BILL NUMBER: SB 1903 CHAPTERED 09/30/00 CHAPTER 1066 FILED WITH SECRETARY OF STATE SEPTEMBER 30, 2000 APPROVED BY GOVERNOR SEPTEMBER 30, 2000 PASSED THE SENATE AUGUST 31, 2000 PASSED THE ASSEMBLY AUGUST 30, 2000 AMENDED IN ASSEMBLY AUGUST 29, 2000 AMENDED IN ASSEMBLY JULY 6, 2000 AMENDED IN ASSEMBLY JUNE 22, 2000 AMENDED IN SENATE APRIL 24, 2000 INTRODUCED BY Senator Speier FEBRUARY 24, 2000 An act to amend Sections 56.10 and 56.11 of, and to add Section 56.07 to, the Civil Code, and to add Section 123111 to the Health and Safety Code, relating to medical information. LEGISLATIVE COUNSEL'S DIGEST SB 1903, Speier. Medical information: requests for disclosure. Existing law, the Confidentiality of Medical Information Act, provides that, except in specified circumstances, medical information, as defined, may not be disclosed by providers of health care, health care service plans, or contractors, as defined, without the patient's written authorization. Existing law also prohibits a provider of health care, health care service plan, or contractor from intentionally sharing, selling, or otherwise using any medical information not necessary to provide health care services to the patient, except as specified. Existing law also prohibits a provider of health care, a health care services plan, or a contractor from further disclosing medical information to any person or entity that is not engaged in providing direct health care services, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties. For purposes of the act, "providers of health care" includes corporations organized for the primary purpose of maintaining medical information, as specified. This bill would make the provisions prohibiting sharing, selling, or using medical information for purposes other than provision of health care services applicable to corporations and their subsidiaries and affiliates. The bill would also require a valid authorization for the release of medical information to a person or entity not otherwise authorized by law to obtain such information. Violation of these requirements resulting in economic loss would be a misdemeanor. By creating new crimes, the bill would create a state-mandated local program. The bill would also require specified corporations and entities that maintain medical profiles, summaries, or information, except as specified, to provide the patient with a copy thereof at no charge, upon request. Existing law provides that an adult patient shall be entitled to inspect his or her patient records upon written request to the health care provider. This bill would authorize an adult patient to prepare a specified addendum to his or her patient records and require the health care provider to attach that addendum to the patient's records. The bill would also specify that the health care provider shall not be liable for the receipt and inclusion, in and of itself, of the contents of a patient's addendum in the patient's records, as specified. This bill would incorporate additional changes to Section 56.10 of the Civil Code proposed by AB 2414 and SB 2094, to be operative if this bill and one or more of the other bills are enacted and become effective on or before January 1, 2001, and this bill is enacted last. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 56.07 is added to the Civil Code, to read: 56.07. (a) Except as provided in subdivision (c), upon the patient's written request, any corporation described in Section 56.06, or any other entity that compiles or maintains medical information for any reason, shall provide the patient, at no charge, with a copy of any medical profile, summary, or information maintained by the corporation or entity with respect to the patient. (b) A request by a patient pursuant to this section shall not be deemed to be an authorization by the patient for the release or disclosure of any information to any person or entity other than the patient. (c) This section shall not apply to any patient records that are subject to inspection by the patient pursuant to Section 123110 of the Health and Safety Code and shall not be deemed to limit the right of a health care provider to charge a fee for the preparation of a summary of patient records as provided in Section 123130 of the Health and Safety Code. This section shall not apply to a health care service plan licensed pursuant to Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code or a disability insurer licensed pursuant to the Insurance Code. This section shall not apply to medical information compiled or maintained by a fire and casualty insurer or its retained counsel in the regular course of investigating or litigating a claim under a policy of insurance that it has written. For the purposes of this section, a fire and casualty insurer is an insurer writing policies that may be sold by a fire and casualty licensee pursuant to Section 1625 of the Insurance Code. SEC. 2. Section 56.10 of the Civil Code is amended to read: 56.10. (a) No provider of health care, or health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c). (b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following: (1) By a court pursuant to an order of that court. (2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority. (3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency. (4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code. (5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel. (6) By a search warrant lawfully issued to a governmental law enforcement agency. (7) By the patient or the patient's representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code. (8) When otherwise specifically required by law. (c) A provider of health care, or a health care service plan may disclose medical information as follows: (1) The information may be disclosed to providers of health care, health care service plans, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1200) of Division 2 of the Health and Safety Code. (2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient's eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient. (3) The information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part. (4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, plans, organizations, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges. (5) The information in the possession of any provider of health care or health care service plan may be reviewed by any private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law. (6) The information may be disclosed to the county coroner in the course of an investigation by the coroner's office. (7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of any patient or be violative of this part. (8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee's employer that part of the information that: (A) Is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding. (B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient's fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed. (9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits. (10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part. (11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code. (12) The information relevant to the patient's condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship. (13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms "tissue bank" and "tissue" have the same meaning as defined in Section 1635 of the Health and Safety Code. (14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, such as the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems. (15) Basic information including the patient's name, city of residence, age, sex, and general condition may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries. (16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information. (17) For purposes of chronic disease management programs, information may be disclosed to any entity contracting with a health care service plan to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician. (d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient. (e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer. SEC. 2.1. Section 56.10 of the Civil Code is amended to read: 56.10. (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c). (b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following: (1) By a court pursuant to an order of that court. (2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority. (3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency. (4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code. (5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel. (6) By a search warrant lawfully issued to a governmental law enforcement agency. (7) By the patient or the patient's representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code. (8) When otherwise specifically required by law. (c) A provider of health care, or a health care service plan may disclose medical information as follows: (1) The information may be disclosed to providers of health care, health care service plans, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code. (2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient's eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient. (3) The information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part. (4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, plans, organizations, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges. (5) The information in the possession of any provider of health care or health care service plan may be reviewed by any private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law. (6) The information may be disclosed to the county coroner in the course of an investigation by the coroner's office. (7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of any patient or be violative of this part. (8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee's employer that part of the information that: (A) Is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding. (B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient's fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed. (9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits. (10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part. (11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code. (12) The information relevant to the patient's condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship. (13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms "tissue bank" and "tissue" have the same meaning as defined in Section 1635 of the Health and Safety Code. (14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, such as the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems. (15) Basic information including the patient's name, city of residence, age, sex, and general condition may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries. (16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information. (17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to any entity contracting with a health care service plan or the health care service plan's contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician, or (B) to any disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan's or contractor's network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of any well-recognized church or religious denomination who depend upon prayer or spiritual means for healing in the practice of the religion of that church or denomination. (d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient. (e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries or affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer. SEC. 2.2. Section 56.10 of the Civil Code is amended to read: 56.10. (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c). (b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following: (1) By a court pursuant to an order of that court. (2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority. (3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency. (4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code. (5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel. (6) By a search warrant lawfully issued to a governmental law enforcement agency. (7) By the patient or the patient's representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code. (8) When otherwise specifically required by law. (c) A provider of health care, or a health care service plan may disclose medical information as follows: (1) The information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1200) of Division 2 of the Health and Safety Code. (2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient's eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient. (3) The information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part. (4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges. (5) The information in the possession of any provider of health care or health care service plan may be reviewed by any private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part. (6) The information may be disclosed to the county coroner in the course of an investigation by the coroner's office. (7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of any patient or be violative of this part. (8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee's employer that part of the information that: (A) Is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding. (B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient's fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed. (9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits. (10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part. (11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code. (12) The information relevant to the patient's condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship. (13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms "tissue bank" and "tissue" have the same meaning as defined in Section 1635 of the Health and Safety Code. (14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, such as the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems. (15) Basic information including the patient's name, city of residence, age, sex, and general condition may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries. (16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information. (17) For purposes of chronic disease management programs, information may be disclosed to any entity contracting with a health care service plan to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician. (d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient. (e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer. SEC. 2.3. Section 56.10 of the Civil Code is amended to read: 56.10. (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c). (b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following: (1) By a court pursuant to an order of that court. (2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority. (3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency. (4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code. (5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel. (6) By a search warrant lawfully issued to a governmental law enforcement agency. (7) By the patient or the patient's representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code. (8) When otherwise specifically required by law. (c) A provider of health care, or a health care service plan may disclose medical information as follows: (1) The information may be disclosed to providers of health care, health care service plans, contractor's or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code. (2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient's eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient. (3) The information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part. (4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges. (5) The information in the possession of any provider of health care or health care service plan may be reviewed by any private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part. (6) The information may be disclosed to the county coroner in the course of an investigation by the coroner's office. (7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of any patient or be violative of this part. (8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee's employer that part of the information that: (A) Is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding. (B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient's fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed. (9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits. (10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part. (11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code. (12) The information relevant to the patient's condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship. (13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms "tissue bank" and "tissue" have the same meaning as defined in Section 1635 of the Health and Safety Code. (14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, such as the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems. (15) Basic information including the patient's name, city of residence, age, sex, and general condition may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries. (16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would be violative of this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information. (17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to any entity contracting with a health care service plan or the health care service plan's contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician, or (B) to any disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan's or contractor's network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of any well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination. (d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient. (e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer. SEC. 3. Section 56.11 of the Civil Code is amended to read: 56.11. Any person or entity that wishes to obtain medical information pursuant to subdivision (a) of Section 56.10, other than a person or entity authorized to receive medical information pursuant to subdivision (b) or (c) of Section 56.10, shall obtain a valid authorization for the release of this information. An authorization for the release of medical information by a provider of health care, a health care service plan, or contractor shall be valid if it: (a) Is handwritten by the person who signs it or is in typeface no smaller than 8-point type. (b) Is clearly separate from any other language present on the same page and is executed by a signature which serves no other purpose than to execute the authorization. (c) Is signed and dated by one of the following: (1) The patient. A patient who is a minor may only sign an authorization for the release of medical information obtained by a provider of health care, health care service plan, or contractor in the course of furnishing services to which the minor could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60). (2) The legal representative of the patient, if the patient is a minor or an incompetent. However, authorization may not be given under this subdivision for the disclosure of medical information obtained by the provider of health care, a health care service plan, or a contractor in the course of furnishing services to which a minor patient could lawfully have consented under Part 1 (commencing with Section 25) or Part 2.7 (commencing with Section 60). (3) The spouse of the patient or the person financially responsible for the patient, where the medical information is being sought for the sole purpose of processing an application for health insurance or for enrollment in a nonprofit hospital plan, a health care service plan, or an employee benefit plan, and where the patient is to be an enrolled spouse or dependent under the policy or plan. (4) The beneficiary or personal representative of a deceased patient. (d) States the specific uses and limitations on the types of medical information to be disclosed. (e) States the name or functions of the provider of health care, health care service plan, or contractor that may disclose the medical information. (f) States the name or functions of the persons or entities authorized to receive the medical information. (g) States the specific uses and limitations on the use of the medical information by the persons or entities authorized to receive the medical information. (h) States a specific date after which the provider of health care, health care service plan, or contractor is no longer authorized to disclose the medical information. (i) Advises the person signing the authorization of the right to receive a copy of the authorization. SEC. 4. Section 123111 is added to the Health and Safety Code, to read: 123111. (a) Any adult patient who inspects his or her patient records pursuant to Section 123110 shall have the right to provide to the health care provider a written addendum with respect to any item or statement in his or her records that the patient believes to be incomplete or incorrect. The addendum shall be limited to 250 words per alleged incomplete or incorrect item in the patient's record and shall clearly indicate in writing that the patient wishes the addendum to be made a part of his or her record. (b) The health care provider shall attach the addendum to the patient's records and shall include that addendum whenever the health care provider makes a disclosure of the allegedly incomplete or incorrect portion of patient's records to any third party. (c) The receipt of information in a patient's addendum which contains defamatory or otherwise unlawful language, and the inclusion of this information in the patient's records, in accordance with subdivision (b), shall not, in and of itself, subject the health care provider to liability in any civil, criminal, administrative, or other proceeding. (d) Subdivision (f) of Section 123110 and Section 123120 shall be applicable with respect to any violation of this section by a health care provider. SEC. 5. (a) Section 2.1 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by both this bill and AB 2414. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2001, (2) each bill amends Section 56.10 of the Civil Code, and (3) SB 2094 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after AB 2414, in which case Sections 2, 2.2, and 2.3 of this bill shall not become operative. (b) Section 2.2 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by both this bill and SB 2094. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2001, (2) each bill amends Section 56.10 of the Civil Code, (3) AB 2414 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after SB 2094 in which case Sections 2, 2.1 and 2.3 of this bill shall not become operative. (c) Section 2.3 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by this bill, AB 2414, and SB 2094. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2001, (2) all three bills amend Section 56.10 of the Civil Code, and (3) this bill is enacted after AB 2414 and SB 2094, in which case Sections 2,2.1 and 2.2 of this bill shall not become operative. SEC. 6. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.