify
10any individual who is the subject of an HIV test, as defined in
11subdivision (c) of Section 120775.

P3    1

SEC. 2.  

Section 121010 of the Health and Safety Code is
2amended to read:

3

121010.  

Notwithstanding Section 120975 or 120980, the results
4of an HIV test, as defined in subdivision (c) of Section 120775, to
5detect antibodies to the probable causative agent of AIDS may be
6disclosed to any of the following persons without written
7authorization of the subject of the test:

8(a) To the subject of the test or the subject’s legal representative,
9conservator, or to any person authorized to consent to the test
10pursuant to subdivision (b) of Section 120990.

11(b) To a test subject’s provider of health care, as defined in
12subdivision (d) of Section 56.05 of the Civil Code, except that for
13purposes of this section, “provider of health care” does not include
14a health care service plan regulated pursuant to Chapter 2.2
15(commencing with Section 1340) of Division 2.

16(c) To an agent or employee of the test subject’s provider of
17health care who provides direct patient care and treatment.

18(d) To a provider of health care who procures, processes,
19distributes, or uses a human body part donated pursuant to the
20Uniform Anatomical Gift Act (Chapter 3.5 (commencing with
21Section 7150) of Part 1 of Division 7).

22(e) (1) To the designated officer of an emergency response
23employee, and from that designated officer to an emergency
24response employee regarding possible exposure to HIV or AIDS,
25but only to the extent necessary to comply with provisions of the
26federal Ryan White Comprehensive AIDS Resources Emergency
27Act of 1990 (Public Law 101-381; 42 U.S.C. Sec. 201).

28(2) For purposes of this subdivision, “designated officer” and
29“emergency response employee” have the same meaning as these
30terms are used in the federal Ryan White Comprehensive AIDS
31Resources Emergency Act of 1990 (Public Law 101-381; 42 U.S.C.
32Sec. 201).

33(3) The designated officer shall be subject to the confidentiality
34 requirements specified in Section 120980, and may be personally
35liable for unauthorized release of any identifying information about
36the HIV results. Further, the designated officer shall inform the
37exposed emergency response employee that the employee is also
38subject to the confidentiality requirements specified in Section
39120980, and may be personally liable for unauthorized release of
40any identifying information about the HIV test results.

P4    1

SEC. 3.  

Section 121022 of the Health and Safety Code is
2 amended to read:

3

121022.  

(a) To ensure knowledge of current trends in the HIV
4epidemic and to ensure that California remains competitive for
5federal HIV and AIDS funding, health care providers and
6laboratories shall report cases of HIV infection to the local health
7officer using patient names on a form developed by the department.
8Upon request by the department, laboratories shall report cases of
9HIV infection by name directly to the department in a manner
10consistent with subdivision (g) of Section 120130, in addition to
11reports to the local health officer. Local health officers shall report
12unduplicated HIV cases by name to the department on a form
13developed by the department.

14(b) (1) Health care providers and local health officers shall
15submit cases of HIV infection pursuant to subdivision (a) by courier
16service, United States Postal Service express mail or registered
17mail, other traceable mail, person-to-person transfer, facsimile, or
18electronically by a secure and confidential electronic reporting
19system established by the department.

20(2) This subdivision shall be implemented using the existing
21resources of the department.

22(c) The department and local health officers shall ensure
23continued reasonable access to anonymous HIV testing through
24alternative testing sites, as established by Section 120890, and in
25consultation with HIV planning groups and affected stakeholders,
26including representatives of persons living with HIV and health
27officers.

28(d) The department shall promulgate emergency regulations to
29conform the relevant provisions of Article 3.5 (commencing with
30Section 2641.5) of Chapter 4 of Division 1 of Title 17 of the
31California Code of Regulations, consistent with this chapter, by
32April 17, 2007. Notwithstanding the Administrative Procedure
33Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of
34Division 3 of Title 2 of the Government Code), if the department
35revises the form used for reporting pursuant to subdivision (a) after
36consideration of the reporting guidelines published by the federal
37Centers for Disease Control and Prevention, the revised form shall
38be implemented without being adopted as a regulation, and shall
39be filed with the Secretary of State and printed in Title 17 of the
40California Code of Regulations.

P5    1(e) Pursuant to Section 121025, reported cases of HIV infection
2shall not be disclosed, discoverable, or compelled to be produced
3in any civil, criminal, administrative, or other proceeding.

4(f) State and local health department employees and contractors
5shall be required to sign confidentiality agreements developed by
6the department that include information related to the penalties for
7a breach of confidentiality and the procedures for reporting a breach
8of confidentiality, prior to accessing confidential HIV-related
9public health records. Those agreements shall be reviewed annually
10by either the department or the appropriate local health department.

11(g)  No person shall disclose identifying information reported
12pursuant to subdivision (a) to the federal government, including,
13but not limited to, any agency, employee, agent, contractor, or
14anyone else acting on behalf of the federal government, except as
15permitted under subdivision (b) of Section 121025.

16(h) (1) Any potential or actual breach of confidentiality of
17HIV-related public health records shall be investigated by the local
18health officer, in coordination with the department, when
19appropriate. The local health officer shall immediately report any
20evidence of an actual breach of confidentiality of HIV-related
21public health records at a city or county level to the department
22and the appropriate law enforcement agency.

23(2) The department shall investigate any potential or actual
24breach of confidentiality of HIV-related public health records at
25the state level, and shall report any evidence of such a breach of
26confidentiality to an appropriate law enforcement agency.

27(i) Any willful, negligent, or malicious disclosure of cases of
28HIV infection reported pursuant to subdivision (a) shall be subject
29to the penalties prescribed in Section 121025.

30(j) Nothing in this section shall be construed to limit other
31remedies and protections available under state or federal law.

32

SEC. 4.  

Section 121025 of the Health and Safety Code is
33amended to read:

34

121025.  

(a) Public health records relating to human
35immunodeficiency virus (HIV) or acquired immunodeficiency
36syndrome (AIDS), containing personally identifying information,
37that were developed or acquired by a state or local public health
38agency, or an agent of that agency, shall be confidential and shall
39not be disclosed, except as otherwise provided by law for public
40health purposes or pursuant to a written authorization by the person
P6    1who is the subject of the record or by his or her guardian or
2conservator.

3(b) In accordance with subdivision (g) of Section 121022, a
4state or local public health agency, or an agent of that agency, may
5disclose personally identifying information in public health records,
6as described in subdivision (a), to other local, state, or federal
7public health agencies or to corroborating medical researchers,
8when the confidential information is necessary to carry out the
9duties of the agency or researcher in the investigation, control, or
10surveillance of disease, as determined by the state or local public
11health agency.

12(c) Except as provided in paragraphs (1) to (3), inclusive, any
13disclosure authorized by subdivision (a) or (b) shall include only
14the information necessary for the purpose of that disclosure and
15shall be made only upon agreement that the information will be
16kept confidential and will not be further disclosed without written
17authorization, as described in subdivision (a).

18(1) Notwithstanding any other provision of law, the following
19disclosures shall be authorized for the purpose of enhancing
20completeness of HIV/AIDS, tuberculosis, and sexually transmitted
21disease coinfection reporting to the federal Centers for Disease
22Control and Prevention (CDC):

23(A) The local public health agency HIV surveillance staff may
24further disclose the information to the health care provider who
25provides HIV care to the HIV-positive person who is the subject
26of the record for the purpose of assisting in compliance with
27subdivision (a) of Section 121022.

28(B) Local public health agency tuberculosis control staff may
29further disclose the information to state public health agency
30tuberculosis control staff, who may further disclose the information,
31without disclosing patient identifying information, to the CDC, to
32 the extent the information is requested by the CDC and permitted
33by subdivision (b), for purposes of the investigation, control, or
34surveillance of HIV and tuberculosis coinfections.

begin delete

35(C) Local public health agency sexually transmitted disease
36control staff may further disclose the information to state public
37health agency sexually transmitted disease control staff, who may
38further disclose the information, without disclosing patient
39identifying information, to the CDC, to the extent it is requested
40by the CDC, and permitted by subdivision (b), for the purposes of
P7    1the investigation, control, or surveillance of HIV and syphilis,
2gonorrhea, or chlamydia coinfection.

end delete

3(2) Notwithstanding any other provision of law, the following
4disclosures shall be authorized for the purpose of facilitating
5appropriate HIV/AIDS medical care and treatment:

6(A) State public health agency HIV surveillance staff, AIDS
7Drug Assistance Program staff, and care services staff may further
8disclose the information to local public health agency staff, who
9may further disclose the information to the HIV-positive person
10who is the subject of the record, or the health care provider who
11provides his or her HIV care, for the purpose of proactively offering
12and coordinating care and treatment services to him or her.

13(B) AIDS Drug Assistance Program staff and care services staff
14in the State Department of Public Health may further disclose the
15information directly to the HIV-positive person who is the subject
16of the record or the health care provider who provides his or her
17HIV care, for the purpose of proactively offering and coordinating
18care and treatment services to him or her.

19(C) Local public health agency staff may further disclose
20acquired or developed information to the HIV-positive person who
21is the subject of the record or the health care provider who provides
22his or her HIV care for the purpose of proactively offering and
23coordinating care and treatment services to him or her.

24(3) Notwithstanding any other provision of law, for the purpose
25of facilitating appropriate medical care and treatment of persons
26coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or
27chlamydia, local public health agency sexually transmitted disease
28control and tuberculosis control staff may further disclose the
29information to state or local public health agency sexually
30transmitted disease control and tuberculosis control staff, the
31HIV-positive person who is the subject of the record, or the health
32care provider who provides his or her HIV, tuberculosis, and
33sexually transmitted disease care.

34(4) For the purposes of paragraphs (2) and (3), “staff” shall not
35include nongovernmental entities, but shall include state and local
36contracted employeesbegin insert end insertbegin insertwho work within state and local public health
37departmentsend insert
.

38(d) No confidential public health record, as defined in
39subdivision (c) of Section 121035, shall be disclosed, discoverable,
P8    1or compelled to be produced in any civil, criminal, administrative,
2or other proceeding.

3(e) (1) A person who negligently discloses the content of a
4confidential public health record, as defined in subdivision (c) of
5Section 121035, to any third party, except pursuant to a written
6authorization, as described in subdivision (a), or as otherwise
7authorized by law, shall be subject to a civil penalty in an amount
8not to exceed five thousand dollars ($5,000), plus court costs, as
9determined by the court, which penalty and costs shall be paid to
10the person whose record was disclosed.

11(2) Any person who willfully or maliciously discloses the
12content of any confidential public health record, as defined in
13subdivision (c) of Section 121035, to any third party, except
14pursuant to a written authorization, or as otherwise authorized by
15law, shall be subject to a civil penalty in an amount not less than
16five thousand dollars ($5,000) and not more than twenty-five
17thousand dollars ($25,000), plus court costs, as determined by the
18court, which penalty and costs shall be paid to the person whose
19confidential public health record was disclosed.

20(3) Any person who willfully, maliciously, or negligently
21discloses the content of any confidential public health record, as
22defined in subdivision (c) of Section 121035, to any third party,
23except pursuant to a written authorization, or as otherwise
24authorized by law, that results in economic, bodily, or
25psychological harm to the person whose confidential public health
26record was disclosed, is guilty of a misdemeanor, punishable by
27imprisonment in a county jail for a period not to exceed one year,
28or a fine of not to exceed twenty-five thousand dollars ($25,000),
29or both, plus court costs, as determined by the court, which penalty
30and costs shall be paid to the person whose confidential public
31health record was disclosed.

32(4) Any person who commits any act described in paragraph
33(1), (2), or (3), shall be liable to the person whose confidential
34public health record was disclosed for all actual damages for
35economic, bodily, or psychological harm that is a proximate result
36of the act.

37(5) Each violation of this section is a separate and actionable
38offense.

P9    1(6) Nothing in this section limits or expands the right of an
2injured person whose confidential public health record was
3disclosed to recover damages under any other applicable law.

4(f) In the event that a confidential public health record, as
5defined in subdivision (c) of Section 121035, is disclosed, the
6information shall not be used to determine employability, or
7insurability of any person.

8

SEC. 5.  

Section 121026 is added to the Health and Safety Code,
9to read:

10

121026.  

(a) Notwithstanding subdivision (f) of Section 120980,
11Section 121010, subdivision (g) of Section 121022, subdivision
12(f) of Section 121025, Section 121115, and Section 121280, the
13State Department of Public Healthbegin delete may share withend deletebegin insert andend insert qualified
14entitiesbegin insert may share with each other end insert health records involving the
15diagnosis, care, and treatment of human immunodeficiency virus
16(HIV) or acquired immunodeficiency syndrome (AIDS) related
17to a beneficiary enrolled in federal Ryan White Act funded
18programs who may be eligible for services under the federal Patient
19Protection and Affordable Care Act (Public Law 111-148), as
20amended by the Health Care and Education Reconciliation Act of
212010 (Public Law 111-152). The qualified entities begin delete may share health
22records relating to persons diagnosed with HIV/AIDS with the
23State Department of Public Healthend delete
begin insert, who shall be covered entities
24under the Health Insurance Portability and Accountability Act (42
25U.S.C. Sec. 300gg) and the final regulations issued pursuant to
26the act by the United States Department of Health and Human
27Services (45 C.F.R. Parts 160 and 164), may share records onlyend insert

28 for the purpose ofbegin delete enrollment without disruptionend deletebegin insert enrolling the
29beneficiaryend insert
in Medi-Cal, the bridge programs, Medicaid expansion
30programs, and any insurance plan certified by the California Health
31Benefit Exchange established pursuant to Title 22 (commencing
32with Section 100500) of the Government Codebegin insert, or end insertbegin insertany other
33programs authorized under the federal Patient Protection and
34 Affordable Care Act (Public Law 111-148), and for the purpose
35of continuing his or her access to those programs and plans without
36disruptionend insert
.

37(b) The information provided by the State Department of Public
38Health pursuant to this section shall be limited to only the
39information necessary for the purposes of this section andbegin insert shall
40not include HIV or AIDS surveillance data. This informationend insert
shall
P10   1not be further disclosed by a qualified entity, except to any or all
2of the followingbegin insert as necessary for the purposes of this sectionend insert:

3(1) The person who is the subject of the record or to his or her
4guardian or conservator.

5(2) The provider of health care for the person with HIV or AIDS
6to whom the information pertains.

7(3) The Office of AIDS within the State Department of Public
8Health.

9(c) For purposes of this section, the following definitions shall
10apply:

11(1) “Contractor” means any person or entity that is a medical
12group, independent practice association, pharmaceutical benefits
13manager, or a medical service organization and is not a health care
14service plan or provider of health care.

15(2) “Provider of health care” means any person licensed or
16certified pursuant to Division 2 (commencing with Section 500)
17of the Business and Professions Code; any person licensed pursuant
18to the Osteopathic Initiative Act or the Chiropractic Initiative Act;
19any person certified pursuant to Division 2.5 (commencing with
20Section 1797) of the Health and Safety Code; any clinic, health
21dispensary, or health facility licensed pursuant to Division 2
22(commencing with Section 1200) of the Health and Safety Code.

23(3) “Qualified entity” means any of the following:

24(A) The State Department of Health Care Services.

25(B) The California Health Benefit Exchange established pursuant
26to Title 22 (commencing with Section 100500) of the Government
27Code.

28(C) Medi-Cal managed care plans.

29(D) Health plans participating in the Bridge Program.

30(E) Health plans offered through the Exchange.

begin delete

31(F) The Department of Managed Health Care.

end delete
begin insert

32(F) County health departments delivering HIV or AIDS health
33care services.

end insert

34(d) begin deleteInformation end deletebegin insertNotwithstanding any other law, information end insert
35shared pursuant to this section shall not be disclosed, discoverable,
36or compelled to be produced in any civil, criminal, administrative,
37or other proceeding.

38(e) All employees and contractors of a qualified entity who have
39legal access to confidential HIV-related medical records shall be
P11   1required to sign confidentiality agreements pursuant to subdivision
2(f)begin insert of end insert Section 121022.

3(f) This section shall be implemented only to the extent
4permitted by federal law.begin insert Information shared pursuant to this
5section shall be protected in accordance with the federal Health
6Insurance Portability and Accountability Act (42 U.S.C. Sec.
7300gg) and the final regulations issued pursuant to that act by the
8United States Department of Health and Human Services (45
9C.F.R. Parts 160 and 164), the Confidentiality of Medical
10Information Act (Part 2.6 (commencing with Section 56) of Division
111 of the Civil Code), and the Insurance Information and Privacy
12Protection Act (Article 6.6 (commencing with Section 791) of Part
132 of Division 1 of the Insurance Code).end insert



O

    96