BILL ANALYSIS Ó
SENATE JUDICIARY COMMITTEE
Senator Hannah-Beth Jackson, Chair
2015-2016 Regular Session
SB 1443 (Galgiani)
Version: March 28, 2016
Hearing Date: April 19, 2016
Fiscal: Yes
Urgency: No
NR
SUBJECT
Incarcerated persons: health records
DESCRIPTION
This bill would expressly authorize, in the Confidentiality of
Medical Information Act, the disclosure of information between
county and state correctional facilities, as specified, to
ensure the continuity of health care for inmates being
transferred. This bill would also authorize the disclosure and
exchange of information for the purpose of mandatory offender
screening.
When an inmate is being released to post-release community
supervision, or is being retained at a county or local jail, or
county officials will otherwise have responsibility for the
inmate's health care needs, this bill would require the
department to disclose the inmate's health information, as
necessary for continuity of care, to the applicable agency. This
bill would require that all transmissions made pursuant to these
provisions comply with specified provisions of state and federal
law, including the Confidentiality of Medical Information Act.
BACKGROUND
The federal Health Insurance Portability and Accountability Act
(HIPAA), enacted in 1996, guarantees privacy protection for
individuals with regards to specific health information (Pub.L.
104-191, 110 Stat. 1936). Generally, protected health
information (PHI) is any information held by a covered entity
which concerns health status, provision of health care, or
SB 1443 (Galgiani)
Page 2 of ?
payment for health care that can be connected to an individual.
HIPAA privacy regulations require health care providers and
organizations to develop and follow procedures that ensure the
confidentiality and security of PHI when it is transferred,
received, handled, or shared. HIPAA further requires reasonable
efforts when using, disclosing, or requesting PHI, to limit
disclosure of that information to the minimum amount necessary
to accomplish the intended purpose. California's
Confidentiality of Medical Information Act (CMIA) also protects
PHI and restricts the disclosure of medical information by
health care providers, and health care service plans, as
specified.
The use of electronic health records has been on the rise since
2009 when the President signed the American Recovery and
Reinvestment Act, which included the establishment of the Office
of the National Coordinator for Health Information Technology to
facilitate and expand the use of health information technology
pursuant to national standards. Using electronic health record
systems is intended to reduce medical errors and increase
patient accessibility to personal medical information. However,
according to Privacy Rights Clearing House, 1263 data breaches
involving medical and healthcare providers have been made public
since 2005. Those breaches involved over 45 million records.
Increasingly, prisoners are the targets of identity theft. The
California Department of Corrections and Rehabilitation (CDCR)
alone has reported four data breaches in the past four years.
Identity theft rings are using prisoners' Social Security
numbers in financial crimes against the government, such as
posing as legitimate applicants for the purpose of stealing
student loan money or unemployment benefits, or filing bogus tax
returns to obtain unearned refunds. Accordingly, both the state
and federal governments continue to enact measures to ensure the
protection of patient medical information, and closely monitor
legislation involving electronic health records.
This bill, seeking to improve prisoner healthcare, would
expressly authorize the disclosure of inmate medical information
when the inmate is transferring facilities, as specified. This
bill was passed out on consent within the Senate Public Safety
Committee on April 12, 2016.
CHANGES TO EXISTING LAW
Existing law , the California Constitution, provides that all
SB 1443 (Galgiani)
Page 3 of ?
people have inalienable rights, including the right to pursue
and obtain privacy. (Cal. Const. art. I, Sec. 1.)
Existing federal law , the Health Insurance Portability and
Accountability Act (HIPAA), specifies privacy protections for
patients' protected health information and generally provides
that a covered entity, as defined (health plan, health care
provider, and health care clearing house), may not use or
disclose protected health information except as specified or as
authorized by the patient in writing. (45 C.F.R. Sec. 164.500
et seq.)
Existing law prohibits, under the State Confidentiality of
Medical Information Act (CMIA), providers of health care, health
care service plans, or contractors, as defined, from sharing
medical information without the patient's written authorization,
subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
Existing law defines "medical information" to mean any
individually identifiable information, in electronic or physical
form, in possession of or derived from a provider of health
care, health care service plan, pharmaceutical company, or
contractor regarding a patient's medical history, mental or
physical condition, or treatment. Existing law defines
"individually identifiable" to mean that the medical information
includes or contains any element of personal identifying
information sufficient to allow identification of the
individual, such as the patient's name, address, electronic mail
address, telephone number, or social security number, or other
information that, alone or in combination with other publicly
available information, reveals the individual's identity. (Civ.
Code Sec. 56.05(g).)
Existing law defines "provider of health care" to include: any
person licensed or certified pursuant to the Business &
Professions Code; any person licensed pursuant to the
Osteopathic Initiative Act or the Chiropractic Initiative Act;
any clinic, health dispensary, or licensed health facility
licensed, as specified. (Civ. Code Sec. 56.05(m).)
Existing law defines a "licensed health care professional" to
mean any person licensed
or certified pursuant to the Business and Professions Code, the
Osteopathic Initiative Act or the Chiropractic Initiative Act,
or the Health and Safety Code, as specified. (Civ. Code Sec.
SB 1443 (Galgiani)
Page 4 of ?
56.05(h).)
Existing law defines "health care service plan" to mean any
entity regulated pursuant
to the Knox-Keene Health Care Service Plan Act of 1975. (Civ.
Code Sec. 56.05(g).)
Existing law provides that any provider of health care, a health
care service plan, pharmaceutical company, or contractor who
negligently creates, maintains, preserves, stores, abandons,
destroys, or disposes of written or electronic medical records
shall be subject to damages in a civil action or an
administrative fine, as specified. (Civ. Code Sec. 56.36.)
This bill would authorize the disclosure of medical information
between a county correctional facility, a county medical
facility, a state correctional facility, or a state hospital to
ensure the continuity of health care of an inmate being
transferred among those facilities, and would authorize the
disclosure of medical information for the purpose of performing
a forensic evaluation of an offender, or a mentally disordered
offender, or a sexually violent predator screening of an
offender.
This bill would require, when jurisdiction of an inmate is
transferred from or among CDCR, the State Department of State
Hospitals, and county agencies caring for inmates, those
agencies to disclose, by electronic transmission when possible,
medical, dental, and mental health information regarding each
transferred or released inmate, as provided by the bill's
provisions.
This bill would authorize the sharing of an inmate's health
information, as necessary for continuity of care, when an inmate
is transferred between or among a state prison, a fire camp
operated by CDCR, a state hospital, a county correctional
facility, or a county medical facility providing medical or
mental health services to offenders, as specified.
This bill would require, when an inmate is being released by
CDCR to post-release community supervision, or is being retained
in custody at a county or local jail, or county officials will
otherwise have responsibility for the inmate's ongoing health
care needs, the department to disclose the inmate's health
information, as necessary for continuity of care, to the
SB 1443 (Galgiani)
Page 5 of ?
applicable county agency, as specified.
This bill would require all transmissions made pursuant to these
provisions to comply with specified provisions of state and
federal law, including, among others, the Confidentiality of
Medical Information Act.
COMMENT
1.Stated need for the bill
According to the author:
Not only does the lack of sharing of medical history impact
offender safety, but it is costly as well, as many times
treatment/diagnostic testing must be duplicated at the
receiving facility. Although there are a variety of statutory
schemes that discuss the transfer of patient records in the
public, none apply in a correctional setting.
This bill would address the current lack of statutory
authority that would provide for the transfer of medical and
mental health records for offenders who transition in and out
of various state and local jurisdictions. This bill would
amend current law to require that an offender's pertinent
medical and mental health records and copies that are
reasonably available be transferred from the sending
practitioner to the receiving practitioner within 24 hours
whenever the offender transitions between state/county
correctional facilities. The bill would allow for the
disclosure of medical or mental health information when an
offender is being transferred between state/county
correctional facilities, whether it be on a temporary or
permanent basis.
2.Sharing of medical information for purposes of diagnosis or
treatment is authorized under the Confidentiality of Medical
Information Act
The Confidentiality of Medical Information Act (CMIA) generally
prohibits the sharing of a patient's medical information, but
allows health care professionals, providers, and service plans
to disclose medical information for the purpose of diagnosis or
treatment. Inmates have a constitutional right to limited
healthcare, which is generally provided by the state or county
SB 1443 (Galgiani)
Page 6 of ?
holding them in custody. The county and state correctional
facilities, medical facilities, and hospitals that provide
medical and mental health services to inmates arguably fall
within CMIA's definition of "licensed health care professional,"
"provider of health care,"or "health care service plan." (See
Civ. Code Sec. 56.05 (g), (h), and (m).)
Accordingly, this bill does not appear to be necessary for
county and state facilities to share an inmate's medical records
when he or she is transferred to a new facility. The sponsor
asserts that this clarification is needed because often the
transferring facility does not understand that sharing an
inmate's medical information for the purpose of diagnosis or
treatment is legally permissible. Thus, the sponsor argues that
requiring the automatic sharing of the medical record would
significantly improve the receiving facility's ability to
provide continuity of care.
To that end, this bill would require that medical information is
disclosed to the receiving facility or agency anytime
jurisdiction of an inmate is transferred from or among CDCR, the
State Department of State Hospitals, and county agencies caring
for inmates, or anytime an inmate is being released by CDCR to
post-release community supervision or county officials will
otherwise have responsibility for the inmate's ongoing health
care needs. While it is necessary for correctional facilities
to have an inmate's medical record so that the facility may
adequately care for him or her, as an inmate transitions into
post-release supervision, he or she should arguably have a
greater right to privacy.
The following amendments would address the above concerns by
requiring that a transferring facility disclose an inmate's
entire medical record when the inmate is transferred to a new
facility. This requirement should aid the correctional system
in providing adequate and timely health care and ensuring that
an inmate's health is not compromised over administrative issues
between facilities. The amendments would also remove the
provisions of the bill relating to post-release community
supervision, in order to maintain the status quo while the
author and the sponsor continue to consider the appropriate
amount of control an individual in post-release community
supervision should have over his or her medical information.
Author's amendment:
SB 1443 (Galgiani)
Page 7 of ?
1 Page 17, Section 5073 is amended to read:
Information shall be disclosed among a county correctional
facility, a county medical facility, a state correctional
facility, a state hospital, or a state-assigned mental
health provider, to ensure the continuity of health care of
an inmate being transferred among those facilities.
2 Page 17 and 18, strike subdivisions (a) and (b)
Staff notes that expressly naming correctional facilities, and
authorizing them to share medical information within the CMIA,
arguably begins to undermine the integrity of the Act. With
every authorization for a specific group or agency that is added
to the Act, it becomes less clear that the Act is designed to
cover all providers of health care. The following amendment
would instead specify in the CMIA that correctional facilities
are required to share information when an inmate is transferring
facilities, which is distinct from the permissive disclosure
permitted under the Act.
Author's amendment:
3 Page 11, subdivision (23) is amended to read:
Information shall be disclosed among a county correctional
facility, a county medical facility, a state correctional
facility, a state hospital, or a state-assigned mental
health provider, to ensure the continuity of health care of
an inmate being transferred among those facilities.
4 Page 11, strike lines 5-10
1.Mandatory offender screening
This bill would require the transferring of health information
to perform mandatory offender screenings, such as a mentally
disordered offender or sexually violent predator screening. (See
Pen. Code Sec. 2960 et seq. and Welf. & Inst. Code Sec. 6600 et
seq.) These screenings are arguably performed for security
purposes and not for medical diagnosis or treatment.
Accordingly, the sharing of medical information for the purpose
of mandatory offender screening is outside the scope of CMIA.
However, CMIA does carve out an exception to its general
SB 1443 (Galgiani)
Page 8 of ?
prohibition on the sharing of medical information, by allowing
disclosure of information if "otherwise specifically authorized
by law," which would then be governed by the Information
Practices Act. (See Civ. Code Sec. 56.10(c)(14).)
The Information Practices Act prohibits the disclosure of
personal information to another party without first obtaining
the permission of the affected individual. In certain
circumstances, disclosure may be authorized without such
permission when, as here, the information may be necessary for
an agency "to perform its constitutional or statutory duties."
(Civ. Code Sec. 1798.24.) Even when permission from an affected
individual is not obtained, the Information Practices Act
requires governmental agencies to "establish appropriate and
reasonable administrative, technical, and physical safeguards to
ensure compliance with the [act], to ensure the security and
confidentiality of records, and to protect against anticipated
threats or hazards to their security or integrity which could
result in any injury." (Civ. Code Sec. 1798.21.) Consequently,
whether or not the CMIA applies to medical records disclosed for
the purpose of mandatory offender screening, under the
Information Practices Act, the county and the state would be
required to protect the confidentiality of that information.
In addition, while medical records, and specifically mental
health records, could be very helpful in determining whether an
individual is mentally disordered or a sexually violent predator
for security-related purposes, these evaluations are only
partially related to the future medical treatment of an inmate.
Accordingly, some mental health records produced for the
diagnosis or medical treatment of the inmate may not be
necessary for the purposes of these evaluations given the
inmate's privacy rights. Accordingly, the following amendment
removes the provisions of the bill which authorize correctional
facilities and county agencies to disclose medical information
for the purpose of mandatory offender screening, thus
maintaining the status quo while the author and sponsor continue
to examine how to best disclose medical information for purposes
related to public safety, while still adequately protecting an
inmate's privacy.
Author's amendment:
Page 11, strike lines 5-10
Page 18, strike lines 5-28
SB 1443 (Galgiani)
Page 9 of ?
Support : None Known
Opposition : None Known
HISTORY
Source : California Correctional Health Care Services
Related Pending Legislation : None Known
Prior Legislation : None Known
Prior Vote : Senate Public Safety Committee (Ayes 6, Noes 0)
**************