BILL NUMBER: SB 337 AMENDED
BILL TEXT
AMENDED IN ASSEMBLY SEPTEMBER 4, 2009
AMENDED IN ASSEMBLY AUGUST 17, 2009
AMENDED IN ASSEMBLY JULY 7, 2009
AMENDED IN ASSEMBLY JUNE 17, 2009
AMENDED IN SENATE MAY 6, 2009
AMENDED IN SENATE APRIL 22, 2009
INTRODUCED BY Senator Alquist
FEBRUARY 25, 2009
An act to amend Section 1280.15 of of, and
to add Division 109.5 (commencing with Section 130250) to, the
Health and Safety Code, relating to health facilities
public health .
LEGISLATIVE COUNSEL'S DIGEST
SB 337, as amended, Alquist. Patient medical information:
disclosure: reporting. Health information.
Existing
(1) Existing law establishes
provisions for the licensing and certification of clinics, health
facilities, home health agencies, and hospices under the jurisdiction
of the State Department of Public Health. Existing law requires
these entities to prevent unlawful or unauthorized access to, and use
or disclosure of, a patient's medical information, and authorizes
the department to assess administrative penalties for violations.
Existing law also requires these entities to report instances of
unlawful or unauthorized access to, and use or disclosure of, a
patient's medical information to the department and to the affected
patient or patient's representative, as prescribed, within 5 days of
detecting it.
This bill would specify that this period is 5 business days.
This bill would require a clinic, health facility, home health
agency, or hospice to delay reporting to the affected patient or
patient's representative the unlawful or unauthorized access to, and
use or disclosure of, a patient's medical information beyond 5
business days, as specified, if a law enforcement agency or official
provides a written or oral statement that compliance with that
reporting requirement would impede the law enforcement agency's
activities that relate to the unlawful or unauthorized access to, and
use or disclosure of, a patients medical information and specifying
the date upon which the delay shall end, as prescribed.
(2) Existing law establishes the Office of Health Information
Integrity within the California Health and Human Services Agency to
ensure the enforcement of state law mandating confidentiality of
medical information and to impose administrative fines for the
unauthorized use of medical information.
This bill would, in addition, authorize the California Health and
Human Services Agency to apply for federal health information
technology and exchange funding and would, if no application is made
by that date, require selection of a state-designated qualified
nonprofit agency for the purposes of submitting an application for
federal health information technology and exchange funding.
This bill, in the event that the California Health and Human
Services Agency applies for and receives federal health information
technology and exchange funding, would create the California Health
Information Technology and Exchange Fund in the State Treasury. The
bill would require that all moneys in the fund be available, upon
appropriation by the Legislature, for purposes related to health
information technology and exchange. The bill would provide that the
fund shall consist of, but would not be limited to, federal health
information technology and exchange funding.
Vote: majority. Appropriation: no. Fiscal committee: yes.
State-mandated local program: no.
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. Section 1280.15 of the Health and Safety Code is
amended to read:
1280.15. (a) A clinic, health facility, home health agency, or
hospice licensed pursuant to Section 1204, 1250, 1725, or 1745 shall
prevent unlawful or unauthorized access to, and use or disclosure of,
patients' medical information, as defined in subdivision (g) of
Section 56.05 of the Civil Code and consistent with Section 130203.
The department, after investigation, may assess an administrative
penalty for a violation of this section of up to twenty-five thousand
dollars ($25,000) per patient whose medical information was
unlawfully or without authorization accessed, used, or disclosed, and
up to seventeen thousand five hundred dollars ($17,500) per
subsequent occurrence of unlawful or unauthorized access, use, or
disclosure of that patients' medical information. For purposes of the
investigation, the department shall consider the clinic's, health
facility's, agency's, or hospice's history of compliance with this
section and other related state and federal statutes and regulations,
the extent to which the facility detected violations and took
preventative action to immediately correct and prevent past
violations from recurring, and factors outside its control that
restricted the facility's ability to comply with this section. The
department shall have full discretion to consider all factors when
determining the amount of an administrative penalty pursuant to this
section.
(b) (1) A clinic, health facility, home health agency, or hospice
to which subdivision (a) applies shall report any unlawful or
unauthorized access to, or use or disclosure of, a patient's medical
information to the department no later than five business days after
the unlawful or unauthorized access, use, or disclosure has been
detected by the clinic, health facility, home health agency, or
hospice.
(2) Subject to subdivision (c), a clinic, health facility, home
health agency, or hospice shall also report any unlawful or
unauthorized access to, or use or disclosure of, a patient's medical
information to the affected patient or the patient's representative
at the last known address, no later than five business days after the
unlawful or unauthorized access, use, or disclosure has been
detected by the clinic, health facility, home health agency, or
hospice.
(c) (1) A clinic, health facility, home health agency, or hospice
shall delay the reporting, as required pursuant to paragraph (2) of
subdivision (b), of any unlawful or unauthorized access to, or use or
disclosure of, a patient's medical information beyond five business
days if a law enforcement agency or official provides the clinic,
health facility, home health agency, or hospice with a written or
oral statement that compliance with the reporting requirements of
paragraph (2) of subdivision (b) would be likely to impede the law
enforcement agency's activities that relate to the unlawful or
unauthorized access to, and use or disclosure of, a patient's medical
information and specifies a date upon which the delay shall end, not
to exceed 60 days after a written request is made, or 30 days after
an oral request is made. A law enforcement agency or official may
request an extension of a delay based upon a written declaration that
there exists a bona fide, ongoing, significant criminal
investigation of serious wrongdoing relating to the unlawful or
unauthorized access to, and use or disclosure of, a patient's medical
information, that notification of patients will undermine the law
enforcement agency's activities, and that specifies a date upon which
the delay shall end, not to exceed 60 days after the end of the
original delay period.
(2) If the statement of the law enforcement agency or official is
made orally, then the clinic, health facility, home health agency, or
hospice shall do the following:
(A) Document the oral statement, including, but not limited to,
the identity of the law enforcement agency or official making the
oral statement and the date upon which the oral statement was made.
(B) Limit the delay in reporting the unlawful or unauthorized
access to, or use or disclosure of, the patient's medical information
to the date specified in the oral statement, not to exceed 30
calendar days from the date that the oral statement is made, unless a
written statement that complies with the requirements of this
subdivision is received during that time.
(3) A clinic, health facility, home health agency, or hospice
shall submit a report that is delayed pursuant to this subdivision
not later than five business days after the date designated as the
end of the delay.
(d) If a clinic, health facility, home health agency, or hospice
to which subdivision (a) applies violates subdivision (b), the
department may assess the licensee a penalty in the amount of one
hundred dollars ($100) for each day that the unlawful or unauthorized
access, use, or disclosure is not reported, following the initial
five-day period specified in subdivision (b). However, the total
combined penalty assessed by the department under subdivision (a) and
this subdivision shall not exceed two hundred fifty thousand dollars
($250,000) per reported event.
(e) In enforcing subdivisions (a) and (d), the department shall
take into consideration the special circumstances of small and rural
hospitals, as defined in Section 124840, and primary care clinics, as
defined in subdivision (a) of Section 1204, in order to protect
access to quality care in those hospitals and clinics. When assessing
a penalty on a skilled nursing facility or other facility subject to
Section 1423, 1424, 1424.1, or 1424.5, the department shall issue
only the higher of either a penalty for the violation of this section
or a penalty for violation of Section 1423, 1424, 1424.1, or 1424.5,
not both.
(f) All penalties collected by the department pursuant to this
section, Sections 1280.1, 1280.3, and 1280.4, shall be deposited into
the Internal Departmental Quality Improvement Account, which is
hereby created within the Special Deposit Fund under Section 16370 of
the Government Code. Upon appropriation by the Legislature, moneys
in the account shall be expended for internal quality improvement
activities in the Licensing and Certification Program.
(g) If the licensee disputes a determination by the department
regarding a failure to prevent or failure to timely report unlawful
or unauthorized access to, or use or disclosure of, patients' medical
information, or the imposition of a penalty under this section, the
licensee may, within 10 days of receipt of the penalty assessment,
request a hearing pursuant to Section 131071. Penalties shall be paid
when appeals have been exhausted and the penalty has been upheld.
(h) In lieu of disputing the determination of the department
regarding a failure to prevent or failure to timely report unlawful
or unauthorized access to, or use or disclosure of, patients' medical
information, transmit to the department 75 percent of the total
amount of the administrative penalty, for each violation, within 30
business days of receipt of the administrative penalty.
(i) Notwithstanding any other law, the department may refer
violations of this section to the Office of Health Information
Integrity for enforcement pursuant to Section 130303.
(j) For purposes of this section, the following definitions shall
apply:
(1) "Reported event" means all breaches included in any single
report that is made pursuant to subdivision (b), regardless of the
number of breach events contained in the report.
(2) "Unauthorized" means the inappropriate access, review, or
viewing of patient medical information without a direct need for
medical diagnosis, treatment, or other lawful use as permitted by the
Confidentiality of Medical Information Act (Part 2.6 (commencing
with Section 56) of Division 1 of the Civil Code) or any other
statute or regulation governing the lawful access, use, or disclosure
of medical information.
SEC. 2. Division 109.5 (commencing with Section
130250) is added to the Health and Safety Code
, to read:
DIVISION 109.5. California Health Information Technology and
Exchange Act
130250. The Legislature finds and declares all of the following:
(a) Health information technology provides tools that can improve
the quality, safety, and value of health care services. However, the
full benefit of health information technology cannot be realized
until electronic health record systems supporting the secure exchange
of individual health records are in place and used by health care
providers, payers, patients, and other individuals throughout the
state, and across state boundaries.
(b) There is a need to promote secure electronic health data
exchange among payers, health care providers, consumers of health
care, researchers, and governmental agencies.
(c) Health information exchange necessarily includes the sharing
of private health records and information of individuals.
Establishing the security of individual privacy rights and
confidentiality of personal health and medical records is of
paramount importance to creating public confidence in any broad-based
electronic health records system. Ensuring transparent
accountability, governance, and oversight are critical components to
maintaining the public's trust.
(d) The American Recovery and Reinvestment Act of 2009 (ARRA)
(Public Law 111-5) includes within it the Health Information
Technology for Economic and Clinical Health Act (the HITECH Act). The
HITECH Act provides an unprecedented opportunity for California to
develop a statewide health information technology infrastructure to
improve California's health care system. It includes provisions and
federal funding to encourage the adoption and meaningful use of
health information technology and exchange.
(e) Section 3013 of ARRA provides federal grant funds to
facilitate and expand the electronic movement and use of health
information among organizations according to nationally recognized
standards.
(f) Lack of a timely and available health information exchange
jeopardizes the ability of the state and providers to access
available federal Medicaid and Medicare incentive payments.
130251. (a) The California Health and Human Services Agency or
one of the departments under its jurisdiction may apply for federal
funds made available through the federal American Recovery and
Reinvestment Act of 2009 (Public Law 111-5) for health information
technology and exchange.
(b) In the event that the California Health and Human Services
Agency or one of the departments under its jurisdiction elects not to
submit an application described in subdivision (a), the Governor
shall designate a qualified nonprofit entity to be the
state-designated entity for the purposes of health information
exchange, pursuant to the requirements set forth in ARRA.
(c) The agency or state-designated entity shall execute tasks
related to accessing federal stimulus funds made available through
ARRA, and facilitate and expand the use and disclosure of health
information electronically among organizations according to
nationally recognized standards and implementation specifications
while protecting, to the greatest extent possible, individual privacy
and the confidentiality of electronic medical records.
(d) The agency or state-designated entity shall develop a plan to
ensure that health information exchange capabilities are available,
adopted, and utilized statewide so that patients do not experience
disparities in access to the benefits of this technology by age,
race, ethnicity, language, income, insurance status, geography, or
otherwise.
(e) The agency or state-designated entity shall create a plan for
a self-sustaining funding mechanism that does not include use of
General Fund moneys that shall cover all reasonable costs of the
administration of health information exchange when federal ARRA funds
expire or are exhausted.
(f) The state-designated entity shall continually meet any
conditions for being so designated as determined by the Secretary of
California Health and Human Services. Failure to comply with this
subdivision may result in the entity losing its designation.
(g) As a condition of receiving the state designation, the
state-designated entity shall comply with all of the following
requirements:
(1) It shall be subject to oversight by the California Health and
Human Services Agency.
(2) (A) It shall be governed by a board with a diverse composition
from multiple types of organizations from multiple regions
throughout the state. The governing board shall include, at a
minimum, all of the following:
(i) The Secretary of California Health and Human Services on his
or her designee.
(ii) The chair of the Senate Committee on Health or his or her
designee.
(iii) The chair of the Assembly Committee on Health on his or her
designee.
(iv) At least two consumer representatives, one of whom shall have
expertise in privacy and security of health information.
(B) The majority of the board shall be comprised of
`nongovernmental employees.
(3) If the board convenes workgroups or subcommittees, the
workgroups or subcommittees shall be comprised of representatives
from multiple types of organizations from multiple regions throughout
the state, and meetings of any workgroup or subcommittee shall be
held in an open, public, and transparent way.
(4) It shall have nondiscrimination and conflict-of-interest
policies that demonstrate a commitment to open, fair, and
nondiscriminatory participation by stakeholders.
(h) The state-designated entity shall report to the California
Health and Human Services Agency and the Legislature on its progress
and activities at least annually.
130255. (a) In the event that the California Health and Human
Services Agency applies for and receives federal funds made available
through the federal American Recovery and Reinvestment Act of 2009
(Public Law 111-5) for health information technology and exchange, as
outlined in subdivision (a) of Section 130251, the California Health
Information Technology and Exchange Fund is hereby created in the
State Treasury.
(b) All moneys in the California Health Information Technology and
Exchange Fund shall be available, upon appropriation by the
Legislature, for purposes related to health information technology
and exchange.
(c) The California Health Information Technology and Exchange Fund
shall consist of, but is not limited to, federal funds made
available through ARRA for health information technology and
exchange. Notwithstanding Section 16305.7 of the Government Code, any
interest and dividends earned on deposits in the fund shall be
retained in the fund for purposes of this division.
(d) It is the intent of the Legislature that the activities
associated with health information exchange be funded solely through
the following:
(1) Federal funds.
(2) Private contributions identified by the state, the
state-designated entity, or any relevant advisory panel convened by
the California Health and Human Services Agency.
(3) Funds generated by the self-sustaining funding mechanism to be
established by the California Health and Human Services Agency or
one of its departments, or the state-designated entity.