BILL ANALYSIS                                                                                                                                                                                                    Ó



          SENATE COMMITTEE ON HEALTH
                          Senator Ed Hernandez, O.D., Chair

          BILL NO:                    SB 514    
           --------------------------------------------------------------- 
          |AUTHOR:        |Anderson                                       |
          |---------------+-----------------------------------------------|
          |VERSION:       |April 20, 2015                                 |
           --------------------------------------------------------------- 
           --------------------------------------------------------------- 
          |HEARING DATE:  |January 16,    |               |               |
          |               |2016           |               |               |
           --------------------------------------------------------------- 
           --------------------------------------------------------------- 
          |CONSULTANT:    |Teri Boughton                                  |
           --------------------------------------------------------------- 
          
           SUBJECT  :  California Health Benefit Exchange

         SUMMARY  :1.  Requires the California Health Benefit Exchange, known as  
          Covered California, to allow an applicant to indicate in an  
          application for health care coverage whether or not the  
          applicant would like assistance with completing the application  
          from a Covered California certified insurance agent or certified  
          enrollment counselor and prohibits the release of personally  
          identifiable information without permission. Contains an urgency  
          clause that will make this bill effective upon enactment.
        
          Existing law:
          1)Establishes the Covered California in state government as a  
            state-based marketplace where individuals and small businesses  
            can purchase qualified health plans.

          2)Establishes the Information Practices Act of 1977 (IPA), which  
            prohibits every state office, officer, department, division,  
            bureau, board, commission or other state agency from  
            disclosing personal information unless the information is  
            disclosed according to one of a specified list of provisions,  
            such as:

                   a)         With prior voluntary written consent, not  
                     more than 30 days in advance of the disclosure, or in  
                     the time limit agreed to by the individual; or,
                   b)         To those officers, employees, attorneys,  
                     agents, or volunteers of the agency that has custody  
                     of the information if the disclosure is relevant and  
                     necessary in the ordinary course of the performance  
                     of their official duties and is related to the  
                     purpose for which the information was acquired.







          SB 514 (Anderson)                                  Page 2 of ?
          
          

          3)Defines, under the IPA, "personal information" as any  
            information that is maintained by an agency that identifies or  
            describes an individual, including, but not limited to, his or  
            her name, social security number, physical description, home  
            address, home telephone number, education, financial matters,  
            and medical or employment history. 

          4)Makes, under the IPA, any person who willfully requests or  
            obtains any record containing personal information from an  
            agency under false pretenses guilty of a misdemeanor and fined  
            not more than $5,000, or imprisoned not more than one year, or  
            both, and also under the IPA subject to civil action for  
            invasion of privacy, in addition to any special or general  
            damages awarded,  awarded a minimum of $2,500 in exemplary  
            damages as well as attorney's fees and other litigation costs  
            reasonably incurred in the suit.

          5)Establishes, under federal law, the Health Insurance  
            Portability and Accountability Act of 1996 (HIPAA), which  
            among various provisions, mandates industry-wide standards for  
            health care information on electronic billing and other  
            processes; and, requires the protection and confidential  
            handling of protected health information.

          6)Establishes, under the federal Affordable Care Act, (ACA), the  
            procedures for determining eligibility requirements for  
            participation in an exchange, premium tax credits, cost  
            sharing reductions, and the individual responsibility  
            exemption.  Requires an applicant for coverage or for a  
            premium tax credit or cost sharing reduction to be required to  
            provide only the information strictly necessary to  
            authenticate identity, determine eligibility, and determine  
            the amount of the credit or reduction.  

          7)Requires under the ACA any person who receives information  
            provided by an applicant for insurance coverage to use the  
            information only for the purposes of, and to the extent  
            necessary in, ensuring the efficient operation of the  
            exchange, including verifying eligibility of an individual to  
            enroll through an exchange or to claim a premium tax credit or  
            cost sharing reduction or the amount of the credit or  
            reduction, and not disclose the information to any other  
            person except as provided.  









          SB 514 (Anderson)                                  Page 3 of ?
          
          
          8)Authorizes under federal regulations an exchange to only use  
            or disclose such personally identifiable information for the  
            purposes of determining eligibility in a qualified health  
            plan, for other insurance affordability programs, or for  
            exemptions from the individual responsibility provisions, as  
            specified, to the extent such information is necessary to  
            carry out the functions of the exchange, as specified.  For  
            other uses which the Secretary of Health and Human Services  
            (HHS) determines are in compliance with the ACA but are not to  
            carry out the exchange functions, requires individual consent.  
             To carry out other functions, requires consent and  
            substantive and procedural requirements, as specified.   

          This bill:
          1)Requires Covered California to allow an applicant to indicate  
            in an application for health care coverage whether or not the  
            applicant would like assistance with completing the  
            application from a Covered California certified insurance  
            agent or certified enrollment counselor.

          2)Prohibits Covered California from disclosing any personal  
            information, as defined in existing law, that was obtained  
            from the application for health care coverage to a certified  
            insurance agent or certified enrollment counselor until  
            Covered California has complied with 1) above.

          3)Prohibits Covered California from disclosing any personal  
            information, as defined in existing law that was obtained from  
            the application for health care coverage to a certified  
            insurance agent or certified enrollment counselor if the  
            applicant indicates that the applicant does not want  
            assistance from a Covered California certified insurance agent  
            or certified enrollment counselor.

          4)Permits Covered California to share the information of current  
            enrollees or applicants with the same certified enrollment  
            counselor or certified insurance agent of record that provided  
            the applicant assistance with an existing application, or  
            their successor or authorized staff, as otherwise permitted by  
            federal and state laws and regulations.

          5)Contains an urgency clause that will make this bill effective  
            upon enactment.

           FISCAL  








          SB 514 (Anderson)                                  Page 4 of ?
          
          
          EFFECT :  This bill has not been analyzed by a fiscal committee.
           
          COMMENTS  :
          1)Author's statement.  According to the author, the ACA has directed  
            states to provide marketplaces, or exchanges, for consumers  
            seeking health insurance. Covered California, the health benefit  
            exchange in California, has provided this platform for individuals  
            shopping for a plan. Unfortunately, due to a security loophole in  
            the law, shoppers on the website have suffered a disclosure of  
            their data to outside companies without having given their  
            permission. This bill is an effort to close that loophole, so that  
            consumers may shop free from fear of losing their privacy to  
            unknown, outside entities.

          2)Covered California Launch.  Covered California opened for  
            enrollment October 1, 2013.  While the California launch was a  
            success, it was not without issues.  Many found the overall  
            enrollment process difficult to complete. Covered California  
            identified challenges and opportunities for improvement. Due to  
            technical system issues, Covered California allowed people who  
            started applications to complete those applications until April  
            15th.  According to Covered California, to follow-up on  
            applications started to ensure coverage effective January 1, 2014,  
            Covered California enlisted the help of roughly 2,100 of its  
            Certified Insurance Agent subcontractors to offer additional  
            assistance to roughly 41,000 households. The basic contact  
            information (name, telephone number, etc.) was securely  
            transmitted to Certified Insurance Agents by General Agent  
            partners, with instructions to quickly touch as many of these  
            consumers as possible to ensure that they were offered additional  
            assistance to complete their enrollments. Consumer information was  
            carefully protected: each Certified Insurance Agent who  
            participated in the program was given only a small batch of  
            "leads" at a time, according to their capacity to reach consumers,  
            and results were reported back to the General Agents.  The program  
            was put on hold when some consumers were surprised to be contacted  
            by someone they did not realize was calling on behalf of Covered  
            California.  

          3)Covered California Privacy Practices.  Covered California  
            Notice of Privacy Practices, Use and Disclosure explain that  
            Covered California may use and disclose a consumer's personal  
            information with contractors to help with enrollment and  
            contact the consumer when necessary.  Additionally, all  
            contractors with whom Covered California shares information  








          SB 514 (Anderson)                                  Page 5 of ?
          
          
            for these purposes undergo a fingerprint and background check,  
            receive specialized training on keeping information  
            confidential, and must sign confidentiality agreements that  
            require contractors to follow the safeguards applicable to  
            Covered California and prohibit the use of the information for  
            any purposes outside the scope of the contract.

          According to Covered California, both the paper and online  
            application include disclosures about Covered California's  
            privacy policy and require the consumer to agree that they are  
            aware of those privacy policies and practices, which is  
            required under the IPA and the ACA.   On the paper  
            application, the privacy policy is described immediately above  
            the "rights and responsibilities" section of the application,  
            and is referenced in the declaration and signature which are  
            submitted under penalty of perjury.  Specifically, the paper  
            application states, "We will share your information with other  
            state, federal and local agencies, contractors, health plans,  
            and programs only to enroll you in a plan or program or to  
            administer programs, and with other state and federal agencies  
            as required by law." For the web-based application, in order  
            to initially set up an online application a user is first  
            presented with two separate links: one for Covered  
            California's Terms and Conditions, and the other to Covered  
            California's privacy policy.  In order to continue, a consumer  
            must actively consent by clicking a box to agree to the Terms  
            of Conditions and the privacy policy.  The privacy policy  
            discloses that Covered California maintains administrative,  
            physical, technical, electronic and procedural safeguards to  
            protect the confidentiality and security of the personal  
            information.  It allows links to additional information about  
            how data is collected online and used, and how to request  
            restrictions on the use and disclosure of information, among  
            other information.

          4)California Healthcare Eligibility, Enrollment and Retention  
            System (CalHEERS).  CalHEERS is a web-based system that  
            streamlines the eligibility and enrollment process for all  
            products and programs available through Covered California.   
            Covered California has a CalHEERS change request with the  
            title, "Consumer Consent to Share Personally Identifiable  
            Information with Covered California Certified Representative."  
            According to the document, Covered California needs to obtain  
            more explicit consumer consent before it shares any personally  
            identifiable information (namely, contact information) to any  








          SB 514 (Anderson)                                  Page 6 of ?
          
          
            of its certified representatives.  The goal of this change  
            request is to implement a business policy that allows  
            consumers the opportunity to opt in or out of having their  
            information shared for program purposes. The background  
            associated with this change request indicates that most  
            consumers appreciated the help from certified representatives  
            but a few consumers were surprised that they were being  
            contacted by an agent since they had not delegated their  
            application. According to the document, while this use of  
            consumer information was legally authorized, Covered  
            California wants to make sure consumers always have a clear  
            expectation about how their information may be shared.  If the  
            change request is implemented there will be two boxes for  
            consumers to consent to Covered California's privacy policies  
            and information sharing practices. The first for the consumer  
            to agree to the privacy policy and the second to agree to have  
            information shared with the certified representative for  
            follow-up assistance.  Consumer advocates have requested that  
            this change allow for an opt-in not an opt-out of having their  
            information shared.  
            
            According to Covered California, the change request is under  
            consideration for their next batch of changes, to be  
            implemented in September 2016. Currently, that batch still  
            needs to be prioritized. The prioritization process is under  
            way and will be finalized around April. Additionally, Covered  
            California has determined that changing the application as  
            called for in this bill is a costly, time-intensive process.  
            As such, Covered California has been looking at ways that  
            express consumer consent without changing the application.  
            Covered California is considering options that might be more  
            cost-effective and have the added benefit of being a system  
            that can actively check in with consumers, even existing ones  
            who may not be coming back to the application any time soon to  
            update their preferences. Covered California indicates that if  
            this bill were to become effective as is they would be  
            strictly limited to amending the application as indicated in  
            this bill.  Furthermore, Covered California indicates that  
            this bill is duplicative of federal requirements and actually  
            less rigorous, as a check box would not be sufficient consent  
            as required by federal requirements.
            
          5)Prior legislation.  SB 974 (Anderson of 2014), would have  
            required Covered California to allow consumers to indicate  
            whether they would like assistance from an agent or enrollment  








          SB 514 (Anderson)                                  Page 7 of ?
          
          
            counselor, and prohibit Covered California from disclosing  
            personal information if applicants indicate they do not want  
            assistance.  SB 974 was held in the Assembly Appropriations  
            Committee.
          
            AB 1560 (Gorell of 2014), would have prohibited Covered  
            California from disclosing an individual's personal  
            information, as defined, to third parties for the purpose of  
            determining eligibility for, or enrolling the individual in,  
            health care coverage unless, prior to the disclosure, and  
            would have required Covered California to immediately notify  
            the public of any breach of the security of personal  
            information created, collected, or maintained by Covered  
            California, regardless of the severity of the breach and  
            regardless of whether personal information was acquired by an  
            unauthorized person during the breach.  AB 1560 failed passage  
            in the Assembly Health Committee.

            SB 900 (Alquist, Chapter 659, Statutes of 2010), and AB 1602  
            (Perez, Chapter 655, Statutes of 2010), established the  
            California Health Benefit Exchange.

          6)Support. According to the California Association of Health  
            Underwriters, the National Association of Insurance and  
            Financial Advisors of California, and the Independent  
            Insurance Agents and Brokers of California indicate that  
            licensed health insurance agents are already mandated to  
            comply with extensive privacy laws, undergo substantial  
            education on handling of consumer information and ethics, plus  
            annual continuing education.  These proponents support this  
            bill because it provides a simple, tailored approach to permit  
            individuals needing assistance in the Covered California  
            enrollment process to affirmatively indicate they need  
            additional help with their applications.

          7)Policy Comment.  The author and Committee may wish to keep the  
            pressure on Covered California to maintain as a priority a  
            technological solution which allows an applicant or renewing  
            enrollee to consent to sharing information with contractors to  
            assist with enrollment and eligibility assistance, but may not  
            want to limit Covered California's ability to develop a  
            solution that is cost-effective and more beneficial to  
            enrollees. If this is the case, amendments may be needed to  
            provide Covered California some flexibility in developing the  
            specific solution to the identified problem. Amendments could  








          SB 514 (Anderson)                                  Page 8 of ?
          
          
            also include a timeline for implementation.

           SUPPORT AND OPPOSITION  :
          Support:  California Association of Health Underwriters
                    Independent Insurance Agents and Brokers of California
                    National Association of Insurance and Financial  
                    Advisors of California
          
          Oppose:   None received
          

                                      -- END --