Amended in Assembly September 3, 2013

Amended in Assembly June 27, 2013

Amended in Assembly June 17, 2013

Amended in Senate April 16, 2013

Amended in Senate April 9, 2013

Senate BillNo. 249


Introduced by Senator Leno

(Principal coauthor: Assembly Member Stone)

February 12, 2013


An act to amend Sections 120975, 121010, 121022, and 121025 of, and to add Section 121026 to, the Health and Safety Code, relating to public health.

LEGISLATIVE COUNSEL’S DIGEST

SB 249, as amended, Leno. Public health: health records: confidentiality.

Existing law requires health care providers and laboratories to report cases of HIV infection to the local health officer using patient names on a form developed by the State Department of Public Health.begin insert Existing law, commencing July 1, 2009, or within one year of the establishment of a state electronic laboratory reporting system, whichever is later, requires a report generated pursuant to that provision by a laboratory to be submitted electronically in a manner specified by the department.end insert

begin delete

This bill would require laboratories, upon request by the department, to report cases of HIV infection by name directly to the department in addition to reports to the local health officer.

end delete
begin insert

This bill would authorize both the local health officer and the department to access reports of HIV infection that are electronically submitted by laboratories pursuant to the above-described provision.

end insert

Existing law authorizes state public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff to disclose personally identifying information in public health records relating to HIV or AIDS to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides that person’s HIV care, for the purpose of proactively offering and coordinating care and treatment services to that person.

This bill would authorize local public health agency staff to further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides that person’s HIV care, for that purpose.

Existing law also provides specified health care coverage to individuals under the AIDS Drug Assistance Program (ADAP) and under federal Ryan White Act funded programs, which are administered by the State Department of Public Health. Existing law, with some exceptions, prohibits the disclosure of the results of an HIV test to any 3rd party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply. Existing law also provides that public health records related to HIV or AIDS containing personal identifying information that were developed or acquired by a state or local public agency shall be confidential and shall not be disclosed, except as otherwise provided by law or pursuant to written authorization.

This bill would authorize the State Department of Public Health, subject to specified provisions, and qualified entities, as defined, to share with each other health records involving the diagnosis, care, and treatment of HIV or AIDS related to a beneficiary enrolled in federal Ryan White Act funded programs who may be eligible for services under the federal Patient Protection and Affordable Care Act (PPACA), as specified. The bill would make other related changes.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

P3    1

SECTION 1.  

Section 120975 of the Health and Safety Code
2 is amended to read:

3

120975.  

To protect the privacy of individuals who are the
4subject of testing for human immunodeficiency virus (HIV), the
5following shall apply:

6Except as provided in Section 1603.1, 1603.3, or 121022, no
7person shall be compelled in any state, county, city, or other local
8civil, criminal, administrative, legislative, or other proceedings to
9identify or provide identifying characteristics that would identify
10any individual who is the subject of an HIV test, as defined in
11subdivision (c) of Section 120775.

12

SEC. 2.  

Section 121010 of the Health and Safety Code is
13amended to read:

14

121010.  

Notwithstanding Section 120975 or 120980, the results
15of an HIV test, as defined in subdivision (c) of Section 120775, to
16detect antibodies to the probable causative agent of AIDS may be
17disclosed to any of the following persons without written
18authorization of the subject of the test:

19(a) To the subject of the test or the subject’s legal representative,
20conservator, or to any person authorized to consent to the test
21pursuant to Section 120990 of this code and Section 6926 of the
22Family Code.

23(b) To a test subject’s provider of health care, as defined in
24subdivision (j) of Section 56.05 of the Civil Code, except that for
25purposes of this section, “provider of health care” does not include
26a health care service plan regulated pursuant to Chapter 2.2
27(commencing with Section 1340) of Division 2.

28(c) To an agent or employee of the test subject’s provider of
29health care who provides direct patient care and treatment.

30(d) To a provider of health care who procures, processes,
31distributes, or uses a human body part donated pursuant to the
32Uniform Anatomical Gift Act (Chapter 3.5 (commencing with
33Section 7150) of Part 1 of Division 7).

34(e) (1) To the designated officer of an emergency response
35employee, and from that designated officer to an emergency
36response employee regarding possible exposure to HIV or AIDS,
37but only to the extent necessary to comply with provisions of the
P4    1federal Ryan White Comprehensive AIDS Resources Emergency
2Act of 1990 (Public Law 101-381; 42 U.S.C. Sec. 201).

3(2) For purposes of this subdivision, “designated officer” and
4“emergency response employee” have the same meaning as these
5terms are used in the federal Ryan White Comprehensive AIDS
6Resources Emergency Act of 1990 (Public Law 101-381; 42 U.S.C.
7Sec. 201).

8(3) The designated officer shall be subject to the confidentiality
9 requirements specified in Section 120980, and may be personally
10liable for unauthorized release of any identifying information about
11the HIV results. Further, the designated officer shall inform the
12exposed emergency response employee that the employee is also
13subject to the confidentiality requirements specified in Section
14120980, and may be personally liable for unauthorized release of
15any identifying information about the HIV test results.

16

SEC. 3.  

Section 121022 of the Health and Safety Code is
17amended to read:

18

121022.  

(a) To ensure knowledge of current trends in the HIV
19epidemic and to ensure that California remains competitive for
20federal HIV and AIDS funding, health care providers and
21laboratories shall report cases of HIV infection to the local health
22officer using patient names on a form developed by the department.
23begin delete Upon request by the department, laboratories shall report cases of
24HIV infection by name directly to the department in a manner
25consistent with subdivision (g) of Section 120130, in addition to
26reports to the local health officer.end delete
begin insert Both the local health officer and
27the department shall be authorized to access end insert
begin insertreports of HIV
28infection that are electronically submitted by laboratories pursuant
29to subdivision (g) of Section 120130.end insert
Local health officers shall
30report unduplicated HIV cases by name to the department on a
31form developed by the department.

32(b) (1) Health care providers and local health officers shall
33submit cases of HIV infection pursuant to subdivision (a) by courier
34service, United States Postal Service express mail or registered
35mail, other traceable mail, person-to-person transfer, facsimile, or
36electronically by a secure and confidential electronic reporting
37system established by the department.

38(2) This subdivision shall be implemented using the existing
39resources of the department.

P5    1(c) The department and local health officers shall ensure
2continued reasonable access to anonymous HIV testing through
3alternative testing sites, as established by Section 120890, and in
4consultation with HIV planning groups and affected stakeholders,
5including representatives of persons living with HIV and health
6officers.

7(d) The department shall promulgate emergency regulations to
8conform the relevant provisions of Article 3.5 (commencing with
9Section 2641.5) of Chapter 4 of Division 1 of Title 17 of the
10California Code of Regulations, consistent with this chapter, by
11April 17, 2007. Notwithstanding the Administrative Procedure
12Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of
13Division 3 of Title 2 of the Government Code), if the department
14revises the form used for reporting pursuant to subdivision (a) after
15consideration of the reporting guidelines published by the federal
16Centers for Disease Control and Prevention, the revised form shall
17be implemented without being adopted as a regulation, and shall
18be filed with the Secretary of State and printed in Title 17 of the
19California Code of Regulations.

20(e) Pursuant to Section 121025, reported cases of HIV infection
21shall not be disclosed, discoverable, or compelled to be produced
22in any civil, criminal, administrative, or other proceeding.

23(f) State and local health department employees and contractors
24shall be required to sign confidentiality agreements developed by
25the department that include information related to the penalties for
26a breach of confidentiality and the procedures for reporting a breach
27of confidentiality, prior to accessing confidential HIV-related
28public health records. Those agreements shall be reviewed annually
29by either the department or the appropriate local health department.

30(g)  No person shall disclose identifying information reported
31pursuant to subdivision (a) to the federal government, including,
32but not limited to, any agency, employee, agent, contractor, or
33anyone else acting on behalf of the federal government, except as
34permitted under subdivision (b) of Section 121025.

35(h) (1) Any potential or actual breach of confidentiality of
36HIV-related public health records shall be investigated by the local
37health officer, in coordination with the department, when
38appropriate. The local health officer shall immediately report any
39evidence of an actual breach of confidentiality of HIV-related
P6    1public health records at a city or county level to the department
2and the appropriate law enforcement agency.

3(2) The department shall investigate any potential or actual
4breach of confidentiality of HIV-related public health records at
5the state level, and shall report any evidence of such a breach of
6confidentiality to an appropriate law enforcement agency.

7(i) Any willful, negligent, or malicious disclosure of cases of
8HIV infection reported pursuant to subdivision (a) shall be subject
9to the penalties prescribed in Section 121025.

10(j) Nothing in this section shall be construed to limit other
11remedies and protections available under state or federal law.

12

SEC. 4.  

Section 121025 of the Health and Safety Code is
13amended to read:

14

121025.  

(a) Public health records relating to human
15immunodeficiency virus (HIV) or acquired immunodeficiency
16syndrome (AIDS), containing personally identifying information,
17that were developed or acquired by a state or local public health
18agency, or an agent of that agency, shall be confidential and shall
19not be disclosed, except as otherwise provided by law for public
20health purposes or pursuant to a written authorization by the person
21who is the subject of the record or by his or her guardian or
22conservator.

23(b) In accordance with subdivision (g) of Section 121022, a
24state or local public health agency, or an agent of that agency, may
25disclose personally identifying information in public health records,
26as described in subdivision (a), to other local, state, or federal
27public health agencies or to corroborating medical researchers,
28when the confidential information is necessary to carry out the
29duties of the agency or researcher in the investigation, control, or
30surveillance of disease, as determined by the state or local public
31health agency.

32(c) Except as provided in paragraphs (1) to (3), inclusive, any
33disclosure authorized by subdivision (a) or (b) shall include only
34the information necessary for the purpose of that disclosure and
35shall be made only upon agreement that the information will be
36kept confidential and will not be further disclosed without written
37authorization, as described in subdivision (a).

38(1) Notwithstanding any other provision of law, the following
39disclosures shall be authorized for the purpose of enhancing
40completeness of HIV/AIDS, tuberculosis, and sexually transmitted
P7    1disease coinfection reporting to the federal Centers for Disease
2Control and Prevention (CDC):

3(A) The local public health agency HIV surveillance staff may
4further disclose the information to the health care provider who
5provides HIV care to the HIV-positive person who is the subject
6of the record for the purpose of assisting in compliance with
7subdivision (a) of Section 121022.

8(B) Local public health agency tuberculosis control staff may
9further disclose the information to state public health agency
10tuberculosis control staff, who may further disclose the information,
11without disclosing patient identifying information, to the CDC, to
12 the extent the information is requested by the CDC and permitted
13by subdivision (b), for purposes of the investigation, control, or
14surveillance of HIV and tuberculosis coinfections.

15(C) Local public health agency sexually transmitted disease
16control staff may further disclose the information to state public
17health agency sexually transmitted disease control staff, who may
18further disclose the information, without disclosing patient
19identifying information, to the CDC, to the extent it is requested
20by the CDC, and permitted by subdivision (b), for the purposes of
21the investigation, control, or surveillance of HIV and syphilis,
22gonorrhea, or chlamydia coinfection.

23(2) Notwithstanding any other provision of law, the following
24disclosures shall be authorized for the purpose of facilitating
25appropriate HIV/AIDS medical care and treatment:

26(A) State public health agency HIV surveillance staff, AIDS
27Drug Assistance Program staff, and care services staff may further
28disclose the information to local public health agency staff, who
29may further disclose the information to the HIV-positive person
30who is the subject of the record, or the health care provider who
31provides his or her HIV care, for the purpose of proactively offering
32and coordinating care and treatment services to him or her.

33(B) AIDS Drug Assistance Program staff and care services staff
34in the State Department of Public Health may further disclose the
35information directly to the HIV-positive person who is the subject
36of the record or the health care provider who provides his or her
37HIV care, for the purpose of proactively offering and coordinating
38care and treatment services to him or her.

39(C) Local public health agency staff may further disclose
40acquired or developed information to the HIV-positive person who
P8    1is the subject of the record or the health care provider who provides
2his or her HIV care for the purpose of proactively offering and
3coordinating care and treatment services to him or her.

4(3) Notwithstanding any other provision of law, for the purpose
5of facilitating appropriate medical care and treatment of persons
6coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or
7chlamydia, local public health agency sexually transmitted disease
8control and tuberculosis control staff may further disclose the
9information to state or local public health agency sexually
10transmitted disease control and tuberculosis control staff, the
11HIV-positive person who is the subject of the record, or the health
12care provider who provides his or her HIV, tuberculosis, and
13sexually transmitted disease care.

14(4) For the purposes of paragraphs (2) and (3), “staff” shall not
15include nongovernmental entities, but shall include state and local
16contracted employees who work within state and local public health
17departments.

18(d) No confidential public health record, as defined in
19subdivision (c) of Section 121035, shall be disclosed, discoverable,
20or compelled to be produced in any civil, criminal, administrative,
21or other proceeding.

22(e) (1) A person who negligently discloses the content of a
23confidential public health record, as defined in subdivision (c) of
24Section 121035, to any third party, except pursuant to a written
25authorization, as described in subdivision (a), or as otherwise
26authorized by law, shall be subject to a civil penalty in an amount
27not to exceed five thousand dollars ($5,000), plus court costs, as
28determined by the court, which penalty and costs shall be paid to
29the person whose record was disclosed.

30(2) Any person who willfully or maliciously discloses the
31content of any confidential public health record, as defined in
32subdivision (c) of Section 121035, to any third party, except
33pursuant to a written authorization, or as otherwise authorized by
34law, shall be subject to a civil penalty in an amount not less than
35five thousand dollars ($5,000) and not more than twenty-five
36thousand dollars ($25,000), plus court costs, as determined by the
37court, which penalty and costs shall be paid to the person whose
38confidential public health record was disclosed.

39(3) Any person who willfully, maliciously, or negligently
40discloses the content of any confidential public health record, as
P9    1defined in subdivision (c) of Section 121035, to any third party,
2except pursuant to a written authorization, or as otherwise
3authorized by law, that results in economic, bodily, or
4psychological harm to the person whose confidential public health
5record was disclosed, is guilty of a misdemeanor, punishable by
6imprisonment in a county jail for a period not to exceed one year,
7or a fine of not to exceed twenty-five thousand dollars ($25,000),
8or both, plus court costs, as determined by the court, which penalty
9and costs shall be paid to the person whose confidential public
10health record was disclosed.

11(4) Any person who commits any act described in paragraph
12(1), (2), or (3), shall be liable to the person whose confidential
13public health record was disclosed for all actual damages for
14economic, bodily, or psychological harm that is a proximate result
15of the act.

16(5) Each violation of this section is a separate and actionable
17offense.

18(6) Nothing in this section limits or expands the right of an
19injured person whose confidential public health record was
20disclosed to recover damages under any other applicable law.

21(f) In the event that a confidential public health record, as
22defined in subdivision (c) of Section 121035, is disclosed, the
23information shall not be used to determine employability, or
24insurability of any person.

25

SEC. 5.  

Section 121026 is added to the Health and Safety Code,
26to read:

27

121026.  

(a) Notwithstanding subdivision (f) of Section 120980,
28Section 121010, subdivision (g) of Section 121022, subdivision
29(f) of Section 121025, Section 121115, and Section 121280, the
30State Department of Public Health and qualified entities may share
31with each other health records involving the diagnosis, care, and
32treatment of human immunodeficiency virus (HIV) or acquired
33immunodeficiency syndrome (AIDS) related to a beneficiary
34enrolled in federal Ryan White Act funded programs who may be
35eligible for services under the federal Patient Protection and
36Affordable Care Act (Public Law 111-148), as amended by the
37Health Care and Education Reconciliation Act of 2010 (Public
38Law 111-152). The qualified entities, who shall be covered entities
39under the Health Insurance Portability and Accountability Act (42
40U.S.C. Sec. 300gg) and the final regulations issued pursuant to the
P10   1act by the United States Department of Health and Human Services
2(45 C.F.R. Parts 160 and 164), may share records only for the
3purpose of enrolling the beneficiary in Medi-Cal, the bridge
4programs, Medicaid expansion programs, and any insurance plan
5certified by the California Health Benefit Exchange established
6pursuant to Title 22 (commencing with Section 100500) of the
7Government Code, or any other programs authorized under the
8federal Patient Protection and Affordable Care Act (Public Law
9111-148), and for the purpose of continuing his or her access to
10those programs and plans without disruption.

11(b) The information provided by the State Department of Public
12Health pursuant to this section shall be limited to only the
13information necessary for the purposes of this section and shall
14not include HIV or AIDS surveillance data. This information shall
15not be further disclosed by a qualified entity, except to any or all
16of the following as necessary for the purposes of this section:

17(1) The person who is the subject of the record or to his or her
18guardian or conservator.

19(2) The provider of health care for the person with HIV or AIDS
20to whom the information pertains.

21(3) The Office of AIDS within the State Department of Public
22Health.

23(c) For purposes of this section, the following definitions shall
24apply:

25(1) “Contractor” means any person or entity that is a medical
26group, independent practice association, pharmaceutical benefits
27manager, or a medical service organization and is not a health care
28service plan or provider of health care.

29(2) “Provider of health care” means any person licensed or
30certified pursuant to Division 2 (commencing with Section 500)
31of the Business and Professions Code; any person licensed pursuant
32to the Osteopathic Initiative Act or the Chiropractic Initiative Act;
33any person certified pursuant to Division 2.5 (commencing with
34Section 1797) of the Health and Safety Code; any clinic, health
35dispensary, or health facility licensed pursuant to Division 2
36(commencing with Section 1200) of the Health and Safety Code.

37(3) “Qualified entity” means any of the following:

38(A) The State Department of Health Care Services.

P11   1(B) The California Health Benefit Exchange established pursuant
2to Title 22 (commencing with Section 100500) of the Government
3Code.

4(C) Medi-Cal managed care plans.

5(D) Health plans participating in the Bridge Program.

6(E) Health plans offered through the Exchange.

7(F) County health departments delivering HIV or AIDS health
8care services.

9(d) Notwithstanding any other law, information shared pursuant
10to this section shall not be disclosed, discoverable, or compelled
11to be produced in any civil, criminal, administrative, or other
12proceeding.

begin delete

13(e) All employees and contractors of a qualified entity who have
14legal access to confidential HIV-related medical records shall be
15required to sign confidentiality agreements pursuant to subdivision
16(f) of Section 121022.

end delete
begin delete

17(f)

end delete

18begin insert(e)end insert This section shall be implemented only to the extent
19permitted by federal law.begin delete Informationend deletebegin insert All employees and
20contractors of a qualified entity who have access to confidential
21HIV-related medical records pursuant to this section shall be
22subject to, and all informationend insert
shared pursuant to this section shall
23be protected in accordance withbegin insert,end insert the federal Health Insurance
24Portability and Accountability Act (42 U.S.C. Sec. 300gg) and the
25final regulations issued pursuant to that act by the United States
26Department of Health and Human Services (45 C.F.R. Parts 160
27and 164), the Confidentiality of Medical Information Act (Part 2.6
28(commencing with Section 56) of Division 1 of the Civil Code),
29and the Insurance Information and Privacy Protection Act (Article
306.6 (commencing with Section 791) of Part 2 of Division 1 of the
31Insurance Code).



O

    94