BILL ANALYSIS Ó
SB 249
Page 1
Date of Hearing: July 2, 2013
ASSEMBLY COMMITTEE ON JUDICIARY
Bob Wieckowski, Chair
SB 249 (Leno) - As Amended: June 27, 2013
PROPOSED CONSENT
SENATE VOTE : 39-0
SUBJECT : PUBLIC HEALTH: HEALTH RECORDS: CONFIDENTIALITY
KEY ISSUE : SHOULD THE DEPARTMENT OF PUBLIC HEALTH AND OTHER
QUALIFIED ENTITIES BE AUTHORIZED TO SHARE WITH EACH OTHER
SENSITIVE HIV- OR AIDS-RELATED HEALTH INFORMATION OF CERTAIN
BENEFICIARIES FOR THE LIMITED PURPOSE OF ENSURING THEIR SMOOTH
TRANSITION TO NEW HEALTH CARE COVERAGE OPTIONS MADE AVAILABLE BY
THE FEDERAL AFFORDABLE CARE ACT?
FISCAL EFFECT : As currently in print this bill is keyed fiscal.
SYNOPSIS
This laudable bill seeks to update California health privacy law
to ensure that providers are able to coordinate care for AIDS
and HIV patients while continuing to protect the confidentiality
of sensitive medical information. Implementation of the federal
Affordable Care Act (ACA) in California will necessitate the
transition of many persons living with AIDS/HIV to new coverage
options for their health care. Current health privacy law,
however, prohibits any sharing of HIV information by health
officials except in extremely limited circumstances. According
to the author, this prohibition is not only duplicative of the
protections provided under federal law, but it is also an
impediment to individuals enrolled in federal Ryan White
Act-funded services, who must transition to new health coverage
systems under recent changes to health care law. Accordingly,
this bill seeks to authorize limited sharing of sensitive HIV-
and AIDS-related health records between the Department of Public
Health, the new California health benefit exchange (known as
Covered California), and other specified "qualified entities"
for the purpose of enrolling persons in coverage options
authorized under the ACA while ensuring uninterrupted HIV care
for beneficiaries of RWA-funded programs. In addition, this
bill also extends confidentiality protections to all forms of
SB 249
Page 2
HIV testing- protections which, for historic reasons, only
currently apply to HIV blood testing. This bill is co-sponsored
by the California Conference of Bar Associations and three HIV
advocacy groups, and enjoys support from several other groups
that advocate for people living with HIV/AIDS. This bill did
not receive a single "No" vote in the Senate, and has no known
opposition.
SUMMARY : Authorizes limited sharing of a beneficiary's HIV- and
AIDS-related health records between the Department of Public
Health (DPH) and other qualified entities for the purpose of
enrolling the beneficiary in coverage options authorized under
the federal Affordable Care Act (ACA) without causing any
interruption in health care coverage. Specifically, this bill :
1) Authorizes DPH and qualified entities, as defined, to
share with each other health records involving the
diagnosis, care, and treatment of HIV or AIDS related to a
beneficiary enrolled in federal Ryan White Act (RWA) funded
programs who may be eligible for services under the ACA.
2) Authorizes qualified entities who are covered entities
under the Health Insurance Portability and Accountability
Act (HIPAA), as specified, to share records only for the
purpose of enrolling the beneficiary in Medi-Cal, the
Bridge Programs, Medicaid expansion programs, and any
insurance plan certified by the California Health Benefit
Exchange (Exchange) or any other program under the ACA, as
specified, and for the purpose of continuing access to
these programs and plans without disruption.
3) Requires the information provided by DPH to be limited
only to the information necessary for the provisions in 1)
and 2) above, and excludes HIV or AIDS surveillance data.
Prohibits the further disclosure by any qualified entity,
except to any of the following, as necessary:
a) The person who is the subject of the record or to his or
her guardian or conservator;
b) The provider of health care for the person with HIV or
AIDS to whom the information pertains; or,
SB 249
Page 3
c) The Office of AIDS (OA) within DPH.
4) Defines "qualified entity" to mean any of the
following: the Department of Health Care Services (DHCS);
the Exchange; Medi-Cal managed care plans; health plans
participating in the Bridge Program; health plans offered
through the Exchange; or county health departments
delivering HIV or AIDS health care services.
5) Prohibits the disclosure, discovery, or compelling the
production of the shared information in any civil,
criminal, administrative, or other proceeding.
6) Requires all employees and contractors of a qualified
entity who have legal access to confidential HIV-related
medical records to sign confidentiality agreements, as
specified.
7) Provides that the above provisions are to be implemented
only to the extent permitted pursuant to federal law, and
information shared pursuant to this bill shall be protected
under HIPAA, the Confidentiality of Medical Information
Act, and the Insurance Information and Privacy Protection
Act.
8)Requires laboratories, upon request by DPH, to report cases of
HIV infection by name directly to DPH in accordance with
existing requirements, in addition to reports to the local
health officer (LHO).
9)Extends privacy protections that currently apply to HIV blood
tests to all types of HIV tests.
EXISTING FEDERAL LAW :
1)Pursuant to the Patient Protection and Affordable Care Act
(ACA), requires every individual to be covered under minimum
essential coverage, as specified, and requires every health
SB 249
Page 4
insurance issuer to offer coverage in the individual or small
group markets to ensure coverage includes specified essential
benefits. (Pub. Law 111-148, 124 Stat. 119.)
2)Pursuant to the Health Insurance Portability and
Accountability Act (HIPAA), specifies privacy protections for
patients' protected health information and generally provides
that a covered entity, as defined, may not use or disclose
protected health information, except as specified, or as
authorized by the patient in writing. (45 C.F.R. Sec. 164.500
et seq.)
EXISTING CALIFORNIA LAW :
1)Protects the privacy of individuals who are the subject of
blood testing for antibodies to human immunodeficiency virus
(HIV), as specified. (Health & Safety Code Section 120975.)
2)Establishes the California Health Benefits Exchange ("Covered
California") to facilitate the purchase of qualified health
plans by qualified individuals and qualified small employers
by January 1, 2014. (Government Code Section 100500.)
3)Pursuant to the State Confidentiality of Medical Information
Act (CMIA), prohibits providers of health care, health care
service plans, or contractors, as defined, from sharing
medical information without the patient's written
authorization, subject to certain exceptions. (Civil Code
Section 56 et seq.)
4)Requires health care providers and laboratories to report
cases of HIV infection to the local health officer (LHO) using
patient names, as specified, and requires the LHO to report
unduplicated HIV cases by name to DPH. (Health & Safety Code
Section 121022.)
5)Requires health records containing personally identifying
information relating to HIV or AIDS, which were developed or
acquired by state or local public health agencies, to be
confidential and not be disclosed, except as provided by law
for public health purposes or in accordance with a written
authorization by the patient, as specified. (Health & Safety
Code Section 121025(a).)
6)Permits the disclosure of health records related to HIV and
SB 249
Page 5
AIDS by local public health agency HIV surveillance staff to a
health care provider providing HIV care to the person who is
the subject of the record, for the purpose of enhancing
completeness of coinfection reporting to the federal Centers
for Disease Control and Prevention (CDC). (Health & Safety
Code Section 121025(c)(1).)
7)Permits the disclosure of health records related to HIV or
AIDS for the purpose of facilitating appropriate medical care
and treatment between various entities, including the state
public health agency HIV surveillance staff, AIDS Drug
Assistance Program (ADAP) staff, and care services staff.
(Health & Safety Code Section 121025(c)(2).)
COMMENTS : This bill seeks to update California health privacy
law to ensure that providers are able to coordinate care for
AIDS and HIV patients while continuing to protect the
confidentiality of sensitive medical information. In addition,
this bill also extends confidentiality protections to all forms
of HIV testing-important protections which, for historic
reasons, only currently apply to HIV blood testing.
Need for the Bill . This bill is co-sponsored by the California
Conference of Bar Associations (CCBA), San Francisco AIDS
Foundation, L.A. Gay & Lesbian Center, and AIDS Legal Referral
Panel. According to the author and proponents:
Current law prohibits any sharing of HIV information by
public health authorities, even at the request of the
HIV-positive patient, except in extremely limited
circumstances. This prohibition is not only duplicative
of the protections provided under other law, such as
HIPAA, but it is also an impediment to individuals
enrolled in federal Ryan White Act-funded services, who
must transition to new health coverage systems under
recent changes to health care law. The current
restrictions on sharing of HIV information also cause
serious problems for both patients trying to access
health care and providers who are trying to coordinate
such care. SB 249 addresses these concerns by permitting
the sharing of HIV information for the limited purpose of
coordination of care during the transition to a new
health care option, such as a health plan available from
Covered California or through MediCal.
SB 249
Page 6
To further illustrate the need for this bill, the author and the
sponsors note that data sharing was essential to a successful
transition in 2011 of ADAP clients to the Low Income Health
Program (LIHP) within DPH, an optional program that expanded
primary medical coverage to certain uninsured, low-income
persons. Because DPH was not authorized to share sensitive
HIV/AIDS-related information prior to the transition, the
Legislature included language in a budget trailer bill (AB 1467
of 2011) to facilitate sharing of data between DPH and LIHP.
Similarly, this bill seeks to allow the limited sharing of
information for the purpose of the facilitating seamless
coverage of HIV care during the upcoming transition to the ACA.
Implementation of the Affordable Care Act will necessitate the
transition of many persons living with AIDS/HIV to new coverage
options for their health care. In 2010, President Obama signed
the Affordable Care Act (ACA) (Public Law 111-148). Among other
things, the ACA requires most U.S. citizens and legal residents
to have health insurance; creates state-based Health Benefit
Exchanges through which individuals can purchase coverage, with
premium and cost sharing credits, as specified, and creates
separate exchanges through which small businesses can purchase
coverage. As part of implementation of the ACA, health insurers
must follow many new requirements, including the elimination of
pre-existing condition requirements, limitations on enrollee
cost sharing, guaranteed issue of plans and policies, and
restrictions on the factors health plans and insurers can use to
determine premium rates.
By January 1, 2014, the ACA will fundamentally change the way
Californians access public health care coverage. Instead of
applying for a particular health coverage program, the ACA will
require a seamless approach to coverage where, regardless of
what coverage a person applies for, he or she will be evaluated
for all programs and enrolled into the most beneficial program
based on income and other criteria. Starting in 2014, new
health coverage options will be available in the private health
insurance market and in the California Health Benefits Exchange.
According to DPH figures, as of the end of 2012 there were a
total of 212,442 reported HIV/AIDS cases in California.
Implementation of the Affordable Care Act will necessitate the
transition of many persons living with AIDS/HIV to new coverage
options for their health care-specifically, persons currently
SB 249
Page 7
enrolled in federal Ryan White Act-funded programs.
Accordingly, this bill seeks to authorize limited sharing of
sensitive HIV- and AIDS-related health records between DPH,
Covered California and other qualified entities for the purpose
of enrolling persons in coverage options authorized under the
ACA while ensuring uninterrupted HIV care for beneficiaries of
RWA-funded programs.
Strict current HIV/AIDS confidentiality laws require updating to
allow limited sharing of health information in order to
facilitate the smooth transition of care for many persons living
with AIDS/HIV. Federal law generally protects the
confidentiality of patient records, particularly with respect to
HIV and AIDS-related information, but allows some health
information to be shared for certain limited purposes. Federal
HIPAA privacy regulations require health care providers and
health plans to implement procedures that ensure the
confidentiality of protected health information. HIPAA further
requires reasonable efforts when using, disclosing, or
requesting protected health information, to limit disclosure of
that information to the minimum amount necessary to accomplish
the intended purpose.
California law similarly protects sensitive health information,
in many cases to an even greater degree than HIPAA, but does
allow the limited disclosure of such information for certain
purposes, as outlined below.
1. HIV testing information. Current state law authorizes the
disclosure of HIV tests without written authorization to the
subject of the test or his/her legal representative, as
specified; the test subject's provider of health care (including
an agent or employee), or to an emergency response employee, as
specified. In addition, current law prohibits the disclosure of
an HIV test to any third party in a manner that identifies or
provides identifying characteristics of the person to whom the
test results apply, unless pursuant to written authorization,
and prescribes penalties for such violations when the disclosure
is negligent, willful, or malicious.
2. Diagnosis and treatment. The Confidentiality of Medical
Information Act (CMIA) protects patient confidentiality and
provides that medical information may not generally be
disclosed, but may be shared with other health care
professionals or facilities for the purposes of diagnosis or
SB 249
Page 8
treatment of the patient.
In order to facilitate appropriate HIV/AIDS medical care and
treatment, existing law also allows state public health agency
HIV surveillance staff, ADAP Program staff, and care services
staff to disclose health information to local public health
agency staff, who may further disclose the information to the
HIV-positive person who is the subject of the record, or the
health care provider who provides his or her HIV care. In
addition, ADAP staff and DPH care services staff may disclose
the information directly to the HIV-positive person who is the
subject of the record or the health care provider who provides
his or her HIV care for the purpose of proactively offering care
and treatment services.
3. Local public health duties. Public health records relating
to HIV or AIDS which contain personally identifying information
that were developed or acquired by a state or local health
agency are confidential and cannot be disclosed except for
public health purposes or pursuant to a written authorization by
the person who is the subject of the record. However,
personally identifying information may be disclosed when the
confidential information is necessary to carry out the duties of
the agency or researcher in the investigation, control, or
surveillance of the disease.
This bill seeks to authorize limited sharing of sensitive HIV-
and AIDS-related health records for an additional purpose,
namely to allow DPH, Covered California and other qualified
entities to coordinate and enroll, without disruption,
beneficiaries of RWA-funded programs into other coverage options
made available to them by implementation of the ACA.
This bill also extends confidentiality protections that apply to
HIV blood testing to all new types of HIV tests. Existing law,
Health and Safety Code Section 120975, provides that no person
shall be compelled in civil, criminal, administrative,
legislative, or other proceedings to identify or provide
identifying characteristics that would identify any individual
"who is the subject of a blood test to detect antibodies to
HIV." According to the sponsors, the statute needs to be
updated because the protection is unnecessarily limited only to
"blood testing" for HIV, which reflects the fact that blood
testing was the only testing method available at the time the
law was enacted in 1995. With scientific progress since 1995,
SB 249
Page 9
HIV testing has grown more sophisticated and can now be
performed using a urine or saliva sample.
This bill would revise this language to ensure that
confidentiality protection is extended simply to every form of
HIV testing, without limitation, which would also helpfully
apply in the future to HIV testing methods not yet developed.
REGISTERED SUPPORT / OPPOSITION :
Support
Conference of California Bar Associations (co-sponsor)
San Francisco AIDS Foundation (co-sponsor)
L.A. Gay & Lesbian Center (co-sponsor)
AIDS Legal Referral Panel (co-sponsor)
AIDS Project Los Angeles
American Federation of State, County, and Municipal Employees,
AFL-CIO
California Communities United Institute
California Primary Care Association
Disability Rights California
National Association of Social Workers
Project Inform
Transgender Law Center
Opposition
None on file
Analysis Prepared by : Anthony Lew / JUD. / (916) 319-2334