BILL ANALYSIS Ó SENATE JUDICIARY COMMITTEE Senator Noreen Evans, Chair 2013-2014 Regular Session SB 249 (Leno) As Amended April 16, 2013 Hearing Date: April 30, 2013 Fiscal: Yes Urgency: No NR SUBJECT Public Health: Health Records: Confidentiality DESCRIPTION Existing law protects the privacy of individuals who are the subject of blood testing for antibodies to the human immunodeficiency virus (HIV), as specified. This bill would broaden those protections to instead protect individuals who are the subject of testing for HIV. This bill would also authorize the State Department of Public Health (DPH) to share the health records involving the diagnosis, care, and treatment of HIV or acquired immunodeficiency syndrome (AIDS) related to a beneficiary in a federal Ryan White Act-funded program(s) who may be eligible for services under the Affordable Care Act (ACA) with qualified entities, as defined. This bill would also authorize qualified entities to share these health records with the DPH for the purpose of enrollment without disruption in Medi-Cal, the bridge programs, Medicaid expansion programs, and any insurance plan certified by Covered California. This bill would additionally make technical and clarifying changes. BACKGROUND The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, guarantees privacy protection for individuals with regards to specific health information (Pub.L. 104-191, 110 Stat. 1936). Generally, protected health information (PHI) is any information held by a covered entity which concerns health (more) SB 249 (Leno) Page 2 of ? status, provision of health care, or payment for health care that can be connected to an individual. HIPAA privacy regulations require health care providers and organizations to develop and follow procedures that ensure the confidentiality and security of PHI when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting PHI, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose. California's Confidentiality of Medical Information Act (CMIA), also protects patient confidentiality and provides that medical information may not generally be disclosed by providers of health care, health care service plans, or contractors without the patient's written authorization. However, medical information may be shared with other health care professionals or facilities for the purposes of diagnosis or treatment of the patient. The federal Patient Protection and Affordable Care Act (ACA) was signed into law by President Obama in 2010. By January 1, 2014, the ACA will fundamentally change the way individuals access public health care coverage. Instead of applying for a particular health coverage program, the ACA will require a seamless approach to coverage where regardless of what coverage a person applies for, he or she will be evaluated for all programs and enrolled into the most beneficial program based on income and other criteria. First enacted in 1990, the Ryan White Program is the single largest federal program, and the third largest source of federal funding, for HIV care in the United States. The program provides care and support services to individuals and families affected by the disease, and functions as the "payer of last resort" by filling the gaps for those who have no other source of coverage or face coverage limits. (Kaiser Family Foundation, Ryan White Program Fact Sheet (2009) < http://www. kff.org/hivaids/upload /7582_05.pdf> as of April 23, 2013.) This bill would authorize the State Department of Public Health to share the records of an individual who, although enrolled in the Ryan White Program, may be eligible for services under the ACA with other health plans. This bill would also authorize qualified entities to share health records of persons diagnosed with HIV/AIDS with the DPH, for the purpose of enrollment without disruption in other plans, as specified. CHANGES TO EXISTING LAW SB 249 (Leno) Page 3 of ? 1.Existing law protects the privacy of individuals who are the subject of blood testing for antibodies to human immunodeficiency virus (HIV), as specified. (Health & Saf. Code Sec. 120975.) This bill would instead protect the privacy of individuals who are the subject of testing for HIV. 2.Existing law , the California Constitution, provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. Art. I, Sec. 1.) Existing federal law the Patient Protection and Affordable Care Act (ACA) requires every individual to be covered under minimum essential coverage, as specified, and requires every health insurance issuer offer coverage in the individual or small group markets to ensure coverage includes specified essential benefits. (Pub. Law 111-148, 124 Stat. 119.) Existing law establishes the California Health Benefits Exchange (Covered California) to facilitate the purchase of qualified health plans by qualified individuals and qualified small employers by January 1, 2014. (Gov. Code Sec. 100500.) Existing federal law , the Health Insurance Portability and Accountability Act (HIPAA), specifies privacy protections for patients' protected health information and generally provides that a covered entity, as defined, may not use or disclose protected health information, except as specified, or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.) Existing law prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient's written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.) Existing law requires health care providers and laboratories to report cases of HIV infection to the local health officer (LHO) using patient names, as specified, and requires the LHO to report unduplicated HIV cases by name to DPH. (Health & Saf. Code Sec. 121022.) SB 249 (Leno) Page 4 of ? Existing law requires health records containing personally identifying information relating to HIV or AIDS, which were developed or acquired by state or local public health agencies, to be confidential and not be disclosed, except as provided by law for public health purposes or in accordance with a written authorization by the patient, as specified. (Health & Saf. Code Sec. 121025(a).) Existing law permits the disclosure of health records related to HIV or AIDS for the purpose of facilitating appropriate medical care and treatment between various entities, including the state public health agency HIV surveillance staff, AIDS Drug Assistance Program (ADAP) staff, and care services staff. (Health & Saf. Code Sec. 121025(c).) This bill would authorize the DPH to share health records involving the diagnosis, care, and treatment of a beneficiary enrolled in federal Ryan White Act-funded programs who may be eligible for services under the ACA, with "qualified entities," as defined. This bill would permit qualified entities to share these health records with DPH for the purpose of enrollment without disruption in Medi-Cal, the bridge programs, Medicaid expansion programs, and any insurance plan certified by Covered California. This bill would provide that the sharing of the above information be limited to only that necessary for the purposes of eligibility and enrollment in the previously stated health programs, and would prohibit it from being further disclosed by a qualified entity, except to: the person who is the subject of the record, or to his or her guardian or conservator; the health care provider for the person with HIV/AIDS to whom the information pertains; or the DPH Office of AIDS (DPH/OA). This bill , consistent with existing law, would prohibit the HIV-related medical records subject to the provisions of this bill, from being disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding. This bill, consistent with existing law, would require all employees and contractors of a qualified entity who have legal access to confidential HIV-related medical records to sign confidentiality agreements related to the protection of SB 249 (Leno) Page 5 of ? confidentiality for HIV positive individuals. This bill would define the following terms: "Contractor" to mean any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. "Qualified entity" to mean Department of Health Care Services (DHCS), Covered California, Medi-Cal managed care plans, Bridge Program plans, health plans offered through the Covered California, and Department of Managed Health Care (DMHC). This bill would authorize LHO staff to disclose acquired or developed information to the HIV-positive person, or to the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to that individual. COMMENT 1.Stated need for the bill According to the author: The prohibition on disclosure of HIV information has become not only somewhat redundant because of other privacy laws that protect all medical information, but also is an impediment to HIV positive patients in transition to new health coverage systems. The restrictions cause serious problems not only for patients trying to access health care, but also providers trying to coordinate such care. At the same time, current law does not provide protections to all types of HIV tests that have been developed and are now available to consumers and health care providers. SB 249 addresses these problems by amending HIV confidentiality laws to do the following (1) allow the sharing of HIV information for a limited purpose - coordination of care during the transition to a new health care option, such as a health plan available from Covered California, or through MediCal - and (2) extend the protections that now apply to only HIV blood tests to all types of HIV tests. 2.Consistent with federal and state law privacy protections SB 249 (Leno) Page 6 of ? This bill would authorize the State Department of Public Health (DPH) to share the records of an individual who, although enrolled in the Ryan White Program, may be eligible for services under the ACA with qualified entities. "Qualified entities" would be defined as the Department of Health Care Services (DHCS), Covered California, Medi-Cal managed care plans, Bridge Program plans, health plans offered through the Covered California, and the Department of Managed Health Care (DMHC). This bill would also authorize qualified entities to share health records of persons diagnosed with HIV/AIDS with the DPH, for the purpose of enrollment without disruption in other plans, as specified. Federal and California law generally protect patient information, but allow medical information to be shared for diagnosis or treatment of a patient. California's Confidentiality of Medical Information Act (CMIA), protects patient confidentiality and provides that medical information may not generally be disclosed, but may be shared with other health care professionals or facilities for the purposes of diagnosis or treatment of the patient. HIPAA privacy regulations require health care providers and health plans to implement procedures that ensure the confidentiality of protected health information. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose. In coordinating health care, data sharing is becoming increasingly important, both in the private and public sector. Beginning next year, the Affordable Care Act (ACA) will require a seamless approach to health coverage enrollment, where regardless of what coverage a person applies for, he or she will be evaluated for all programs and enrolled into the most beneficial program based on income and other criteria. Regarding the necessity of data sharing, the author writes: Data sharing was essential to a successful transition of AIDS Drug Assistance Program (ADAP) clients to Low Income Health Programs (LIHPs) and trailer bill language (AB 1467 (Committee on Budget), 2011) was created to facilitate the sharing of data between the Department of Public Health/Office of Aids (DPH/OA) and LIHPs. Prior to the trailer bill language, DPH/OA was not able to share this data. Just as this problem needed to be fixed with LIHPs, the same problem will occur when those SB 249 (Leno) Page 7 of ? receiving ADAP move to new payers/systems of care being created under the Affordable Care Act (ACA). The timing wasn't right to address to the whole ACA transition at the time the 2011 budget trailer language was adopted, and SB 249 is now addressing these issues. This bill, consistent with federal and state law, would authorize the sharing of a patient's protected HIV health information from one public health plan to another, for the limited purpose of coordinating care during a patient's transition to a new health care option. This bill is timely, as by January of 2014, the ACA will expand the healthcare options available to all individuals, including those living with HIV and the underinsured. 3.Remedies available under existing law apply to provisions of this bill The AIDS Public Health Records Confidentiality Act (APHCA) provides that any person who negligently discloses the content of a confidential public record is subject to a civil penalty up to $5,000. Any person who willfully or maliciously discloses the content of a confidential public health record is subject to a civil penalty up to $25,000. In addition, if one of these disclosures results in economic, bodily, or psychological harm, the person who disclosed the record is guilty of a misdemeanor, which is punishable by imprisonment for up to a year, or a fine of up to $25,000, or both. (Health & Saf. Code Sec. 121025(d).) In addition, unlawful disclosures under the CMIA authorize a plaintiff to bring an action against any person or entity who has negligently released his or her confidential information or records for both nominal damages of $1,000 and the amount of actual damages. (Civ. Code Sec. 56.36(b).) The APHCA defines a "confidential public health record" as any paper of electronic record maintained by the department or a local health department or agency, or its agent that includes data or information that may directly or indirectly lead to the identification of the individual who is the subject of the record. (Health & Saf. Code Sec. 121035.) Protected health information under the CMIA is broader, as it limits disclosure of medical information held by entities outside of public agencies as well. (Civ. Code Sec. 56.05 (g).) This bill would authorize the State Department of Public Health to share the records of an individual who, although enrolled in SB 249 (Leno) Page 8 of ? the Ryan White Program may be eligible for services under the ACA with qualified entities, and authorize qualified entities to share health records of persons diagnosed with HIV/AIDS with the DPH, for a limited purpose. These records arguably fall within the definitions discussed above. Thus, the sharing of records, as would be authorized under this bill, would be subject to protections under existing law regarding unlawful disclosures of medical information under CMIA and APHCA. 4.Broadening scope of protection comports with changing technology Regarding scientific and technological advances since the existing statutes were enacted, the Conference of California Bar Associations writes: The California Legislature and courts have gone to great lengths to ensure the confidentiality of a person's HIV/AIDS status. However, Health & Safety Code Sections 120975 and 12010 currently limit their applicability to blood tests, which were the only tests available at the time the statutes were enacted in 1995. Since that time, testing has become more sophisticated and encompasses more tests than blood (e.g., HIV antibody test can be conducted with a urine or saliva sample). SB 249 would ensure that confidentiality is given to every form of test used to identify the HIV virus, ? including tests not yet developed. Support : AIDS Legal Referral Panel; AIDS Project Los Angeles; California Communities United Institute; California Primary Care Association; Community Clinic Association of Los Angeles County; National Association of Social Workers; Project Inform; Transgender Law Center Opposition : None Known HISTORY Source : Conference of California Bar Associations; L.A. Gay and Lesbian Center; San Francisco AIDS Foundation Related Pending Legislation : SB 28 (Hernandez) would require the California Major Risk Medical Insurance Program (MRMIP) to provide the Exchange with specified information of subscribers and applicants of MRMIP and the temporary high risk pool in SB 249 (Leno) Page 9 of ? order to assist the Exchange in conducting outreach to those subscribers and applicants. Prior Legislation : AB 714 (Atkins, 2012) would have required notices of health care eligibility be sent to individuals who are enrolled in, or who cease to be enrolled in, publicly-funded state health care programs. AB 714 was held on the Senate Appropriations Committee suspense file. AB 1296 (Bonilla, Ch. 641, Stats. 2011) enacted the Health Care Eligibility, Enrollment, and Retention Act and required, by January 1, 2012, the California Health and Human Services Agency, in consultation with other stakeholders, to undertake a planning process to develop plans and procedures to implement ACA. SB 1602 (Perez, Ch. 655, Stats. 2010) enacted the California Patient Protection and Affordable Care Act, contingent on the creation of the California Health Benefit Exchange. SB 900 (Steinberg, Ch. 659, Stats. 2010) established the California Health Benefit Exchange (the Exchange) within state government. Prior Vote : Senate Committee on Health (Ayes 9, Noes 0) **************