BILL NUMBER: AB 416 ENROLLED BILL TEXT PASSED THE ASSEMBLY SEPTEMBER 10, 1999 PASSED THE SENATE SEPTEMBER 9, 1999 AMENDED IN SENATE SEPTEMBER 9, 1999 AMENDED IN SENATE SEPTEMBER 7, 1999 AMENDED IN SENATE AUGUST 17, 1999 AMENDED IN SENATE JULY 12, 1999 AMENDED IN ASSEMBLY MAY 17, 1999 AMENDED IN ASSEMBLY MAY 3, 1999 INTRODUCED BY Assembly Member Machado FEBRUARY 12, 1999 An act to amend Section 56.35 of, and to add Section 56.104 to, the Civil Code, relating to personal information. LEGISLATIVE COUNSEL'S DIGEST AB 416, Machado. Personal information: disclosure. Existing law prohibits the disclosure of medical information by providers of health care, as defined, without the patient's prior authorization, except in specified circumstances. However, existing law permits the disclosure of specified personally identifiable information by those providers unless the patient specifically requests in writing to the contrary. A violation of these provisions that results in economic loss or personal injury to a patient is punishable as a misdemeanor. In addition, a patient whose medical information is used or disclosed in violation of these provisions is subject to civil penalties. This bill would prohibit health care providers from releasing specified medical information created regarding an individual as a result of that person's participation in outpatient treatment with a psychotherapist, as defined, unless the person or entity requesting the information submits a written request, signed by the requester as specified. Since a violation of this provision that results in economic loss or personal injury to a patient would be punishable as a crime, the bill would impose a state-mandated local program. The bill would include a statement of findings and declarations. This bill would also extend this prohibition to health care service plans, their contractors, and make conforming changes made by SB 19 to Section 56.10 of the Civil Code, contingent upon the enactment of SB 19. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. The Legislature finds and declares the following: (a) Privacy is a fundamental right of Californians. (b) Mental health treatment, in order to be effective, depends upon open communication based on the patient's trust in the practitioner. (c) A relationship of trust can only be established if the patient is confident that access to his or her personal information will be limited and that the information will be protected to the fullest extent possible. (d) In recognition of the fundamental importance of maintaining this relationship with patients, mental health practitioners are bound by professional codes of ethics and laws designed to protect sensitive information. (e) As managed care has expanded in recent years, mental health professionals have been forced to choose between their obligation to protect the confidentiality of patient information and the demands of insurers and health care service plans that operate the health care system to obtain that information for administrative purposes other than authorization of treatment and payment of services. (f) The inclusion of recognizable patient identification information in medical records obtained by health care service plans or insurers exposes sensitive identifying information about the patient, thereby jeopardizing the patient's privacy. (g) Laws providing for the confidentiality of medical information should protect patients from the unlawful disclosure of their most personal information. (h) Informed consent is appropriately given by the patient's signature on an authorization to release information that clearly and specifically states the information requested, the purpose for the request, the identity of those who will have access to the information, the date the authorization was signed, and an expiration date. (i) Patients should not forfeit their right to confidentiality of their personal information to insurers or health care service plans for purposes other than those purposes authorized by law. (j) Patient records often contain the names of, and personal information regarding, persons other than the patient and the privacy of those persons should also be protected. SEC. 2. Section 56.104 is added to the Civil Code, to read: 56.104. (a) Notwithstanding subdivision (c) of Section 56.10, no provider of health care may release medical information to persons or entities authorized by law to receive that information pursuant to paragraphs (2), (3), and (7) to (10), inclusive, of, or to licensed health care service plans described in paragraph (4) of subdivision (c) of Section 56.10, if the requested information specifically relates to the patient's participation in outpatient treatment with a psychotherapist, unless the person or entity requesting that information submits to the patient pursuant to subdivision (b) and to the provider of health care a written request, signed by the person requesting the information or an authorized agent of the entity requesting the information, that includes all of the following: (1) The specific information relating to a patient's participation in outpatient treatment with a psychotherapist being requested and its specific intended use or uses. (2) The length of time during which the information will be kept before being destroyed or disposed of. A person or entity may extend that timeframe, provided that the person or entity notifies the provider of the extension. Any notification of an extension shall include the specific reason for the extension, the intended use or uses of the information during the extended time, and the expected date of the destruction of the information. (3) A statement that the information will not be used for any purpose other than its intended use. (4) A statement that the person or entity requesting the information will destroy the information and all copies in the person' s or entity's possession or control, will cause it to be destroyed, or will return the information and all copies of it before or immediately after the length of time specified in paragraph (2) has expired. (b) The person or entity requesting the information shall submit a copy of the written request required by this subdivision to the patient within 30 days of receipt of the information requested, unless the patient has signed a written waiver in the form of a letter signed and submitted by the patient to the provider of health care or health care service plan waiving notification. (c) For purposes of this section, "psychotherapist" means a person who is both a "psychotherapist" as defined in Section 1010 of the Evidence Code and a "provider of health care" as defined in subdivision (d) of Section 56.05 of the Civil Code. (d) This section shall not apply to uses of the information related to law enforcement and investigations of crimes or investigations of unprofessional conduct under the Business and Professions Code. (e) Nothing in this section shall be construed to grant any additional authority to a provider of health care to disclose information to a person or entity without the patient's consent. SEC. 3. Section 56.104 is added to the Civil Code, to read: 56.104. (a) Notwithstanding subdivision (c) of Section 56.10, no provider of health care, health care service plan, or contractor may release medical information to persons or entities authorized by law to receive that information pursuant to subdivision (c) of Section 56.10, if the requested information specifically relates to the patient's participation in outpatient treatment with a psychotherapist, unless the person or entity requesting that information submits to the patient pursuant to subdivision (b) and to the provider of health care, health care service plan, or contractor a written request, signed by the person requesting the information or an authorized agent of the entity requesting the information, that includes all of the following: (1) The specific information relating to a patient's participation in outpatient treatment with a psychotherapist being requested and its specific intended use or uses. (2) The length of time during which the information will be kept before being destroyed or disposed of. A person or entity may extend that timeframe, provided that the person or entity notifies the provider, plan, or contractor of the extension. Any notification of an extension shall include the specific reason for the extension, the intended use or uses of the information during the extended time, and the expected date of the destruction of the information. (3) A statement that the information will not be used for any purpose other than its intended use. (4) A statement that the person or entity requesting the information will destroy the information and all copies in the person' s or entity's possession or control, will cause it to be destroyed, or will return the information and all copies of it before or immediately after the length of time specified in paragraph (2) has expired. (b) The person or entity requesting the information shall submit a copy of the written request required by this section to the patient within 30 days of receipt of the information requested, unless the patient has signed a written waiver in the form of a letter signed and submitted by the patient to the provider of health care or health care service plan waiving notification. (c) For purposes of this section, "psychotherapist" means a person who is both a "psychotherapist" as defined in Section 1010 of the Evidence Code and a "provider of health care" as defined in subdivision (d) of Section 56.05 of the Civil Code. (d) This section does not apply to the disclosure or use of medical information by a law enforcement agency or a regulatory agency when required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law. (e) Nothing in this section shall be construed to grant any additional authority to a provider of health care, health care service plan, or contractor to disclose information to a person or entity without the patient's consent. SEC. 4. Section 56.35 of the Civil Code is amended to read: 56.35. In addition to any other remedies available at law, a patient whose medical information has been used or disclosed in violation of Section 56.10 or 56.104 or 56.20 or subdivision (a) of Section 56.26 and who has sustained economic loss or personal injury therefrom may recover compensatory damages, punitive damages not to exceed three thousand dollars ($3,000), attorneys' fees not to exceed one thousand dollars ($1,000), and the costs of litigation. SEC. 5. Section 3 of this act shall become operative only if SB 19 of the 1999-2000 Regular Session is enacted and amends Section 56.10 of the Civil Code, in which case Section 2 shall not become operative. SEC. 6. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.