BILL NUMBER: AB 416	ENROLLED
	BILL TEXT

	PASSED THE ASSEMBLY   SEPTEMBER 10, 1999
	PASSED THE SENATE   SEPTEMBER 9, 1999
	AMENDED IN SENATE   SEPTEMBER 9, 1999
	AMENDED IN SENATE   SEPTEMBER 7, 1999
	AMENDED IN SENATE   AUGUST 17, 1999
	AMENDED IN SENATE   JULY 12, 1999
	AMENDED IN ASSEMBLY   MAY 17, 1999
	AMENDED IN ASSEMBLY   MAY 3, 1999

INTRODUCED BY   Assembly Member Machado

                        FEBRUARY 12, 1999

   An act to amend Section 56.35 of, and to add Section 56.104 to,
the Civil Code, relating to personal information.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 416, Machado.  Personal information:  disclosure.
   Existing law prohibits the disclosure of medical information by
providers of health care, as defined, without the patient's prior
authorization, except in specified circumstances.  However, existing
law permits the disclosure of specified personally identifiable
information by those providers unless the patient specifically
requests in writing to the contrary.  A violation of these provisions
that results in economic loss or personal injury to a patient is
punishable as a misdemeanor.  In addition, a patient whose medical
information is used or disclosed in violation of these provisions is
subject to civil penalties.
   This bill would prohibit health care providers from releasing
specified medical information created regarding an individual as a
result of that person's participation in outpatient treatment with a
psychotherapist, as defined, unless the person or entity requesting
the information submits a written request, signed by the requester as
specified.  Since a violation of this provision that results in
economic loss or personal injury to a patient would be punishable as
a crime, the bill would impose a state-mandated local program.  The
bill would include a statement of findings and declarations.
   This bill would also extend this prohibition to health care
service plans, their contractors, and make conforming changes made by
SB 19 to Section 56.10 of the Civil Code, contingent upon the
enactment of SB 19.
  The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
   This bill would provide that no reimbursement is required by this
act for a specified reason.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:


  SECTION 1.  The Legislature finds and declares the following:
   (a) Privacy is a fundamental right of Californians.
   (b) Mental health treatment, in order to be effective, depends
upon open communication based on the patient's trust in the
practitioner.
   (c) A relationship of trust can only be established if the patient
is confident that access to his or her personal information will be
limited and that the information will be protected to the fullest
extent possible.
   (d) In recognition of the fundamental importance of maintaining
this relationship with patients, mental health practitioners are
bound by professional codes of ethics and laws designed to protect
sensitive information.
   (e) As managed care has expanded in recent years, mental health
professionals have been forced to choose between their obligation to
protect the confidentiality of patient information and the demands of
insurers and health care service plans that operate the health care
system to obtain that information for administrative purposes other
than authorization of treatment and payment of services.
   (f) The inclusion of recognizable patient identification
information in medical records obtained by health care service plans
or insurers exposes sensitive identifying information about the
patient, thereby jeopardizing the patient's privacy.
   (g) Laws providing for the confidentiality of medical information
should protect patients from the unlawful disclosure of their most
personal information.
   (h) Informed consent is appropriately given by the patient's
signature on an authorization to release information that clearly and
specifically states the information requested, the purpose for the
request, the identity of those who will have access to the
information, the date the authorization was signed, and an expiration
date.
   (i) Patients should not forfeit their right to confidentiality of
their personal information to insurers or health care service plans
for purposes other than those purposes authorized by law.
   (j) Patient records often contain the names of, and personal
information regarding, persons other than the patient and the privacy
of those persons should also be protected.
  SEC. 2.  Section 56.104 is added to the Civil Code, to read:
   56.104.  (a) Notwithstanding subdivision (c) of Section 56.10, no
provider of health care may release medical information to persons or
entities authorized by law to receive that information pursuant to
paragraphs (2), (3), and (7) to (10), inclusive, of, or to licensed
health care service plans described in paragraph (4) of subdivision
(c) of Section 56.10, if the requested information specifically
relates to the patient's participation in outpatient treatment with a
psychotherapist, unless the person or entity requesting that
information submits to the patient pursuant to subdivision (b) and to
the provider of health care a written request, signed by the person
requesting the information or an authorized agent of the entity
requesting the information, that includes all of the following:
   (1) The specific information relating to a patient's participation
in outpatient treatment with a psychotherapist being requested and
its specific intended use or uses.
   (2) The length of time during which the information will be kept
before being destroyed or disposed of.  A person or entity may extend
that timeframe, provided that the person or entity notifies the
provider of the extension.  Any notification of an extension shall
include the specific reason for the extension, the intended use or
uses of the information during the extended time, and the expected
date of the destruction of the information.
   (3) A statement that the information will not be used for any
purpose other than its intended use.
   (4) A statement that the person or entity requesting the
information will destroy the information and all copies in the person'
s or entity's possession or control, will cause it to be destroyed,
or will return the information and all copies of it before or
immediately after the length of time specified in paragraph (2) has
expired.
   (b) The person or entity requesting the information shall submit a
copy of the written request required by this subdivision to the
patient within 30 days of receipt of the information requested,
unless the patient has signed a written waiver in the form of a
letter signed and submitted by the patient to the provider of health
care or health care service plan waiving notification.
   (c) For purposes of this section, "psychotherapist" means a person
who is both a "psychotherapist" as defined in Section 1010 of the
Evidence Code and a "provider of health care" as defined in
subdivision (d) of Section 56.05 of the Civil Code.
   (d) This section shall not apply to uses of the information
related to law enforcement and investigations of crimes or
investigations of unprofessional conduct under the Business and
Professions Code.
   (e) Nothing in this section shall be construed to grant any
additional authority to a provider of health care to disclose
information to a person or entity without the patient's consent.
  SEC. 3.  Section 56.104 is added to the Civil Code, to read:
   56.104.  (a) Notwithstanding subdivision (c) of Section 56.10, no
provider of health care, health care service plan, or contractor may
release medical information to persons or entities authorized by law
to receive that information pursuant to subdivision (c) of Section
56.10, if the requested information specifically relates to the
patient's participation in outpatient treatment with a
psychotherapist, unless the person or entity requesting that
information submits to the patient pursuant to subdivision (b) and to
the provider of health care, health care service plan, or contractor
a written request, signed by the person requesting the information
or an authorized agent of the entity requesting the information, that
includes all of the following:
   (1) The specific information relating to a patient's participation
in outpatient treatment with a psychotherapist being requested and
its specific intended use or uses.
   (2) The length of time during which the information will be kept
before being destroyed or disposed of.  A person or entity may extend
that timeframe, provided that the person or entity notifies the
provider, plan, or contractor of the extension.  Any notification of
an extension shall include the specific reason for the extension, the
intended use or uses of the information during the extended time,
and the expected date of the destruction of the information.
   (3) A statement that the information will not be used for any
purpose other than its intended use.
   (4) A statement that the person or entity requesting the
information will destroy the information and all copies in the person'
s or entity's possession or control, will cause it to be destroyed,
or will return the information and all copies of it before or
immediately after the length of time specified in paragraph (2) has
expired.
   (b) The person or entity requesting the information shall submit a
copy of the written request required by this section to the patient
within 30 days of receipt of the information requested, unless the
patient has signed a written waiver in the form of a letter signed
and submitted by the patient to the provider of health care or health
care service plan waiving notification.
   (c) For purposes of this section, "psychotherapist" means a person
who is both a "psychotherapist" as defined in Section 1010 of the
Evidence Code and a "provider of health care" as defined in
subdivision (d) of Section 56.05 of the Civil Code.
   (d) This section does not apply to the disclosure or use of
medical information by a law enforcement agency or a regulatory
agency when required for an investigation of unlawful activity or for
licensing, certification, or regulatory purposes, unless the
disclosure is otherwise prohibited by law.
   (e) Nothing in this section shall be construed to grant any
additional authority to a provider of health care, health care
service plan, or contractor to disclose information to a person or
entity without the patient's consent.
  SEC. 4.  Section 56.35 of the Civil Code is amended to read:
   56.35.  In addition to any other remedies available at law, a
patient whose medical information has been used or disclosed in
violation of Section 56.10 or 56.104 or 56.20 or subdivision (a) of
Section 56.26 and who has sustained economic loss or personal injury
therefrom may recover compensatory damages, punitive damages not to
exceed three thousand dollars ($3,000), attorneys' fees not to exceed
one thousand dollars ($1,000), and the costs of litigation.
  SEC. 5.  Section 3 of this act shall become operative only if SB 19
of the 1999-2000 Regular Session is enacted and amends Section 56.10
of the Civil Code, in which case Section 2 shall not become
operative.
  SEC. 6.  No reimbursement is required by this act pursuant to
Section 6 of Article XIIIB of the California Constitution because the
only costs that may be incurred by a local agency or school district
will be incurred because this act creates a new crime or infraction,
eliminates a crime or infraction, or changes the penalty for a crime
or infraction, within the meaning of Section 17556 of the Government
Code, or changes the definition of a crime within the meaning of
Section 6 of Article XIIIB of the California Constitution.