BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Noreen Evans, Chair
2013-2014 Regular Session
SB 249 (Leno)
As Amended April 16, 2013
Hearing Date: April 30, 2013
Fiscal: Yes
Urgency: No
NR
SUBJECT
Public Health: Health Records: Confidentiality
DESCRIPTION
Existing law protects the privacy of individuals who are the
subject of blood testing for antibodies to the human
immunodeficiency virus (HIV), as specified. This bill would
broaden those protections to instead protect individuals who are
the subject of testing for HIV.
This bill would also authorize the State Department of Public
Health (DPH) to share the health records involving the
diagnosis, care, and treatment of HIV or acquired
immunodeficiency syndrome (AIDS) related to a beneficiary in a
federal Ryan White Act-funded program(s) who may be eligible for
services under the Affordable Care Act (ACA) with qualified
entities, as defined. This bill would also authorize qualified
entities to share these health records with the DPH for the
purpose of enrollment without disruption in Medi-Cal, the bridge
programs, Medicaid expansion programs, and any insurance plan
certified by Covered California.
This bill would additionally make technical and clarifying
changes.
BACKGROUND
The Health Insurance Portability and Accountability Act (HIPAA),
enacted in 1996, guarantees privacy protection for individuals
with regards to specific health information (Pub.L. 104-191, 110
Stat. 1936). Generally, protected health information (PHI) is
any information held by a covered entity which concerns health
(more)
SB 249 (Leno)
Page 2 of ?
status, provision of health care, or payment for health care
that can be connected to an individual. HIPAA privacy
regulations require health care providers and organizations to
develop and follow procedures that ensure the confidentiality
and security of PHI when it is transferred, received, handled,
or shared. HIPAA further requires reasonable efforts when
using, disclosing, or requesting PHI, to limit disclosure of
that information to the minimum amount necessary to accomplish
the intended purpose. California's Confidentiality of Medical
Information Act (CMIA), also protects patient confidentiality
and provides that medical information may not generally be
disclosed by providers of health care, health care service
plans, or contractors without the patient's written
authorization. However, medical information may be shared with
other health care professionals or facilities for the purposes
of diagnosis or treatment of the patient.
The federal Patient Protection and Affordable Care Act (ACA) was
signed into law by President Obama in 2010. By January 1, 2014,
the ACA will fundamentally change the way individuals access
public health care coverage. Instead of applying for a
particular health coverage program, the ACA will require a
seamless approach to coverage where regardless of what coverage
a person applies for, he or she will be evaluated for all
programs and enrolled into the most beneficial program based on
income and other criteria.
First enacted in 1990, the Ryan White Program is the single
largest federal program, and the third largest source of federal
funding, for HIV care in the United States. The program provides
care and support services to individuals and families affected
by the disease, and functions as the "payer of last resort" by
filling the gaps for those who have no other source of coverage
or face coverage limits. (Kaiser Family Foundation, Ryan White
Program Fact Sheet (2009) < http://www. kff.org/hivaids/upload
/7582_05.pdf> as of April 23, 2013.)
This bill would authorize the State Department of Public Health
to share the records of an individual who, although enrolled in
the Ryan White Program, may be eligible for services under the
ACA with other health plans. This bill would also authorize
qualified entities to share health records of persons diagnosed
with HIV/AIDS with the DPH, for the purpose of enrollment
without disruption in other plans, as specified.
CHANGES TO EXISTING LAW
SB 249 (Leno)
Page 3 of ?
1.Existing law protects the privacy of individuals who are the
subject of blood testing for antibodies to human
immunodeficiency virus (HIV), as specified. (Health & Saf.
Code Sec. 120975.)
This bill would instead protect the privacy of individuals who
are the subject of testing for HIV.
2.Existing law , the California Constitution, provides that all
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. Art. I, Sec. 1.)
Existing federal law the Patient Protection and Affordable
Care Act (ACA) requires every individual to be covered under
minimum essential coverage, as specified, and requires every
health insurance issuer offer coverage in the individual or
small group markets to ensure coverage includes specified
essential benefits. (Pub. Law 111-148, 124 Stat. 119.)
Existing law establishes the California Health Benefits
Exchange (Covered California) to facilitate the purchase of
qualified health plans by qualified individuals and qualified
small employers by January 1, 2014. (Gov. Code Sec. 100500.)
Existing federal law , the Health Insurance Portability and
Accountability Act (HIPAA), specifies privacy protections for
patients' protected health information and generally provides
that a covered entity, as defined, may not use or disclose
protected health information, except as specified, or as
authorized by the patient in writing. (45 C.F.R. Sec. 164.500
et seq.)
Existing law prohibits, under the State Confidentiality of
Medical Information Act (CMIA), providers of health care,
health care service plans, or contractors, as defined, from
sharing medical information without the patient's written
authorization, subject to certain exceptions. (Civ. Code Sec.
56 et seq.)
Existing law requires health care providers and laboratories
to report cases of HIV infection to the local health officer
(LHO) using patient names, as specified, and requires the LHO
to report unduplicated HIV cases by name to DPH. (Health &
Saf. Code Sec. 121022.)
SB 249 (Leno)
Page 4 of ?
Existing law requires health records containing personally
identifying information relating to HIV or AIDS, which were
developed or acquired by state or local public health
agencies, to be confidential and not be disclosed, except as
provided by law for public health purposes or in accordance
with a written authorization by the patient, as specified.
(Health & Saf. Code Sec. 121025(a).)
Existing law permits the disclosure of health records related
to HIV or AIDS for the purpose of facilitating appropriate
medical care and treatment between various entities, including
the state public health agency HIV surveillance staff, AIDS
Drug Assistance Program (ADAP) staff, and care services staff.
(Health & Saf. Code Sec. 121025(c).)
This bill would authorize the DPH to share health records
involving the diagnosis, care, and treatment of a beneficiary
enrolled in federal Ryan White Act-funded programs who may be
eligible for services under the ACA, with "qualified
entities," as defined. This bill would permit qualified
entities to share these health records with DPH for the
purpose of enrollment without disruption in Medi-Cal, the
bridge programs, Medicaid expansion programs, and any
insurance plan certified by Covered California.
This bill would provide that the sharing of the above
information be limited to only that necessary for the purposes
of eligibility and enrollment in the previously stated health
programs, and would prohibit it from being further disclosed
by a qualified entity, except to:
the person who is the subject of the record, or to his
or her guardian or conservator;
the health care provider for the person with HIV/AIDS to
whom the information pertains; or
the DPH Office of AIDS (DPH/OA).
This bill , consistent with existing law, would prohibit the
HIV-related medical records subject to the provisions of this
bill, from being disclosed, discoverable, or compelled to be
produced in any civil, criminal, administrative, or other
proceeding.
This bill, consistent with existing law, would require all
employees and contractors of a qualified entity who have legal
access to confidential HIV-related medical records to sign
confidentiality agreements related to the protection of
SB 249 (Leno)
Page 5 of ?
confidentiality for HIV positive individuals.
This bill would define the following terms:
"Contractor" to mean any person or entity that is a
medical group, independent practice association,
pharmaceutical benefits manager, or a medical service
organization and is not a health care service plan or
provider of health care.
"Qualified entity" to mean Department of Health Care
Services (DHCS), Covered California, Medi-Cal managed care
plans, Bridge Program plans, health plans offered through
the Covered California, and Department of Managed Health
Care (DMHC).
This bill would authorize LHO staff to disclose acquired or
developed information to the HIV-positive person, or to the
health care provider who provides his or her HIV care, for the
purpose of proactively offering and coordinating care and
treatment services to that individual.
COMMENT
1.Stated need for the bill
According to the author:
The prohibition on disclosure of HIV information has become
not only somewhat redundant because of other privacy laws that
protect all medical information, but also is an impediment to
HIV positive patients in transition to new health coverage
systems. The restrictions cause serious problems not only for
patients trying to access health care, but also providers
trying to coordinate such care. At the same time, current law
does not provide protections to all types of HIV tests that
have been developed and are now available to consumers and
health care providers.
SB 249 addresses these problems by amending HIV
confidentiality laws to do the following (1) allow the sharing
of HIV information for a limited purpose - coordination of
care during the transition to a new health care option, such
as a health plan available from Covered California, or through
MediCal - and (2) extend the protections that now apply to
only HIV blood tests to all types of HIV tests.
2.Consistent with federal and state law privacy protections
SB 249 (Leno)
Page 6 of ?
This bill would authorize the State Department of Public Health
(DPH) to share the records of an individual who, although
enrolled in the Ryan White Program, may be eligible for services
under the ACA with qualified entities. "Qualified entities"
would be defined as the Department of Health Care Services
(DHCS), Covered California, Medi-Cal managed care plans, Bridge
Program plans, health plans offered through the Covered
California, and the Department of Managed Health Care (DMHC).
This bill would also authorize qualified entities to share
health records of persons diagnosed with HIV/AIDS with the DPH,
for the purpose of enrollment without disruption in other plans,
as specified.
Federal and California law generally protect patient
information, but allow medical information to be shared for
diagnosis or treatment of a patient. California's
Confidentiality of Medical Information Act (CMIA), protects
patient confidentiality and provides that medical information
may not generally be disclosed, but may be shared with other
health care professionals or facilities for the purposes of
diagnosis or treatment of the patient. HIPAA privacy
regulations require health care providers and health plans to
implement procedures that ensure the confidentiality of
protected health information. HIPAA further requires reasonable
efforts when using, disclosing, or requesting protected health
information, to limit disclosure of that information to the
minimum amount necessary to accomplish the intended purpose.
In coordinating health care, data sharing is becoming
increasingly important, both in the private and public sector.
Beginning next year, the Affordable Care Act (ACA) will require
a seamless approach to health coverage enrollment, where
regardless of what coverage a person applies for, he or she will
be evaluated for all programs and enrolled into the most
beneficial program based on income and other criteria. Regarding
the necessity of data sharing, the author writes:
Data sharing was essential to a successful transition of AIDS
Drug Assistance Program (ADAP) clients to Low Income Health
Programs (LIHPs) and trailer bill language (AB 1467 (Committee
on Budget), 2011) was created to facilitate the sharing of
data between the Department of Public Health/Office of Aids
(DPH/OA) and LIHPs. Prior to the trailer bill language, DPH/OA
was not able to share this data. Just as this problem needed
to be fixed with LIHPs, the same problem will occur when those
SB 249 (Leno)
Page 7 of ?
receiving ADAP move to new payers/systems of care being
created under the Affordable Care Act (ACA). The timing wasn't
right to address to the whole ACA transition at the time the
2011 budget trailer language was adopted, and SB 249 is now
addressing these issues.
This bill, consistent with federal and state law, would
authorize the sharing of a patient's protected HIV health
information from one public health plan to another, for the
limited purpose of coordinating care during a patient's
transition to a new health care option. This bill is timely, as
by January of 2014, the ACA will expand the healthcare options
available to all individuals, including those living with HIV
and the underinsured.
3.Remedies available under existing law apply to provisions of
this bill
The AIDS Public Health Records Confidentiality Act (APHCA)
provides that any person who negligently discloses the content
of a confidential public record is subject to a civil penalty up
to $5,000. Any person who willfully or maliciously discloses
the content of a confidential public health record is subject to
a civil penalty up to $25,000. In addition, if one of these
disclosures results in economic, bodily, or psychological harm,
the person who disclosed the record is guilty of a misdemeanor,
which is punishable by imprisonment for up to a year, or a fine
of up to $25,000, or both. (Health & Saf. Code Sec. 121025(d).)
In addition, unlawful disclosures under the CMIA authorize a
plaintiff to bring an action against any person or entity who
has negligently released his or her confidential information or
records for both nominal damages of $1,000 and the amount of
actual damages. (Civ. Code Sec. 56.36(b).)
The APHCA defines a "confidential public health record" as any
paper of electronic record maintained by the department or a
local health department or agency, or its agent that includes
data or information that may directly or indirectly lead to the
identification of the individual who is the subject of the
record. (Health & Saf. Code Sec. 121035.) Protected health
information under the CMIA is broader, as it limits disclosure
of medical information held by entities outside of public
agencies as well. (Civ. Code Sec. 56.05 (g).)
This bill would authorize the State Department of Public Health
to share the records of an individual who, although enrolled in
SB 249 (Leno)
Page 8 of ?
the Ryan White Program may be eligible for services under the
ACA with qualified entities, and authorize qualified entities to
share health records of persons diagnosed with HIV/AIDS with the
DPH, for a limited purpose. These records arguably fall within
the definitions discussed above. Thus, the sharing of records,
as would be authorized under this bill, would be subject to
protections under existing law regarding unlawful disclosures of
medical information under CMIA and APHCA.
4.Broadening scope of protection comports with changing
technology
Regarding scientific and technological advances since the
existing statutes were enacted, the Conference of California Bar
Associations writes:
The California Legislature and courts have gone to great
lengths to ensure the confidentiality of a person's HIV/AIDS
status. However, Health & Safety Code Sections 120975 and
12010 currently limit their applicability to blood tests,
which were the only tests available at the time the statutes
were enacted in 1995. Since that time, testing has become
more sophisticated and encompasses more tests than blood
(e.g., HIV antibody test can be conducted with a urine or
saliva sample). SB 249 would ensure that confidentiality is
given to every form of test used to identify the HIV virus, ?
including tests not yet developed.
Support : AIDS Legal Referral Panel; AIDS Project Los Angeles;
California Communities United Institute; California Primary Care
Association; Community Clinic Association of Los Angeles County;
National Association of Social Workers; Project Inform;
Transgender Law Center
Opposition : None Known
HISTORY
Source : Conference of California Bar Associations; L.A. Gay and
Lesbian Center; San Francisco AIDS Foundation
Related Pending Legislation : SB 28 (Hernandez) would require
the California Major Risk Medical Insurance Program (MRMIP) to
provide the Exchange with specified information of subscribers
and applicants of MRMIP and the temporary high risk pool in
SB 249 (Leno)
Page 9 of ?
order to assist the Exchange in conducting outreach to those
subscribers and applicants.
Prior Legislation :
AB 714 (Atkins, 2012) would have required notices of health care
eligibility be sent to individuals who are enrolled in, or who
cease to be enrolled in, publicly-funded state health care
programs. AB 714 was held on the Senate Appropriations Committee
suspense file.
AB 1296 (Bonilla, Ch. 641, Stats. 2011) enacted the Health Care
Eligibility, Enrollment, and Retention Act and required, by
January 1, 2012, the California Health and Human Services
Agency, in consultation with other stakeholders, to undertake a
planning process to develop plans and procedures to implement
ACA.
SB 1602 (Perez, Ch. 655, Stats. 2010) enacted the California
Patient Protection and Affordable Care Act, contingent on the
creation of the California Health Benefit Exchange.
SB 900 (Steinberg, Ch. 659, Stats. 2010) established the
California Health Benefit Exchange (the Exchange) within state
government.
Prior Vote : Senate Committee on Health (Ayes 9, Noes 0)
**************