BILL NUMBER: AB 1836	CHAPTERED  09/30/00

	CHAPTER   1068
	FILED WITH SECRETARY OF STATE   SEPTEMBER 30, 2000
	APPROVED BY GOVERNOR   SEPTEMBER 30, 2000
	PASSED THE SENATE   AUGUST 31, 2000
	PASSED THE ASSEMBLY   AUGUST 31, 2000
	AMENDED IN SENATE   AUGUST 30, 2000
	AMENDED IN SENATE   AUGUST 28, 2000
	AMENDED IN SENATE   AUGUST 25, 2000
	AMENDED IN SENATE   JULY 6, 2000
	AMENDED IN ASSEMBLY   MAY 22, 2000
	AMENDED IN ASSEMBLY   MAY 2, 2000
	AMENDED IN ASSEMBLY   APRIL 24, 2000

INTRODUCED BY   Assembly Members Bates, Cox, Longville, Oller, Robert
Pacheco, and Zettel
   (Coauthor:  Senator Rainey)

                        FEBRUARY 3, 2000

   An act to amend, repeal, and add Section 56.10 of the Civil Code,
and to amend Section 27491.1 of, and to amend, repeal, and add
Section 27491.8 of, the Government Code, relating to coroners.


	LEGISLATIVE COUNSEL'S DIGEST


   AB 1836, Bates.  Coroner's reports.
   (1) Under existing law, a provider of health care, health care
service plan, or contractor, as defined, may disclose medical
information, as defined, to the county coroner in the course of an
investigation by the coroner's office.
   This bill instead would require the disclosure when requested by a
coroner in the course of an investigation by the coroner's office,
in specified circumstances, and would authorize disclosure in other
circumstances.
   (2) Existing law requires the coroner, when seeking a confidential
communication of a deceased person concerning medical information
that is privileged, as specified, to provide notice to the decedent's
personal representative to provide the records to the presiding
judge of the superior court.  If the personal representative objects
in writing to the disclosure, the presiding judge is required to
examine the records in camera to determine whether the records must
be disclosed as provided.
   This bill would require that the coroner seeking those
confidential communications give notice to the person who has the
right to control disposition of the decedent's remains if there is no
personal representative.
   (3) This bill would repeal the new provisions described above on
January 1, 2003.
   (4) Existing law requires the coroner, in all cases in which a
person has died under circumstances that afford a reasonable ground
to suspect that the death has been occasioned by criminal means, to
notify the law enforcement agency having jurisdiction over the
criminal investigation.  The report is required to state all
information received by the coroner relating to the death.
   This bill would specify that the information in the report shall
include all medical information that is directly related to the
death, as specified.
   This bill would incorporate additional changes to Section 56.10 of
the Civil Code proposed by AB 2414, SB 1903, and SB 2094, to be
operative if this bill and one or more of the other bills are enacted
and become effective on or before January 1, 2001, and this bill is
enacted last.


THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:


  SECTION 1.  Section Section 56.10 of the Civil Code is amended to
read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1200) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted statute
that is enacted before January 1, 2003, deletes or extends that
date.
  SEC. 1.2.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes. However, no information so disclosed shall be
further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.3.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in
                     a proceeding before a court or administrative
agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1200) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.4.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1200) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractor's or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.5.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without                                            delay
upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.6.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan to monitor or administer
care of enrollees for a covered benefit, provided that the disease
management services and care are authorized by a treating physician,
or (B) to any disease management organization, as defined in Section
1399.900 of the Health and Safety Code, that complies fully with the
physician authorization requirements of Section 1399.902 of the
Health and Safety Code, provided that the health care service plan or
its contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.7.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
                                          information requested by
the coroner under this paragraph shall be limited to information
regarding the patient who is the decedent and who is the subject of
the investigation and shall be disclosed to the coroner without delay
upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1200) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractor's or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.8.  Section 56.10 of the Civil Code is amended to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) By a coroner, when requested in the course of an investigation
by the coroner's office for the purpose of identifying the decedent
or locating next of kin, or when investigating deaths that may
involve public health concerns, organ or tissue donation, child
abuse, elder abuse, suicides, poisonings, accidents, sudden infant
death, suspicious deaths, unknown deaths, or criminal deaths, or when
otherwise authorized by the decedent's representative.  Medical
information requested by the coroner under this paragraph shall be
limited to information regarding the patient who is the decedent and
who is the subject of the investigation and shall be disclosed to the
coroner without delay upon request.
   (9) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractor's or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office when requested for
all purposes not included in paragraph (8) of subdivision (b).
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 1.9.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1200) of Division 2 of the Health
         and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes. However, no information so disclosed shall be
further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall become operative on January 1, 2004.
  SEC. 1.10.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall become operative January 1, 2003.
  SEC. 1.11.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, or health care service
plan, or contractor shall disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan without first obtaining an
authorization, except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1200) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.

(7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall become operative on January 1, 2003.
  SEC. 1.12.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1200) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall become operative January 1, 2003.
  SEC. 1.13.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, or other health care professionals or
facilities for purposes of diagnosis or treatment of the patient.
This includes, in an emergency situation, the communication of
patient information by radio transmission between emergency medical
personnel at the scene of an emergency, or in an emergency medical
transport vehicle, and emergency medical personnel at a health
facility licensed pursuant to Chapter 2 (commencing with Section
1250) of Division 2 of the Health and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, or any other person or entity
responsible for paying for health care services rendered to the
patient, to the extent necessary to allow responsibility for payment
to be determined and payment to be made.  If (A) the patient is, by
reason of a comatose or other disabling medical condition, unable to
consent to the disclosure of medical information and (B) no other
arrangements have been made to pay for the health care services being
rendered to the patient, the information may be disclosed to a
governmental authority to the extent necessary to determine the
patient's eligibility for, and to obtain, payment under a
governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, or persons or organizations insuring, responsible for, or
defending professional liability that a provider may incur, if the
committees, agents, plans, organizations, or persons are engaged in
reviewing the competence or qualifications of health care
professionals or in reviewing health care services with respect to
medical necessity, level of care, quality of care, or justification
of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation
officer, or domestic relations investigator engaged in determining
the need for an initial guardianship or continuation of an existent
guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall become operative January 1, 2003.
  SEC. 1.14.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan, or contractor
shall intentionally share, sell, or otherwise use any medical
information for any purpose not necessary to provide health care
services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor shall further disclose medical information regarding a
patient of the provider of health care or an enrollee or subscriber
of a health care service plan or insurer or self-insured employer
received under this section to any person or entity that is not
engaged in providing direct health care services to the patient or
his or her provider of health care or health care service plan or
insurer or self-insured employer.
   (f) This section shall become operative January 1, 2003.
  SEC. 1.15.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1200) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2). However, no information so disclosed shall be further
disclosed by the recipient in any way that would be violative of
this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way
that would be violative of this part, including the unauthorized
manipulation of coded or encrypted medical information that reveals
individually identifiable medical information.
   (17) For purposes of chronic disease management programs,
information may be disclosed to any entity contracting with a health
care service plan to monitor or administer care of enrollees for a
covered benefit, provided that the disease management services and
care are authorized by a treating physician.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
  SEC. 1.16.  Section 56.10 is added to the Civil Code, to read:
   56.10.  (a) No provider of health care, health care service plan,
or contractor shall disclose medical information regarding a patient
of the provider of health care or an enrollee or subscriber of a
health care service plan without first obtaining an authorization,
except as provided in subdivision (b) or (c).
   (b) A provider of health care, a health care service plan, or a
contractor shall disclose medical information if the disclosure is
compelled by any of the following:
   (1) By a court pursuant to an order of that court.
   (2) By a board, commission, or administrative agency for purposes
of adjudication pursuant to its lawful authority.
   (3) By a party to a proceeding before a court or administrative
agency pursuant to a subpoena, subpoena duces tecum, notice to appear
served pursuant to Section 1987 of the Code of Civil Procedure, or
any provision authorizing discovery in a proceeding before a court or
administrative agency.
   (4) By a board, commission, or administrative agency pursuant to
an investigative subpoena issued under Article 2 (commencing with
Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the
Government Code.
   (5) By an arbitrator or arbitration panel, when arbitration is
lawfully requested by either party, pursuant to a subpoena duces
tecum issued under Section 1282.6 of the Code of Civil Procedure, or
any other provision authorizing discovery in a proceeding before an
arbitrator or arbitration panel.
   (6) By a search warrant lawfully issued to a governmental law
enforcement agency.
   (7) By the patient or the patient's representative pursuant to
Chapter 1 (commencing with Section 123100) of Part 1 of Division 106
of the Health and Safety Code.
   (8) When otherwise specifically required by law.
   (c) A provider of health care, or a health care service plan may
disclose medical information as follows:
   (1) The information may be disclosed to providers of health care,
health care service plans, contractors, or other health care
professionals or facilities for purposes of diagnosis or treatment of
the patient.  This includes, in an emergency situation, the
communication of patient information by radio transmission or other
means between emergency medical personnel at the scene of an
emergency, or in an emergency medical transport vehicle, and
emergency medical personnel at a health facility licensed pursuant to
Chapter 2 (commencing with Section 1250) of Division 2 of the Health
and Safety Code.
   (2) The information may be disclosed to an insurer, employer,
health care service plan, hospital service plan, employee benefit
plan, governmental authority, contractor, or any other person or
entity responsible for paying for health care services rendered to
the patient, to the extent necessary to allow responsibility for
payment to be determined and payment to be made.  If (A) the patient
is, by reason of a comatose or other disabling medical condition,
unable to consent to the disclosure of medical information and (B) no
other arrangements have been made to pay for the health care
services being rendered to the patient, the information may be
disclosed to a governmental authority to the extent necessary to
determine the patient's eligibility for, and to obtain, payment under
a governmental program for health care services provided to the
patient.  The information may also be disclosed to another provider
of health care or health care service plan as necessary to assist the
other provider or health care service plan in obtaining payment for
health care services rendered by that provider of health care or
health care service plan to the patient.
   (3) The information may be disclosed to any person or entity that
provides billing, claims management, medical data processing, or
other administrative services for providers of health care or health
care service plans or for any of the persons or entities specified in
paragraph (2).  However, no information so disclosed shall be
further disclosed by the recipient in any way that would be violative
of this part.
   (4) The information may be disclosed to organized committees and
agents of professional societies or of medical staffs of licensed
hospitals, licensed health care service plans, professional standards
review organizations, independent medical review organizations and
their selected reviewers, utilization and quality control peer review
organizations as established by Congress in Public Law 97-248 in
1982, contractors, or persons or organizations insuring, responsible
for, or defending professional liability that a provider may incur,
if the committees, agents, health care service plans, organizations,
reviewers, contractors, or persons are engaged in reviewing the
competence or qualifications of health care professionals or in
reviewing health care services with respect to medical necessity,
level of care, quality of care, or justification of charges.
   (5) The information in the possession of any provider of health
care or health care service plan may be reviewed by any private or
public body responsible for licensing or accrediting the provider of
health care or health care service plan.  However, no patient
identifying medical information may be removed from the premises
except as expressly permitted or required elsewhere by law, nor shall
that information be further disclosed by the recipient in any way
that would violate this part.
   (6) The information may be disclosed to the county coroner in the
course of an investigation by the coroner's office.
   (7) The information may be disclosed to public agencies, clinical
investigators, including investigators conducting epidemiologic
studies, health care research organizations, and accredited public or
private nonprofit educational or health care institutions for bona
fide research purposes.  However, no information so disclosed shall
be further disclosed by the recipient in any way that would disclose
the identity of any patient or be violative of this part.
   (8) A provider of health care or health care service plan that has
created medical information as a result of employment-related health
care services to an employee conducted at the specific prior written
request and expense of the employer may disclose to the employee's
employer that part of the information that:
   (A) Is relevant in a law suit, arbitration, grievance, or other
claim or challenge to which the employer and the employee are parties
and in which the patient has placed in issue his or her medical
history, mental or physical condition, or treatment, provided that
information may only be used or disclosed in connection with that
proceeding.
   (B) Describes functional limitations of the patient that may
entitle the patient to leave from work for medical reasons or limit
the patient's fitness to perform his or her present employment,
provided that no statement of medical cause is included in the
information disclosed.
   (9) Unless the provider of health care or health care service plan
is notified in writing of an agreement by the sponsor, insurer, or
administrator to the contrary, the information may be disclosed to a
sponsor, insurer, or administrator of a group or individual insured
or uninsured plan or policy that the patient seeks coverage by or
benefits from, if the information was created by the provider of
health care or health care service plan as the result of services
conducted at the specific prior written request and expense of the
sponsor, insurer, or administrator for the purpose of evaluating the
application for coverage or benefits.
   (10) The information may be disclosed to a health care service
plan by providers of health care that contract with the health care
service plan and may be transferred among providers of health care
that contract with the health care service plan, for the purpose of
administering the health care service plan.  Medical information may
not otherwise be disclosed by a health care service plan except in
accordance with the provisions of this part.
   (11) Nothing in this part shall prevent the disclosure by a
provider of health care or a health care service plan to an insurance
institution, agent, or support organization, subject to Article 6.6
(commencing with Section 791) of Part 2 of Division 1 of the
Insurance Code, of medical information if the insurance institution,
agent, or support organization has complied with all requirements for
obtaining the information pursuant to Article 6.6 (commencing with
Section 791) of Part 2 of Division 1 of the Insurance Code.
   (12) The information relevant to the patient's condition and care
and treatment provided may be disclosed to a probate court
investigator engaged in determining the need for an initial
conservatorship or continuation of an existent conservatorship, if
the patient is unable to give informed consent, or to a probate court
investigator, probation officer, or domestic relations investigator
engaged in determining the need for an initial guardianship or
continuation of an existent guardianship.
   (13) The information may be disclosed to an organ procurement
organization or a tissue bank processing the tissue of a decedent for
transplantation into the body of another person, but only with
respect to the donating decedent, for the purpose of aiding the
transplant.  For the purpose of this paragraph, the terms "tissue
bank" and "tissue" have the same meaning as defined in Section 1635
of the Health and Safety Code.
   (14) The information may be disclosed when the disclosure is
otherwise specifically authorized by law, such as the voluntary
reporting, either directly or indirectly, to the federal Food and
Drug Administration of adverse events related to drug products or
medical device problems.
   (15) Basic information including the patient's name, city of
residence, age, sex, and general condition may be disclosed to a
state or federally recognized disaster relief organization for the
purpose of responding to disaster welfare inquiries.
   (16) The information may be disclosed to a third party for
purposes of encoding, encrypting, or otherwise anonymizing data.
However, no information so disclosed shall be further disclosed by
the recipient in any way that would be violative of this part,
including the unauthorized manipulation of coded or encrypted medical
information that reveals individually identifiable medical
information.
   (17) For purposes of disease management programs and services as
defined in Section 1399.901 of the Health and Safety Code,
information may be disclosed as follows:  (A) to any entity
contracting with a health care service plan or the health care
service plan's contractors to monitor or administer care of enrollees
for a covered benefit, provided that the disease management services
and care are authorized by a treating physician, or (B) to any
disease management organization, as defined in Section 1399.900 of
the Health and Safety Code, that complies fully with the physician
authorization requirements of Section 1399.902 of the Health and
Safety Code, provided that the health care service plan or its
contractor provides or has provided a description of the disease
management services to a treating physician or to the health care
service plan's or contractor's network of physicians.  Nothing in
this paragraph shall be construed to require physician authorization
for the care or treatment of the adherents of any well-recognized
church or religious denomination who depend solely upon prayer or
spiritual means for healing in the practice of the religion of that
church or denomination.
   (d) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
provider of health care, health care service plan contractor, or
corporation and its subsidiaries and affiliates shall intentionally
share, sell, or otherwise use any medical information for any purpose
not necessary to provide health care services to the patient.
   (e) Except to the extent expressly authorized by the patient or
enrollee or subscriber or as provided by subdivisions (b) and (c), no
contractor or corporation and its subsidiaries and affiliates shall
further disclose medical information regarding a patient of the
provider of health care or an enrollee or subscriber of a health care
service plan or insurer or self-insured employer received under this
section to any person or entity that is not engaged in providing
direct health care services to the patient or his or her provider of
health care or health care service plan or insurer or self-insured
employer.
   (f) This section shall become operative January 1, 2003.
  SEC. 2.  Section 27491.1 of the Government Code is amended to read:

   27491.1.  In all cases in which a person has died under
circumstances that afford a reasonable ground to suspect that the
person's death has been occasioned by the act of another by criminal
means, the coroner, upon determining that those reasonable grounds
exist, shall immediately notify the law enforcement agency having
jurisdiction over the criminal investigation.  Notification shall be
made by the most direct communication available.  The report shall
state the name of the deceased person, if known, the location of the
remains, and other information received by the coroner relating to
the death, including any medical information of the decedent that is
directly related to the death.  The report shall not include any
information contained in the decedent's medical records regarding any
other person unless that information is relevant and directly
related to the decedent's death.
  SEC. 3.  Section 27491.8 of the Government Code is amended to read:

   27491.8.  (a) When the coroner seeks a confidential communication
of a deceased person that is privileged under Article 6 (commencing
with Section 990) or Article 7 (commencing with Section 1010) of
Chapter 4 of Division 8 of the Evidence Code, by means of a subpoena
or subpoena duces tecum, for the purpose of inquiry into, and
determination of, the circumstances, manner, and cause of death as
set forth in Section 27491, or for the sole purpose of being
introduced as evidence at a coroner's inquest proceeding, the coroner
shall provide notice to the decedent's personal representative,
appointed by the court, if any personally or at his or her last known
address, not less than seven days prior to the date the records are
to be delivered to the presiding judge of the superior court.  If no
personal representative has been appointed by the court, the coroner
shall provide notice to the person who has the right to control
disposition of the decedent's remains, as defined in paragraphs (1)
to (4), inclusive, of subdivision (a) of, and paragraphs (1) and (2)
of subdivision (b) of Section 7100 of the Health and Safety Code, to
the extent known.  The notice shall inform the personal
representative or the person with the right to control disposition of
the decedent's remains that he or she may provide to the court a
written objection to the disclosure or to any part thereof, on or
before the date for delivery thereof to the court.  The custodian
shall deliver the records to the presiding judge of the superior
court in a confidential manner.  The presiding judge shall examine
the records in camera.  If there is good cause, the presiding judge
shall direct the custodian to disclose to the coroner those portions
of the records which the judge determines are relevant to the coroner'
s inquiry or inquest.
   (b) A communication made available to the coroner pursuant to this
section is confidential, and shall not be distributed or made
available to any other person, agency, firm, or corporation, except
as follows:
   (1) When introduced into evidence at a coroner's inquest
proceeding.
   (2) When included in a coroner's official report for the purpose
of establishing the cause, manner, and circumstances of death.
   (3) When otherwise required by law.
   (c) This communication shall not be admissible as former testimony
pursuant to Article 9 (commencing with Section 1290) of Chapter 2 of
Division 10 of the Evidence Code unless otherwise admissible by law.

   (d) After the investigation or inquest has terminated, the court
shall order the records produced to the coroner containing the
confidential communication to be sealed or destroyed if necessary to
protect the confidentiality of the decedent's medical or mental
health information.
   (e) This section shall remain in effect only until January 1,
2003, and as of that date is repealed, unless a later enacted
statute, that is enacted before January 1, 2003, deletes or extends
that date.
  SEC. 4.  Section 27491.8 is added to the Government Code, to read:

   27491.8.  (a) When the coroner seeks a confidential communication
of a deceased person that is privileged under Article 6 (commencing
with Section 990) or Article 7 (commencing with Section 1010) of
Chapter 4 of Division 8 of the Evidence Code, by means of a subpoena
or subpoena duces tecum, for the purpose of inquiry into, and
determination of, the circumstances, manner, and cause of death as
set forth in Section 27491, or for the sole purpose of being
introduced as evidence at a coroner's inquest proceeding, the coroner
shall provide notice to the decedent's personal representative
personally or at his or her last known address, not less than 15 days
prior to the date the records are to be delivered to the presiding
judge of the superior court.  The notice shall inform the personal
representative that he or she may provide to the court a written
objection to the disclosure or to any part thereof, on or before the
date for delivery thereof to the court.  The custodian shall deliver
the records to the presiding judge of the superior court in a
confidential manner.  The presiding judge shall examine the records
in camera. If there is good cause, the presiding judge shall direct
the custodian to disclose to the coroner those portions of the
records which the judge determines are relevant to the coroner's
inquiry or inquest.
   (b) A communication made available to the coroner pursuant to this
section is confidential, except insofar as it is introduced into
evidence at a coroner's inquest proceeding, and shall not be
distributed or made available to any other person, agency, firm, or
corporation.
   (c) This communication shall not be admissible as former testimony
pursuant to Article 9 (commencing with Section 1290) of Chapter 2 of
Division 10 of the Evidence Code.
   (d) After the investigation or inquest has terminated, the court
shall order the records thereof to be sealed as necessary to protect
the confidentiality of the decedent's medical or mental health
information.
   (e) This section shall become operative on January 1, 2003.
  SEC. 5.  (a) Sections 1.2 and 1.10 of this bill incorporate
amendments to Section 56.10 of the Civil Code proposed by both this
bill and AB 2414.  They shall only become operative if (1) both bills
are enacted and become effective on or before January 1, 2001, (2)
each bill amends Section 56.10 of the Civil Code, (3) SB 1903 and SB
2094 are not enacted or as enacted do not amend that section, and (4)
this bill is enacted after AB 2414, in which case Sections 1, 1.3,
1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.11, 1.12, 1.13, 1.14, 1.15, and 1.16
of this bill shall not become operative.
   (b) Sections 1.3 and 1.11 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by both this bill and SB
1903.  They shall only become operative if (1) both bills are enacted
and become effective on or before January 1, 2001, (2) each bill
amends Section 56.10 of the Civil Code, (3) AB 2414 and SB 2094 are
not enacted or as enacted do not amend that section, and (4) this
bill is enacted after SB 1903, in which case Sections 1, 1.2, 1.4,
1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.12, 1.13, 1.14, 1.15, and 1.16 of
this bill shall not become operative.
   (c) Sections 1.4 and 1.12 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by both this bill and SB
2094.  They shall only become operative if (1) both bills are enacted
and become effective on or before January 1, 2001, (2) each bill
amends Section 56.10 of the Civil Code, (3) AB 2414 and SB 1903 are
not enacted or as enacted do not amend that section, and (4) this
bill is enacted after SB 2094, in which case Sections 1, 1.2, 1.3,
1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.13, 1.14, 1.15, and 1.16 of
this bill shall not become operative.
   (d) Sections 1.5 and 1.13 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by this bill, AB 2414, and
SB 1903.  They shall only become operative if (1) all three bills are
enacted and become effective on or before January 1, 2001, (2) each
bill amends Section 56.10 of the Civil Code, (3) SB 2094 is not
enacted or as enacted does not amend that section, and (4) this bill
is enacted after AB 2414 and SB 1903, in which case Sections 1, 1.2,
1.3, 1.4, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.14, 1.15, and 1.16
of this bill shall not become operative.
   (e) Sections 1.6 and 1.14 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by this bill, AB 2414, and
SB 2904.  They shall only become operative if (1) all three bills are
enacted and become effective on or before January 1, 2001, (2) each
bill amends Section 56.10 of the Civil Code, (3) SB 1903 is not
enacted or as enacted does not amend that section, and (4) this bill
is enacted after AB 2414 and SB 2094, in which case Sections 1, 1.2,
1.3, 1.4, 1.5, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.15, and 1.16
of this bill shall not become operative.
   (f) Sections 1.7 and 1.15 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by this bill, SB 1903, and
SB 2904.  They shall only become operative if (1) all three bills are
enacted and become effective on or before January 1, 2001, (2) each
bill amends Section 56.10 of the Civil Code, (3) AB 2414 is not
enacted or as enacted does not amend that section, and (4) this bill
is enacted after SB 1903 and SB 2094, in which case Sections 1, 1.2,
1.3, 1.4, 1.5, 1.6, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, and 1.16
of this bill shall not become operative.
   (g) Sections 1.8 and 1.16 of this bill incorporate amendments to
Section 56.10 of the Civil Code proposed by this bill, AB 2414, SB
1903, and SB 2094.  They shall only become operative if (1) all four
bills are enacted and become effective on or before January 1, 2001,
(2) each bill amends Section 56.10 of the Civil Code, (3) this bill
is enacted after AB 2414, SB 1903, and SB 2094, in which case
Sections 1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.9, 1.10, 1.11, 1.12,
1.13, 1.14, and 1.15 of this bill shall not become operative.