BILL NUMBER: SB 249 CHAPTERED
BILL TEXT
CHAPTER 445
FILED WITH SECRETARY OF STATE OCTOBER 1, 2013
APPROVED BY GOVERNOR OCTOBER 1, 2013
PASSED THE SENATE SEPTEMBER 10, 2013
PASSED THE ASSEMBLY SEPTEMBER 9, 2013
AMENDED IN ASSEMBLY SEPTEMBER 3, 2013
AMENDED IN ASSEMBLY JUNE 27, 2013
AMENDED IN ASSEMBLY JUNE 17, 2013
AMENDED IN SENATE APRIL 16, 2013
AMENDED IN SENATE APRIL 9, 2013
INTRODUCED BY Senator Leno
(Principal coauthor: Assembly Member Stone)
FEBRUARY 12, 2013
An act to amend Sections 120975, 121010, 121022, and 121025 of,
and to add Section 121026 to, the Health and Safety Code, relating to
public health.
LEGISLATIVE COUNSEL'S DIGEST
SB 249, Leno. Public health: health records: confidentiality.
Existing law requires health care providers and laboratories to
report cases of HIV infection to the local health officer using
patient names on a form developed by the State Department of Public
Health. Existing law, commencing July 1, 2009, or within one year of
the establishment of a state electronic laboratory reporting system,
whichever is later, requires a report generated pursuant to that
provision by a laboratory to be submitted electronically in a manner
specified by the department.
This bill would authorize both the local health officer and the
department to access reports of HIV infection that are electronically
submitted by laboratories pursuant to the above-described provision.
Existing law authorizes state public health agency HIV
surveillance staff, AIDS Drug Assistance Program staff, and care
services staff to disclose personally identifying information in
public health records relating to HIV or AIDS to local public health
agency staff, who may further disclose the information to the
HIV-positive person who is the subject of the record, or the health
care provider who provides that person's HIV care, for the purpose of
proactively offering and coordinating care and treatment services to
that person.
This bill would authorize local public health agency staff to
further disclose acquired or developed information to the
HIV-positive person who is the subject of the record or the health
care provider who provides that person's HIV care, for that purpose.
Existing law also provides specified health care coverage to
individuals under the AIDS Drug Assistance Program (ADAP) and under
federal Ryan White Act funded programs, which are administered by the
State Department of Public Health. Existing law, with some
exceptions, prohibits the disclosure of the results of an HIV test to
any 3rd party in a manner that identifies or provides identifying
characteristics of the person to whom the test results apply.
Existing law also provides that public health records related to HIV
or AIDS containing personal identifying information that were
developed or acquired by a state or local public agency shall be
confidential and shall not be disclosed, except as otherwise provided
by law or pursuant to written authorization.
This bill would authorize the State Department of Public Health,
subject to specified provisions, and qualified entities, as defined,
to share with each other health records involving the diagnosis,
care, and treatment of HIV or AIDS related to a beneficiary enrolled
in federal Ryan White Act funded programs who may be eligible for
services under the federal Patient Protection and Affordable Care Act
(PPACA), as specified. The bill would make other related changes.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 120975 of the Health and Safety Code is amended
to read:
120975. To protect the privacy of individuals who are the subject
of testing for human immunodeficiency virus (HIV), the following
shall apply:
Except as provided in Section 1603.1, 1603.3, or 121022, no person
shall be compelled in any state, county, city, or other local civil,
criminal, administrative, legislative, or other proceedings to
identify or provide identifying characteristics that would identify
any individual who is the subject of an HIV test, as defined in
subdivision (c) of Section 120775.
SEC. 2. Section 121010 of the Health and Safety Code is amended to
read:
121010. Notwithstanding Section 120975 or 120980, the results of
an HIV test, as defined in subdivision (c) of Section 120775, to
detect antibodies to the probable causative agent of AIDS may be
disclosed to any of the following persons without written
authorization of the subject of the test:
(a) To the subject of the test or the subject's legal
representative, conservator, or to any person authorized to consent
to the test pursuant to Section 120990 of this code and Section 6926
of the Family Code.
(b) To a test subject's provider of health care, as defined in
subdivision (j) of Section 56.05 of the Civil Code, except that for
purposes of this section, "provider of health care" does not include
a health care service plan regulated pursuant to Chapter 2.2
(commencing with Section 1340) of Division 2.
(c) To an agent or employee of the test subject's provider of
health care who provides direct patient care and treatment.
(d) To a provider of health care who procures, processes,
distributes, or uses a human body part donated pursuant to the
Uniform Anatomical Gift Act (Chapter 3.5 (commencing with Section
7150) of Part 1 of Division 7).
(e) (1) To the designated officer of an emergency response
employee, and from that designated officer to an emergency response
employee regarding possible exposure to HIV or AIDS, but only to the
extent necessary to comply with provisions of the federal Ryan White
Comprehensive AIDS Resources Emergency Act of 1990 (Public Law
101-381; 42 U.S.C. Sec. 201).
(2) For purposes of this subdivision, "designated officer" and
"emergency response employee" have the same meaning as these terms
are used in the federal Ryan White Comprehensive AIDS Resources
Emergency Act of 1990 (Public Law 101-381; 42 U.S.C. Sec. 201).
(3) The designated officer shall be subject to the confidentiality
requirements specified in Section 120980, and may be personally
liable for unauthorized release of any identifying information about
the HIV results. Further, the designated officer shall inform the
exposed emergency response employee that the employee is also subject
to the confidentiality requirements specified in Section 120980, and
may be personally liable for unauthorized release of any identifying
information about the HIV test results.
SEC. 3. Section 121022 of the Health and Safety Code is amended to
read:
121022. (a) To ensure knowledge of current trends in the HIV
epidemic and to ensure that California remains competitive for
federal HIV and AIDS funding, health care providers and laboratories
shall report cases of HIV infection to the local health officer using
patient names on a form developed by the department. Both the local
health officer and the department shall be authorized to access
reports of HIV infection that are electronically submitted by
laboratories pursuant to subdivision (g) of Section 120130. Local
health officers shall report unduplicated HIV cases by name to the
department on a form developed by the department.
(b) (1) Health care providers and local health officers shall
submit cases of HIV infection pursuant to subdivision (a) by courier
service, United States Postal Service express mail or registered
mail, other traceable mail, person-to-person transfer, facsimile, or
electronically by a secure and confidential electronic reporting
system established by the department.
(2) This subdivision shall be implemented using the existing
resources of the department.
(c) The department and local health officers shall ensure
continued reasonable access to anonymous HIV testing through
alternative testing sites, as established by Section 120890, and in
consultation with HIV planning groups and affected stakeholders,
including representatives of persons living with HIV and health
officers.
(d) The department shall promulgate emergency regulations to
conform the relevant provisions of Article 3.5 (commencing with
Section 2641.5) of Chapter 4 of Division 1 of Title 17 of the
California Code of Regulations, consistent with this chapter, by
April 17, 2007. Notwithstanding the Administrative Procedure Act
(Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3
of Title 2 of the Government Code), if the department revises the
form used for reporting pursuant to subdivision (a) after
consideration of the reporting guidelines published by the federal
Centers for Disease Control and Prevention, the revised form shall be
implemented without being adopted as a regulation, and shall be
filed with the Secretary of State and printed in Title 17 of the
California Code of Regulations.
(e) Pursuant to Section 121025, reported cases of HIV infection
shall not be disclosed, discoverable, or compelled to be produced in
any civil, criminal, administrative, or other proceeding.
(f) State and local health department employees and contractors
shall be required to sign confidentiality agreements developed by the
department that include information related to the penalties for a
breach of confidentiality and the procedures for reporting a breach
of confidentiality, prior to accessing confidential HIV-related
public health records. Those agreements shall be reviewed annually by
either the department or the appropriate local health department.
(g) No person shall disclose identifying information reported
pursuant to subdivision (a) to the federal government, including, but
not limited to, any agency, employee, agent, contractor, or anyone
else acting on behalf of the federal government, except as permitted
under subdivision (b) of Section 121025.
(h) (1) Any potential or actual breach of confidentiality of
HIV-related public health records shall be investigated by the local
health officer, in coordination with the department, when
appropriate. The local health officer shall immediately report any
evidence of an actual breach of confidentiality of HIV-related public
health records at a city or county level to the department and the
appropriate law enforcement agency.
(2) The department shall investigate any potential or actual
breach of confidentiality of HIV-related public health records at the
state level, and shall report any evidence of such a breach of
confidentiality to an appropriate law enforcement agency.
(i) Any willful, negligent, or malicious disclosure of cases of
HIV infection reported pursuant to subdivision (a) shall be subject
to the penalties prescribed in Section 121025.
(j) Nothing in this section shall be construed to limit other
remedies and protections available under state or federal law.
SEC. 4. Section 121025 of the Health and Safety Code is amended to
read:
121025. (a) Public health records relating to human
immunodeficiency virus (HIV) or acquired immunodeficiency syndrome
(AIDS), containing personally identifying information, that were
developed or acquired by a state or local public health agency, or an
agent of that agency, shall be confidential and shall not be
disclosed, except as otherwise provided by law for public health
purposes or pursuant to a written authorization by the person who is
the subject of the record or by his or her guardian or conservator.
(b) In accordance with subdivision (g) of Section 121022, a state
or local public health agency, or an agent of that agency, may
disclose personally identifying information in public health records,
as described in subdivision (a), to other local, state, or federal
public health agencies or to corroborating medical researchers, when
the confidential information is necessary to carry out the duties of
the agency or researcher in the investigation, control, or
surveillance of disease, as determined by the state or local public
health agency.
(c) Except as provided in paragraphs (1) to (3), inclusive, any
disclosure authorized by subdivision (a) or (b) shall include only
the information necessary for the purpose of that disclosure and
shall be made only upon agreement that the information will be kept
confidential and will not be further disclosed without written
authorization, as described in subdivision (a).
(1) Notwithstanding any other provision of law, the following
disclosures shall be authorized for the purpose of enhancing
completeness of HIV/AIDS, tuberculosis, and sexually transmitted
disease coinfection reporting to the federal Centers for Disease
Control and Prevention (CDC):
(A) The local public health agency HIV surveillance staff may
further disclose the information to the health care provider who
provides HIV care to the HIV-positive person who is the subject of
the record for the purpose of assisting in compliance with
subdivision (a) of Section 121022.
(B) Local public health agency tuberculosis control staff may
further disclose the information to state public health agency
tuberculosis control staff, who may further disclose the information,
without disclosing patient identifying information, to the CDC, to
the extent the information is requested by the CDC and permitted by
subdivision (b), for purposes of the investigation, control, or
surveillance of HIV and tuberculosis coinfections.
(C) Local public health agency sexually transmitted disease
control staff may further disclose the information to state public
health agency sexually transmitted disease control staff, who may
further disclose the information, without disclosing patient
identifying information, to the CDC, to the extent it is requested by
the CDC, and permitted by subdivision (b), for the purposes of the
investigation, control, or surveillance of HIV and syphilis,
gonorrhea, or chlamydia coinfection.
(2) Notwithstanding any other provision of law, the following
disclosures shall be authorized for the purpose of facilitating
appropriate HIV/AIDS medical care and treatment:
(A) State public health agency HIV surveillance staff, AIDS Drug
Assistance Program staff, and care services staff may further
disclose the information to local public health agency staff, who may
further disclose the information to the HIV-positive person who is
the subject of the record, or the health care provider who provides
his or her HIV care, for the purpose of proactively offering and
coordinating care and treatment services to him or her.
(B) AIDS Drug Assistance Program staff and care services staff in
the State Department of Public Health may further disclose the
information directly to the HIV-positive person who is the subject of
the record or the health care provider who provides his or her HIV
care, for the purpose of proactively offering and coordinating care
and treatment services to him or her.
(C) Local public health agency staff may further disclose acquired
or developed information to the HIV-positive person who is the
subject of the record or the health care provider who provides his or
her HIV care for the purpose of proactively offering and
coordinating care and treatment services to him or her.
(3) Notwithstanding any other provision of law, for the purpose of
facilitating appropriate medical care and treatment of persons
coinfected with HIV, tuberculosis, and syphilis, gonorrhea, or
chlamydia, local public health agency sexually transmitted disease
control and tuberculosis control staff may further disclose the
information to state or local public health agency sexually
transmitted disease control and tuberculosis control staff, the
HIV-positive person who is the subject of the record, or the health
care provider who provides his or her HIV, tuberculosis, and sexually
transmitted disease care.
(4) For the purposes of paragraphs (2) and (3), "staff" shall not
include nongovernmental entities, but shall include state and local
contracted employees who work within state and local public health
departments.
(d) No confidential public health record, as defined in
subdivision (c) of Section 121035, shall be disclosed, discoverable,
or compelled to be produced in any civil, criminal, administrative,
or other proceeding.
(e) (1) A person who negligently discloses the content of a
confidential public health record, as defined in subdivision (c) of
Section 121035, to any third party, except pursuant to a written
authorization, as described in subdivision (a), or as otherwise
authorized by law, shall be subject to a civil penalty in an amount
not to exceed five thousand dollars ($5,000), plus court costs, as
determined by the court, which penalty and costs shall be paid to the
person whose record was disclosed.
(2) Any person who willfully or maliciously discloses the content
of any confidential public health record, as defined in subdivision
(c) of Section 121035, to any third party, except pursuant to a
written authorization, or as otherwise authorized by law, shall be
subject to a civil penalty in an amount not less than five thousand
dollars ($5,000) and not more than twenty-five thousand dollars
($25,000), plus court costs, as determined by the court, which
penalty and costs shall be paid to the person whose confidential
public health record was disclosed.
(3) Any person who willfully, maliciously, or negligently
discloses the content of any confidential public health record, as
defined in subdivision (c) of Section 121035, to any third party,
except pursuant to a written authorization, or as otherwise
authorized by law, that results in economic, bodily, or psychological
harm to the person whose confidential public health record was
disclosed, is guilty of a misdemeanor, punishable by imprisonment in
a county jail for a period not to exceed one year, or a fine of not
to exceed twenty-five thousand dollars ($25,000), or both, plus court
costs, as determined by the court, which penalty and costs shall be
paid to the person whose confidential public health record was
disclosed.
(4) Any person who commits any act described in paragraph (1),
(2), or (3), shall be liable to the person whose confidential public
health record was disclosed for all actual damages for economic,
bodily, or psychological harm that is a proximate result of the act.
(5) Each violation of this section is a separate and actionable
offense.
(6) Nothing in this section limits or expands the right of an
injured person whose confidential public health record was disclosed
to recover damages under any other applicable law.
(f) In the event that a confidential public health record, as
defined in subdivision (c) of Section 121035, is disclosed, the
information shall not be used to determine employability, or
insurability of any person.
SEC. 5. Section 121026 is added to the Health and Safety Code, to
read:
121026. (a) Notwithstanding subdivision (f) of Section 120980,
Section 121010, subdivision (g) of Section 121022, subdivision (f) of
Section 121025, Section 121115, and Section 121280, the State
Department of Public Health and qualified entities may share with
each other health records involving the diagnosis, care, and
treatment of human immunodeficiency virus (HIV) or acquired
immunodeficiency syndrome (AIDS) related to a beneficiary enrolled in
federal Ryan White Act funded programs who may be eligible for
services under the federal Patient Protection and Affordable Care Act
(Public Law 111-148), as amended by the Health Care and Education
Reconciliation Act of 2010 (Public Law 111-152). The qualified
entities, who shall be covered entities under the Health Insurance
Portability and Accountability Act (42 U.S.C. Sec. 300gg) and the
final regulations issued pursuant to the act by the United States
Department of Health and Human Services (45 C.F.R. Parts 160 and
164), may share records only for the purpose of enrolling the
beneficiary in Medi-Cal, the bridge programs, Medicaid expansion
programs, and any insurance plan certified by the California Health
Benefit Exchange established pursuant to Title 22 (commencing with
Section 100500) of the Government Code, or any other programs
authorized under the federal Patient Protection and Affordable Care
Act (Public Law 111-148), and for the purpose of continuing his or
her access to those programs and plans without disruption.
(b) The information provided by the State Department of Public
Health pursuant to this section shall be limited to only the
information necessary for the purposes of this section and shall not
include HIV or AIDS surveillance data. This information shall not be
further disclosed by a qualified entity, except to any or all of the
following as necessary for the purposes of this section:
(1) The person who is the subject of the record or to his or her
guardian or conservator.
(2) The provider of health care for the person with HIV or AIDS to
whom the information pertains.
(3) The Office of AIDS within the State Department of Public
Health.
(c) For purposes of this section, the following definitions shall
apply:
(1) "Contractor" means any person or entity that is a medical
group, independent practice association, pharmaceutical benefits
manager, or a medical service organization and is not a health care
service plan or provider of health care.
(2) "Provider of health care" means any person licensed or
certified pursuant to Division 2 (commencing with Section 500) of the
Business and Professions Code; any person licensed pursuant to the
Osteopathic Initiative Act or the Chiropractic Initiative Act; any
person certified pursuant to Division 2.5 (commencing with Section
1797) of the Health and Safety Code; any clinic, health dispensary,
or health facility licensed pursuant to Division 2 (commencing with
Section 1200) of the Health and Safety Code.
(3) "Qualified entity" means any of the following:
(A) The State Department of Health Care Services.
(B) The California Health Benefit Exchange established pursuant to
Title 22 (commencing with Section 100500) of the Government Code.
(C) Medi-Cal managed care plans.
(D) Health plans participating in the Bridge Program.
(E) Health plans offered through the Exchange.
(F) County health departments delivering HIV or AIDS health care
services.
(d) Notwithstanding any other law, information shared pursuant to
this section shall not be disclosed, discoverable, or compelled to be
produced in any civil, criminal, administrative, or other
proceeding.
(e) This section shall be implemented only to the extent permitted
by federal law. All employees and contractors of a qualified entity
who have access to confidential HIV-related medical records pursuant
to this section shall be subject to, and all information shared
pursuant to this section shall be protected in accordance with, the
federal Health Insurance Portability and Accountability Act (42
U.S.C. Sec. 300gg) and the final regulations issued pursuant to that
act by the United States Department of Health and Human Services (45
C.F.R. Parts 160 and 164), the Confidentiality of Medical Information
Act (Part 2.6 (commencing with Section 56) of Division 1 of the
Civil Code), and the Insurance Information and Privacy Protection Act
(Article 6.6 (commencing with Section 791) of Part 2 of Division 1
of the Insurance Code).