BILL ANALYSIS Ó SENATE COMMITTEE ON HEALTH Senator Ed Hernandez, O.D., Chair BILL NO: SB 509 AUTHOR: DeSaulnier and Emmerson AMENDED: April 22, 2013 HEARING DATE: May 8, 2013 CONSULTANT: Bain SUBJECT : California Health Benefit Exchange: background checks. (Urgency) SUMMARY : Authorizes the California Health Benefit Exchange (known as Covered California) to require, and to submit to the Department of Justice (DOJ), fingerprint images and related information of employees, prospective employees, contractors, subcontractors, volunteers, or vendors to obtain criminal history information. Requires DOJ to forward requests to the Federal Bureau of Investigation (FBI) for federal summary criminal history information, and requires DOJ to review the information from the FBI and compile and disseminate a response to Covered California. Requires DOJ to charge a fee sufficient to cover the processing costs. Urgency clause. Existing law: 1.Establishes Covered California in state government, which is governed by a board composed of 5 members. 2.Requires, under federal law, Covered California to make available qualified health plans to qualified individuals and qualified employers. 3.Requires Covered California to inform individuals of eligibility requirements for the Medi-Cal program, the Healthy Families Program, or any applicable state or local public program. Requires Covered California to enroll individuals in any such program, if, through screening of the application, Covered California determines that such an individual is eligible. 4.Permits Covered California to adopt rules and regulations, as necessary, and permits Covered California to adopt any necessary rules and regulations as emergency regulations in accordance with the Administrative Procedure Act until January 1, 2016. Continued--- SB 509 | Page 2 5.Requires, under federal law, any person who receives information provided by an applicant for coverage or receives information from a federal agency, to use the information only for the purposes of ensuring the efficient operation of the Exchange, including verifying the eligibility of an individual to enroll in the Exchange or to claim a premium tax credit or cost-sharing reduction, and to not disclose the information to any other person except as provided. 6.Makes any person authorized by law to receive state summary criminal history information record or information obtained from a record who knowingly furnishes the record or information to a person who is not authorized by law to receive the record or information guilty of a misdemeanor This bill: 1.Permits the Covered California executive board to require and submit to DOJ fingerprint images and related information of all employees, prospective employees, contractors, subcontractors, volunteers, or vendors for the purposes of obtaining information as to the following information: a. The existence and content of a record of state or federal convictions; and, b. The existence and content of a record of state or federal arrests for which DOJ establishes that the person is free on bail or released on his or her own recognizance pending trial or appeal. 2.Requires DOJ to forward to FBI requests for federal summary criminal history information received. Requires DOJ to review the information returned from the FBI and compile and disseminate a response to Covered California. 3.Requires DOJ to provide to Covered California, on individuals who were initially subject to a criminal history information check, subsequent conviction and arrest information for individuals awaiting trial who are incarcerated, released on bail, or released on their own recognizance pending trial. Requires Covered California to request from DOJ this subsequent notification service. 4.Requires DOJ to charge a fee sufficient to cover the cost of processing requests under this bill. SB 509 | Page 3 5.Contains an urgency clause that will make this bill effective upon enactment. FISCAL EFFECT : This bill has not been analyzed by a fiscal committee. COMMENTS : 1.Author's statement. In 2010, California was the first state in the nation to enact legislation to implement the provisions of the federal Affordable Care Act by creating Covered California. Covered California is expected to begin enrolling individuals and small employers in health plans in October of this year. Recently-released federal privacy and security guidelines require state exchanges to perform criminal background checks on any personnel or potential personnel whose duties include, or would include, having access to personal health or financial information for exchange applicants and enrollees. The guidelines also require a process for periodic rescreening of personnel with access to this information. Covered California has determined that these requirements apply broadly to employees, prospective employees, contractors, subcontractors, volunteers and vendors who will have access to personal information for Covered California applicants and enrollees. This group will have access to applicant or enrollee Personal Identifying Information, Personal Health Information and/or Federal Tax Information as defined in the Health Insurance Portability and Accountability Act (HIPAA), the California Information Practices Act, and Internal Revenue Service (IRS) regulations. Federal guidance requires that Covered California protect and safeguard customers from unauthorized and illegal access to or disclosure of this information. To comply with federal guidance, Covered California must implement fingerprint-based background checks to identify, and exclude from accessing personal information, applicants with a demonstrated history of abuse of personal information or other offenses that may indicate potential propensity to abuse such information. SB 509 simply authorizes Covered California to require and submit to DOJ fingerprint images and related information of employees, prospective employees, contractors, subcontractors, volunteers or vendors for the purpose of obtaining criminal offender record information. SB 509 also SB 509 | Page 4 authorizes DOJ to forward the fingerprints to the FBI for federal criminal offender record information. Similar authority is given to the California Department of Insurance (CDI) and the Department of Managed Health Care (DMHC) as well as numerous other state departments and agencies. 2.Background. Covered California will be providing coverage to small employers and individuals, including individuals eligible for federal health insurance premium and cost-sharing subsidies. Since some of the individuals applying for coverage will be applying for coverage subsidies that are means-tested (for example, federal premium and cost-sharing subsidies for Exchange coverage are based on the individual's income), staff for Covered California will have access to information about where the individual works, financial (income, wage data) and personal identifying information (Social Security Number, name, age, address, dependents) about individuals seeking coverage. Covered California indicates the requirement for a fingerprint check against federal and state arrest and comes from the federal Minimum Acceptable Risk Standards for Exchanges (MARS-E) Personnel Screening Requirements. MARS-E requires organizations to screen individuals prior to authorizing access to information systems, and rescreen individuals periodically, consistent with the criticality/sensitivity rating of the position. To meet these MARS-E requirements, Covered California must perform a criminal history check for all persons prior to employment and, require appropriate personnel to obtain and hold a moderate-risk security clearance as defined in the federal personnel security/suitability handbook. 3.Differing requirements for agents, state health insurance programs, and eligibility entities. The Managed Risk Medical Insurance Board (MRMIB), which administers the Healthy Families Program (HFP), the Access for Infants and Mothers Program (AIM), the Major Risk Medical Insurance Program and the federal Pre-Existing Condition Insurance Program (PCIP), does not require its employees to undergo fingerprinting or a criminal background check. In addition, MRMIB does not require its vendors' employees who perform eligibility-related functions to undergo fingerprinting or a criminal background check. However, Maximus, which performs eligibility determinations for MRMIB's HFP, AIM and PCIP, states if performs a national criminal background check on all of its SB 509 | Page 5 employees, but does not require them to be fingerprinted. DHCS' Medi-Cal Eligibility Division indicates its state Medi-Cal employees are neither fingerprinted nor do they undergo a criminal background check. Medi-Cal has a privacy and security agreement between DHCS and the counties, which determine eligibility for Medi-Cal on behalf of the state. The agreement between the DHCS and counties contains a confidentiality statement requirement that requires all county workers who assist in the administration of Medi-Cal and who access, use or disclose Medi-Cal personal identifying information to sign a confidentiality statement that includes, at minimum, general use, security and privacy standards, unacceptable use and enforcement policies, which must be signed by the county worker prior to accessing personal identifying information. In addition, counties must conduct a background screening of a county worker before a county worker may access personal identifying information. The screening requirement is required to be commensurate with the risk and magnitude of harm the employee could cause. This screening requirement does not specifically require fingerprinting and a criminal background check, though counties have policies that include those requirements. The Insurance Commissioner is authorized to require the fingerprints on applications for any, some, or all of the licenses issued under the Insurance Code, and to require authenticated fingerprints. In practice, CDI indicates agents and brokers are required to be fingerprinted. DMHC is authorized to require (and in practice requires) fingerprint images and associated information from a prospective employee whose duties would include access to medical information. 4.Equal Employment Opportunity Enforcement (EEOC) Guidance. In April 2012, the EEOC published "Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII of the Civil Rights Act of 1964" regarding the use of arrest or conviction records in employment decisions under Title VII of the Civil Rights Act of 1964 (Title VII). The EEOC Guidance states that an employer's use of an individual's criminal history in making employment decisions, may, in some instances, violate the prohibition against employment discrimination under Title VII. A violation may occur when an employer treats criminal history information differently for different applicants or employees, SB 509 | Page 6 based on their race or national origin (disparate treatment liability). An employer's neutral policy (e.g., excluding applicants from employment based on certain criminal conduct) may disproportionately impact some individuals protected under Title VII, and may violate the law if not job related and consistent with business necessity (disparate impact liability). Two circumstances in which the EEOC believes employers will consistently meet the "job related and consistent with business necessity" defense are as follows: a. The employer validates the criminal conduct exclusion for the position in question in light of the Uniform Guidelines on Employee Selection Procedures (if there is data or analysis about criminal conduct as related to subsequent work performance or behaviors); or b. The employer develops a targeted screen considering at least the nature of the crime, the time elapsed, and the nature of the job (the three factors identified in case law). The employer's policy then provides an opportunity for an individualized assessment for those individuals identified by the screen, to determine if the policy, as applied, is job related and consistent with business necessity. 5.Fingerprinting process background. According to DOJ, approximately 35,000 entities perform background checks through DOJ's Bureau of Criminal Information and Analysis. Individuals who are required to be fingerprinted must fill out a one page form (typically provided by their employer) entitled "Request for Live Scan Service" that asks for information about the individual's name, date of birth, gender, height, weight, place of birth, address, and Social Security number. The rolling of the individual's fingerprints must be done by a certified Live Scan operator (which includes public providers, such as police departments, and private providers). Once submitted to the DOJ by the Live Scan operator, the fingerprints are searched against all arrest fingerprint images submitted to and maintained by DOJ from California law enforcement agencies. The applicant's fingerprints are retained and are searched against all new arrest fingerprint images. Biometric matches result in subsequent notification to the affected response agency, generally within 48 to 72 hours. DOJ does not determine the fingerprint rolling cost of the Live Scan operators, and the cost can vary by region. Covered SB 509 | Page 7 California estimates the estimated fingerprinting cost per individual is $65 which includes the cost of rolling individual fingerprints and fees charged by DOJ and the FBI. Covered California indicates it will cover the cost for all its employees and prospective employees, although the legislation is silent on this issue. Until December 31, 2014, Covered California will pay the cost for individuals who have successfully completed the training and certification process to be an application assister. Contractors, subcontractors, vendors and volunteers will be responsible for their own costs. The estimated cost of $65 is a one-time cost, and there is no additional cost for subsequent reports necessary to meet the federal "periodic rescreening" requirement. Covered California indicates it plans to negotiate a statewide discount rate and extend the discounted service to contractors, subcontractors, vendors and volunteers. 6.Related legislation. SB X1 4 (Emmerson) and AB X1 3 (Conway) would require all employees, prospective employees, contractors, subcontractors, and vendors, who facilitate enrollment of persons in qualified health plans in Covered California and who have access to the financial or medical information of enrollees/potential enrollees to be fingerprinted for the purpose of obtaining criminal history information. In addition, SB X1 4 and AB X1 3 would prohibit a person who has been convicted of felony crimes of dishonesty or breach of trust in a state or federal jurisdiction or other specified crimes from being hired by or contracting with Covered California for the purpose of facilitating enrollment of persons in a qualified health plan in Covered California, or for any position where, in the course and scope of his or her employment, he or she will have access to the financial or medical information of enrollees or potential enrollees of Covered California. Finally, SB X1 4 and AB X1 3 would also require an applicant to notify Covered California of any prescribed misdemeanor or felony convictions, filing of charges, or administrative actions. 7.Prior legislation. a. SB 900 (Alquist), Chapter 659, Statutes of 2010, establishes Covered California as an independent public entity within state government, and requires Covered California to be governed by a board composed of the Secretary of California Health and Human Services Agency, or his or her designee, and four other members appointed by SB 509 | Page 8 the Governor and the Legislature who meet specified criteria. b. AB 1602 (John A. Pérez), Chapter 655, Statutes of 2010, specifies the powers and duties of Covered California relative to determining eligibility for enrollment in the Covered California, and requires Covered Coverage to arrange for coverage through QHPs. c. AB 2343 (Torres), Chapter 256, Statutes of 2012 requires that, when state or federal summary criminal history information is furnished, the authorized agency, organization, or individual furnish a copy of the information to the person to whom the information relates if the information is a basis for an adverse employment, licensing, or certification decision. 8.Covered California. In a letter explaining the provisions of this bill, Covered California indicates it has determined the most comprehensive way to meet the federal MARS-E requirements is to conduct fingerprint-based background checks. To implement this policy, Covered California states that DOJ requires clear statutory authority to allow Covered California to request and to receive criminal history information from DOJ and the FBI. This bill will provide Covered California with the statutory authority that will allow it to perform fingerprint-based background checks prior to the employment of state service center employees and community-based assisters. Without the authority in this bill, Covered California will not be able to promulgate the necessary background check regulations and cannot hire the needed staff. 9.Support. The California Coverage & Health Initiatives (CCHI) writes in support that the January 1, 2014 date for the Exchange to be open to the public is only seven months away and with open enrollment beginning in October, and it is crucial that the training and hiring of employees, navigators, and assisters begin immediately in order to maximize enrollment and guarantee not only coverage but the success of Covered California. In addition, CCHI writes that it lends it support to the efforts to further define disqualifying crimes and establish a robust appeals process. CCHI concludes it is essential that this legislation be passed to ensure that Covered California is fully functioning by January 2014. 10.Support if amended. Health Access (HA) writes that it supports consumer protections, including fingerprinting and background checks for Covered California employees, SB 509 | Page 9 contractors and navigators that handle sensitive personal information, including personal health information, financial information, and income tax data, and that any Californian who relies on Covered California should be assured that their private information is protected. In addition, HA states that overly stringent background checks disproportionately impact African-Americans and Latinos, particularly men and boys of color. HA states African-Americans are 7.7 times more likely to be incarcerated than whites, and Hispanics are twice as likely. HA states communities of color that stand to benefit most from the expansions of coverage through Covered California and Medi-Cal are the most likely to be barred from helping enroll their own communities if the background check standard is overly broad. HA writes that it does not support a broad grant of authority to Covered California to determine what crimes should be disqualifying crimes and what the appeals process should be. Instead, HA provides amendments based on the best practices recommended by the federal EEOC that require the crimes be substantially related to the qualifications, functions or duties of the employment sought, to specify the disqualifying crimes, and to require a formal appeals process for those whose criminal history includes a potentially disqualifying offense. Consumers Union and Western Center on Law & Poverty write with similar concerns. WCLP seeks amendments that base the background check on the recommended EEOC best practices, to require crimes resulting in disqualification have a correlation to the work (such as fraud or identity theft), and to limit the individuals who are subject to the fingerprinting requirement to individuals with access to sensitive confidential information. Finally, WCLP seeks an amendment to provide an appeals process for applicants so that incorrect information that arise in applications can be remedied. 11.Concerns. The California LGBT Health & Human Services Network (LGBT Network) writes that it is concerned that Covered California is setting up overly-broad standards for disqualifying crimes with a "crimes of moral turpitude" standard. LGBT Network argues LGBT communities would be better served if this bill specifics disqualifying crimes, rather than leaving that determination to the Exchange, and those crimes should be limited to crimes substantially related to SB 509 | Page 10 the qualifications necessary for working with consumers' personal information. 12.Policy issues: a. Statute versus regulation for criteria in this bill. Criminal background checks for employment purposes involve several policy issues including: (1) which individuals are subject to the criminal background check requirement; (2) the crimes that either automatically or potentially disqualify an individual from employment; (3) whether there is an appeal mechanism that allows individuals who otherwise have a disqualifying criminal offense to appeal or present evidence of rehabilitation; and (4) who pays for the criminal background check (the employee versus the employer). This bill broadly defines the individuals who Covered California is authorized to subject to criminal background check (employees, prospective employees, contractors, subcontractors, volunteers, and vendors), and does not contain a requirement or a limitation that only subjects employees and individuals to the criminal background check who have access to confidential or personal identifying information of applicants for health subsidy programs administered by Covered California or require the disqualifying crime be job related. Under this bill, the individuals subject to the criminal background check, the crimes that may disqualify an individual from working or volunteering for the Exchange or its contractors and whether there is an extenuating circumstance or appeal mechanism for individuals who have a criminal background are to be addressed in regulations by Covered California. The EEOC guidance on criminal background checks states that one circumstance in which the EEOC believes employers will consistently meet the "job related and consistent with business necessity" defense in using criminal background checks is if the employer develops a targeted screen considering at least the nature of the crime, the time elapsed, and the nature of the job (three factors identified in case law), and the employer's policy then provides an opportunity for an individualized assessment for those people identified by the screen, to determine if the policy, as applied, is job related and consistent with business necessity. SB 509 | Page 11 Covered California indicates that, in order to be compliant with federal requirements, only individuals with access to personal identifying information, personal health information, and federal tax information need to be fingerprinted, and through the regulatory process, it will develop a fingerprinting policy which identifies the individuals who need to be fingerprinted. Covered California indicates that, should the federal requirements change, it may need to modify which individuals need to be fingerprinted, and given the newness of the Affordable Care Act, it is unknown if, or how, the federal requirements will change. If federal requirements change, Covered California states it would be able to modify the regulations, rather than being required to seek a change in state law. Draft proposed regulations from Covered California require fingerprint images and criminal history information from individuals whose duties include access to federal tax information, access to personal identifying information, access to personal health information, access to confidential or sensitive information (credit card account number or Social Security number), access to cash, checks or other forms of payment, responsibility for the development or maintenance of the CalHEERS system, access to information technology systems of the Exchange, and responsibility for the performance of any service center or county center duties or function. In addition, the proposed draft proposed regulations require the conviction of a felony or misdemeanor related to a crime of moral turpitude be substantially related to the qualifications, functions or duties of the specific employment sought by the applicant. The draft proposed regulations also require Covered California to pay any costs for furnishing the fingerprints and conducting the searches of all its employees and prospective employees. Finally, the draft proposed regulations also contain an appeal process for assisters if the individual believes his or her criminal record is inaccurate, and a requirement that Covered California take into account the nature of the job sought, the age, nature and gravity of the offense, whether the individual has a history of prior discipline and any evidence of rehabilitation when reconsidering the weight of a disqualifying offense. SB 509 | Page 12 13.Amendments. Following discussion between committee staff and Covered California, the following amendment would state that individuals who are subject to the criminal background and fingerprinting requirement would be in compliance with federal guidance applicable to state-based Exchanges. The guidance referred to require Exchanges to assign a criticality/sensitivity risk designation for all positions, establishes screening criteria for individuals filling those positions and requires the criticality/sensitivity designations be reviewed and revised within every 365 days. On page 3, lines 3-13: (a) The executive board of the California Health Benefit line 4 Exchange, as established by Section 100500, may require, and may submit to the Department of Justice, fingerprint images and related information required by the Department of Justice of all employees, prospective employees, contractors, subcontractors, volunteers, or vendors subject to compliance with federal guidance applicable to state-based Exchanges for the purposes of obtaining information as to the existence and content of a record of state or federal convictions and also information as to the existence and content of a record of state or federal arrests for which the Department of Justice establishes that the person is free on bail or on his or her recognizance pending trial or appeal. In addition, an amendment is needed to correct an incorrect cross reference in this bill. On page 3, lines 20-23: (c) The Department of Justice shall provide a state or federal level response to the board pursuant toparagraph (1) ofsubdivision (p) of Section 11105 of the Penal Code. SUPPORT AND OPPOSITION : Support: California Coverage & Health Initiatives Oppose: None received. -- END -- SB 509 | Page 13