BILL ANALYSIS                                                                                                                                                                                                    Ó






                             SENATE JUDICIARY COMMITTEE
                             Senator Noreen Evans, Chair
                              2013-2014 Regular Session


          SB 249 (Leno)
          As Amended April 16, 2013
          Hearing Date: April 30, 2013
          Fiscal: Yes
          Urgency: No
          NR

                                        SUBJECT
                                           
                   Public Health: Health Records: Confidentiality

                                      DESCRIPTION  

          Existing law protects the privacy of individuals who are the  
          subject of blood testing for antibodies to the human  
          immunodeficiency virus (HIV), as specified.  This bill would  
          broaden those protections to instead protect individuals who are  
          the subject of testing for HIV. 

          This bill would also authorize the State Department of Public  
          Health (DPH) to share the health records involving the  
          diagnosis, care, and treatment of HIV or acquired  
          immunodeficiency syndrome (AIDS) related to a beneficiary in a  
          federal Ryan White Act-funded program(s) who may be eligible for  
          services under the Affordable Care Act (ACA) with qualified  
          entities, as defined.   This bill would also authorize qualified  
          entities to share these health records with the DPH for the  
          purpose of enrollment without disruption in Medi-Cal, the bridge  
          programs, Medicaid expansion programs, and any insurance plan  
          certified by Covered California. 

          This bill would additionally make technical and clarifying  
          changes.

                                      BACKGROUND  

          The Health Insurance Portability and Accountability Act (HIPAA),  
          enacted in 1996, guarantees privacy protection for individuals  
          with regards to specific health information (Pub.L. 104-191, 110  
          Stat. 1936).  Generally, protected health information (PHI) is  
          any information held by a covered entity which concerns health  
                                                                (more)



          SB 249 (Leno)
          Page 2 of ?



          status, provision of health care, or payment for health care  
          that can be connected to an individual. HIPAA privacy  
          regulations require health care providers and organizations to  
          develop and follow procedures that ensure the confidentiality  
          and security of PHI when it is transferred, received, handled,  
          or shared.  HIPAA further requires reasonable efforts when  
          using, disclosing, or requesting PHI, to limit disclosure of  
          that information to the minimum amount necessary to accomplish  
          the intended purpose.  California's Confidentiality of Medical  
          Information Act (CMIA), also protects patient confidentiality  
          and provides that medical information may not generally be  
          disclosed by providers of health care, health care service  
          plans, or contractors without the patient's written  
          authorization.  However, medical information may be shared with  
          other health care professionals or facilities for the purposes  
          of diagnosis or treatment of the patient.

          The federal Patient Protection and Affordable Care Act (ACA) was  
          signed into law by President Obama in 2010.  By January 1, 2014,  
          the ACA will fundamentally change the way individuals access  
          public health care coverage.  Instead of applying for a  
          particular health coverage program, the ACA will require a  
          seamless approach to coverage where regardless of what coverage  
          a person applies for, he or she will be evaluated for all  
          programs and enrolled into the most beneficial program based on  
          income and other criteria.  

          First enacted in 1990, the Ryan White Program is the single  
          largest federal program, and the third largest source of federal  
          funding, for HIV care in the United States. The program provides  
          care and support services to individuals and families affected  
          by the disease, and functions as the "payer of last resort" by  
          filling the gaps for those who have no other source of coverage  
          or face coverage limits. (Kaiser Family Foundation, Ryan White  
          Program Fact Sheet (2009) < http://www. kff.org/hivaids/upload  
          /7582_05.pdf> as of April 23, 2013.) 

          This bill would authorize the State Department of Public Health  
          to share the records of an individual who, although enrolled in  
          the Ryan White Program, may be eligible for services under the  
          ACA with other health plans.  This bill would also authorize  
          qualified entities to share health records of persons diagnosed  
          with HIV/AIDS with the DPH, for the purpose of enrollment  
          without disruption in other plans, as specified. 

                                CHANGES TO EXISTING LAW
                                                                      



          SB 249 (Leno)
          Page 3 of ?



           
          1.Existing law  protects the privacy of individuals who are the  
            subject of blood testing for antibodies to human  
            immunodeficiency virus (HIV), as specified.  (Health & Saf.  
            Code Sec. 120975.)
           
            This bill  would instead protect the privacy of individuals who  
            are the subject of testing for HIV.  
           
          2.Existing law  , the California Constitution, provides that all  
            people have inalienable rights, including the right to pursue  
            and obtain privacy.  (Cal. Const. Art. I, Sec. 1.)
           
            Existing federal law  the Patient Protection and Affordable  
            Care Act (ACA) requires every individual to be covered under  
            minimum essential coverage, as specified, and requires every  
            health insurance issuer offer coverage in the individual or  
            small group markets to ensure coverage includes specified  
            essential benefits.  (Pub. Law 111-148, 124 Stat. 119.)

             Existing law  establishes the California Health Benefits  
            Exchange (Covered California) to facilitate the purchase of  
            qualified health plans by qualified individuals and qualified  
            small employers by January 1, 2014. (Gov. Code Sec. 100500.)

             Existing federal law  , the Health Insurance Portability and  
            Accountability Act (HIPAA), specifies privacy protections for  
            patients' protected health information and generally provides  
            that a covered entity, as defined, may not use or disclose  
            protected health information, except as specified, or as  
            authorized by the patient in writing.  (45 C.F.R. Sec. 164.500  
            et seq.)  

             Existing law  prohibits, under the State Confidentiality of  
            Medical Information Act (CMIA), providers of health care,  
            health care service plans, or contractors, as defined, from  
            sharing medical information without the patient's written  
            authorization, subject to certain exceptions.  (Civ. Code Sec.  
            56 et seq.) 

             Existing law  requires health care providers and laboratories  
            to report cases of HIV infection to the local health officer  
            (LHO) using patient names, as specified, and  requires the LHO  
            to report unduplicated HIV cases by name to DPH.  (Health &  
            Saf. Code Sec. 121022.)

                                                                      



          SB 249 (Leno)
          Page 4 of ?



             Existing law  requires health records containing personally  
            identifying information relating to HIV or AIDS, which were  
            developed or acquired by state or local public health  
            agencies, to be confidential and not be disclosed, except as  
            provided by law for public health purposes or in accordance  
            with a written authorization by the patient, as specified.  
            (Health & Saf. Code Sec. 121025(a).)

             Existing law  permits the disclosure of health records related  
            to HIV or AIDS for the purpose of facilitating appropriate  
            medical care and treatment between various entities, including  
            the state public health agency HIV surveillance staff, AIDS  
            Drug Assistance Program (ADAP) staff, and care services staff.  
            (Health & Saf. Code Sec. 121025(c).)

             This bill  would authorize the DPH to share health records  
            involving the diagnosis, care, and treatment of a beneficiary  
            enrolled in federal Ryan White Act-funded programs who may be  
            eligible for services under the ACA, with "qualified  
            entities," as defined.  This bill would permit qualified  
            entities to share these health records with DPH for the  
            purpose of enrollment without disruption in Medi-Cal, the  
            bridge programs, Medicaid expansion programs, and any  
            insurance plan certified by Covered California.

             This bill  would provide that the sharing of the above  
            information be limited to only that necessary for the purposes  
            of eligibility and enrollment in the previously stated health  
            programs, and would prohibit it from being further disclosed  
            by a qualified entity, except to:
                 the person who is the subject of the record, or to his  
               or her guardian or conservator;
                 the health care provider for the person with HIV/AIDS to  
               whom the information pertains; or
                 the DPH Office of AIDS (DPH/OA).

             This bill  , consistent with existing law, would prohibit the  
            HIV-related medical records subject to the provisions of this  
            bill, from being disclosed, discoverable, or compelled to be  
            produced in any civil, criminal, administrative, or other  
            proceeding.

             This bill,  consistent with existing law, would require all  
            employees and contractors of a qualified entity who have legal  
            access to confidential HIV-related medical records to sign  
            confidentiality agreements related to the protection of  
                                                                      



          SB 249 (Leno)
          Page 5 of ?



            confidentiality for HIV positive individuals.

             This bill  would define the following terms: 
                 "Contractor" to mean any person or entity that is a  
               medical group, independent practice association,  
               pharmaceutical benefits manager, or a medical service  
               organization and is not a health care service plan or  
               provider of health care. 
                  "Qualified entity" to mean Department of Health Care  
               Services (DHCS), Covered California, Medi-Cal managed care  
               plans, Bridge Program plans, health plans offered through  
               the Covered California, and Department of Managed Health  
               Care (DMHC).

            This bill  would authorize LHO staff to disclose acquired or  
            developed information to the HIV-positive person, or to the  
            health care provider who provides his or her HIV care, for the  
            purpose of proactively offering and coordinating care and  
            treatment services to that individual.

                                        COMMENT
           
           1.Stated need for the bill
           
          According to the author:

            The prohibition on disclosure of HIV information has become  
            not only somewhat redundant because of other privacy laws that  
            protect all medical information, but also is an impediment to  
            HIV positive patients in transition to new health coverage  
            systems.  The restrictions cause serious problems not only for  
            patients trying to access health care, but also providers  
            trying to coordinate such care.  At the same time, current law  
            does not provide protections to all types of HIV tests that  
            have been developed and are now available to consumers and  
            health care providers.

            SB 249 addresses these problems by amending HIV  
            confidentiality laws to do the following (1) allow the sharing  
            of HIV information for a limited purpose - coordination of  
            care during the transition to a new health care option, such  
            as a health plan available from Covered California, or through  
            MediCal - and (2) extend the protections that now apply to  
            only HIV blood tests to all types of HIV tests.

           2.Consistent with federal and state law privacy protections
                                                                      



          SB 249 (Leno)
          Page 6 of ?




           This bill would authorize the State Department of Public Health  
          (DPH) to share the records of an individual who, although  
          enrolled in the Ryan White Program, may be eligible for services  
          under the ACA with qualified entities.  "Qualified entities"  
          would be defined as the Department of Health Care Services  
          (DHCS), Covered California, Medi-Cal managed care plans, Bridge  
          Program plans, health plans offered through the Covered  
          California, and the Department of Managed Health Care (DMHC).   
          This bill would also authorize qualified entities to share  
          health records of persons diagnosed with HIV/AIDS with the DPH,  
          for the purpose of enrollment without disruption in other plans,  
          as specified.
           
           Federal and California law generally protect patient  
          information, but allow medical information to be shared for  
          diagnosis or treatment of a patient.  California's  
          Confidentiality of Medical Information Act (CMIA), protects  
          patient confidentiality and provides that medical information  
          may not generally be disclosed, but may be shared with other  
          health care professionals or facilities for the purposes of  
          diagnosis or treatment of the patient.  HIPAA privacy  
          regulations require health care providers and health plans to  
          implement procedures that ensure the confidentiality of  
          protected health information.  HIPAA further requires reasonable  
          efforts when using, disclosing, or requesting protected health  
          information, to limit disclosure of that information to the  
          minimum amount necessary to accomplish the intended purpose.  
           
           In coordinating health care, data sharing is becoming  
          increasingly important, both in the private and public sector.   
          Beginning next year, the Affordable Care Act (ACA) will require  
          a seamless approach to health coverage enrollment, where  
          regardless of what coverage a person applies for, he or she will  
          be evaluated for all programs and enrolled into the most  
          beneficial program based on income and other criteria. Regarding  
          the necessity of data sharing, the author writes: 

            Data sharing was essential to a successful transition of AIDS  
            Drug Assistance Program (ADAP) clients to Low Income Health  
            Programs (LIHPs) and trailer bill language (AB 1467 (Committee  
            on Budget), 2011) was created to facilitate the sharing of  
            data between the Department of Public Health/Office of Aids  
            (DPH/OA) and LIHPs. Prior to the trailer bill language, DPH/OA  
            was not able to share this data.  Just as this problem needed  
            to be fixed with LIHPs, the same problem will occur when those  
                                                                      



          SB 249 (Leno)
          Page 7 of ?



            receiving ADAP move to new payers/systems of care being  
            created under the Affordable Care Act (ACA). The timing wasn't  
            right to address to the whole ACA transition at the time the  
            2011 budget trailer language was adopted, and SB 249 is now  
            addressing these issues.
           
           This bill, consistent with federal and state law, would  
          authorize the sharing of a patient's protected HIV health  
          information from one public health plan to another, for the  
          limited purpose of coordinating care during a patient's  
          transition to a new health care option.  This bill is timely, as  
          by January of 2014, the ACA will expand the healthcare options  
          available to all individuals, including those living with HIV  
          and the underinsured.  
           
          3.Remedies available under existing law apply to provisions of  
            this bill

           The AIDS Public Health Records Confidentiality Act (APHCA)  
          provides that any person who negligently discloses the content  
          of a confidential public record is subject to a civil penalty up  
          to $5,000.  Any person who willfully or maliciously discloses  
          the content of a confidential public health record is subject to  
          a civil penalty up to $25,000.  In addition, if one of these  
          disclosures results in economic, bodily, or psychological harm,  
          the person who disclosed the record is guilty of a misdemeanor,  
          which is punishable by imprisonment for up to a year, or a fine  
          of up to $25,000, or both.  (Health & Saf. Code Sec. 121025(d).)  
          In addition, unlawful disclosures under the CMIA authorize a  
          plaintiff to bring an action against any person or entity who  
          has negligently released his or her confidential information or  
          records for both nominal damages of $1,000 and the amount of  
          actual damages.  (Civ. Code Sec. 56.36(b).)

          The APHCA defines a "confidential public health record" as any  
          paper of electronic record maintained by the department or a  
          local health department or agency, or its agent that includes  
          data or information that may directly or indirectly lead to the  
          identification of the individual who is the subject of the  
          record. (Health & Saf. Code Sec. 121035.)  Protected health  
          information under the CMIA is broader, as it limits disclosure  
          of medical information held by entities outside of public  
          agencies as well.  (Civ. Code Sec. 56.05 (g).)

          This bill would authorize the State Department of Public Health  
          to share the records of an individual who, although enrolled in  
                                                                      



          SB 249 (Leno)
          Page 8 of ?



          the Ryan White Program may be eligible for services under the  
          ACA with qualified entities, and authorize qualified entities to  
          share health records of persons diagnosed with HIV/AIDS with the  
          DPH, for a limited purpose.  These records arguably fall within  
          the definitions discussed above.  Thus, the sharing of records,  
          as would be authorized under this bill, would be subject to  
          protections under existing law regarding unlawful disclosures of  
          medical information under CMIA and APHCA.  
           
           4.Broadening scope of protection comports with changing  
            technology
           
          Regarding scientific and technological advances since the  
          existing statutes were enacted, the Conference of California Bar  
          Associations writes:

            The California Legislature and courts have gone to great  
            lengths to ensure the confidentiality of a person's HIV/AIDS  
            status.  However, Health & Safety Code Sections 120975 and  
            12010 currently limit their applicability to blood tests,  
            which were the only tests available at the time the statutes  
            were enacted in 1995.  Since that time, testing has become  
            more sophisticated and encompasses more tests than blood  
            (e.g., HIV antibody test can be conducted with a urine or  
            saliva sample).  SB 249 would ensure that confidentiality is  
            given to every form of test used to identify the HIV virus, ?  
            including tests not yet developed. 


           Support  :  AIDS Legal Referral Panel; AIDS Project Los Angeles;  
          California Communities United Institute; California Primary Care  
          Association; Community Clinic Association of Los Angeles County;  
          National Association of Social Workers; Project Inform;  
          Transgender Law Center                                      

           Opposition  :  None Known

                                        HISTORY
           
           Source  :  Conference of California Bar Associations; L.A. Gay and  
          Lesbian Center; San Francisco AIDS Foundation

           Related Pending Legislation  :  SB 28 (Hernandez) would require  
          the California Major Risk Medical Insurance Program (MRMIP) to  
          provide the Exchange with specified information of subscribers  
          and applicants of MRMIP and the temporary high risk pool in  
                                                                      



          SB 249 (Leno)
          Page 9 of ?



          order to assist the Exchange in conducting outreach to those  
          subscribers and applicants.

           Prior Legislation  :

          AB 714 (Atkins, 2012) would have required notices of health care  
          eligibility be sent to individuals who are enrolled in, or who  
          cease to be enrolled in, publicly-funded state health care  
          programs. AB 714 was held on the Senate Appropriations Committee  
          suspense file.

          AB 1296 (Bonilla, Ch. 641, Stats. 2011) enacted the Health Care  
          Eligibility, Enrollment, and Retention Act and required, by  
          January 1, 2012, the California Health and Human Services  
          Agency, in consultation with other stakeholders, to undertake a  
          planning process to develop plans and procedures to implement  
          ACA.

          SB 1602 (Perez, Ch. 655, Stats. 2010) enacted the California  
          Patient Protection and Affordable Care Act, contingent on the  
          creation of the California Health Benefit Exchange.

          SB 900 (Steinberg, Ch. 659, Stats. 2010) established the  
          California Health Benefit Exchange (the Exchange) within state  
          government.

           Prior Vote  :  Senate Committee on Health (Ayes 9, Noes 0)

                                   **************