BILL ANALYSIS
SB 337
Page 1
SENATE THIRD READING
SB 337 (Alquist)
As Amended September 4, 2009
Majority vote
SENATE VOTE :Vote not relevant
HEALTH 19-0 APPROPRIATIONS 15-0
-----------------------------------------------------------------
|Ayes:|Jones, Fletcher, Adams, |Ayes:|De Leon, Conway, Ammiano, |
| |Ammiano, Block, Carter, | | |
| |Conway, De La Torre, De | |Charles Calderon, Coto, |
| |Leon, Emmerson, Gaines, | |Davis, Fuentes, Harkey, |
| |Hall, Hayashi, Hernandez, | |Miller, Nielsen, John A. |
| | | |Perez, Skinner, Solorio, |
| |Bonnie Lowenthal, Nava, | |Audra Strickland, |
| |V. Manuel Perez, Salas, | |Torlakson |
| |Audra Strickland | | |
|-----+--------------------------+-----+--------------------------|
| | | | |
-----------------------------------------------------------------
SUMMARY : Makes clarifying changes to requirements governing
reporting of unauthorized access to, or use or disclosure of,
patients' medical information, and provides limited exemptions
for law enforcement investigations. Authorizes the California
Health and Human Services Agency (CHHSA) to apply for federal
funds available for health information technology (HIT) and
health information exchange (HIE), and establishes a state fund
for purposes of HIT/HIE. Authorizes the Governor to
alternatively designate an entity to apply for federal HIT
funding, and establishes governance requirements for the entity.
Specifically, this bill :
1)Requires a clinic, health facility, home health agency, or
hospice to report any unauthorized access to, or use or
disclosure of, a patient's medical information to the
Department of Public Health (DPH) and to the affected patient
or patient's representative, no later than five business days,
instead of five days, after the unlawful or unauthorized
access, use, or disclosure has been detected by the entity.
2)Requires the clinic, health facility, home health agency, or
hospice to delay reporting any unlawful or unauthorized
SB 337
Page 2
access, use, or disclosure of a patient's medical information
to DPH and the patient if a law enforcement agency or official
provides a written statement that notification of patients
would be likely to impede the law enforcement agency's
activities, and specifies a date on which the delay will end,
not to exceed 60 days.
3)Requires the clinic, health facility, home health agency, or
hospice to delay reporting any unlawful or unauthorized
access, use, or disclosure of a patient's medical information
to DPH and the patient if a law enforcement agency or official
provides the entity with an oral statement and requires the
clinic, health facility, home health agency, or hospice to
document the statement, including but not limited to the
identity of the enforcement agency or official, the date it
was made, and limit the delay to a date specified for the end
of the delay, not to exceed 30 calendar days from the date the
oral statement is made unless a written statement is received
during that time.
4)Requires that the written statement received during the 30
calendar days after an oral statement is made by the law
enforcement agency or official shall include a date the delay
is to end, not to exceed 60 days.
5)Allows a law enforcement agency or official to request an
extension of the original 60-day delay based upon a written
declaration that there exists a bona fide, ongoing,
significant criminal investigation of serious wrongdoing, that
notification of patients will undermine the law enforcement
agency's activities, and that specifies a date upon which the
delay shall end, not to exceed 60 days after the end of the
original 60-day period.
6)Requires a clinic, health facility, home health agency, or
hospice that is subject to a delay in reporting for law
enforcement purposes to report the unauthorized access to, or
use or disclosure of, the patient's medical information no
later than five business days, instead of five days, after the
date designated as the end of the delay.
7)Authorizes CHHSA or a department within CHHSA to apply for
federal funds available through the American Recovery and
Reinvestment Act (Public Law 111-5; American Recovery and
SB 337
Page 3
Reinvestment Act (ARRA)) for HIT/HIE.
8)Authorizes the Governor to designate a qualified nonprofit
entity as the state designated entity (SDE) for the purposes
of HIE, pursuant to requirements set forth in ARRA, if CHHSA
elects not to submit an application for ARRA funds described
in 7) above.
9)Requires CHHSA or the SDE to facilitate and expand the use and
disclosure of electronic health information according to
nationally recognized standards and specifications, and
execute tasks related to accessing ARRA funds while protecting
the privacy and confidentiality of medical records to the
greatest extent possible.
10)Requires CHHSA or the SDE to develop a plan to ensure that
HIE capabilities are developed, adopted, and utilized
statewide to minimize disparities in access to HIT, as
specified.
11)Requires CHHSA or the SDE to plan for a self-sustaining
funding mechanism that uses no General Fund (GF) moneys and
sustains administration of HIE when federal funds are no
longer available.
12)Requires the SDE to continually meet any conditions for the
designation, as determined by the Secretary of CHHSA, and
specifies that failure to do so may result in loss of the
designation.
13)Requires the SDE, as a condition of the designation, to be
subject to oversight by CHHSA.
14)Requires the SDE to be governed by a board which has diverse
composition; represents multiple types of organizations and
regions; and, includes the Secretary of CHHSA or his or her
designee, chairs of the Assembly and Senate Health Committees
or their designees, at least two consumer representatives, one
with expertise in privacy and security of health information,
and a majority of non-governmental employees.
15)Requires any workgroups or subcommittees of the board to
represent multiple types of organizations and regions and to
meet publicly and transparently.
SB 337
Page 4
16)Requires the board to have nondiscrimination and conflict of
interest policies, as specified.
17)Requires the SDE to report to CHHSA and the Legislature at
least annually.
18)Creates the California Health Information Technology and
Exchange Fund (Fund) in the State Treasury, in the event that
CHHSA receives ARRA HIT/HIE funds, and does not designate an
SDE.
19)Specifies that the Fund consists of, but is not limited to,
ARRA HIT and HIE funds, requires interest and dividends earned
to be retained in the Fund, and subjects all moneys in the
Fund to appropriation by the Legislature for purposes related
to HIT/HIE.
20)Declares the intent of the Legislature that activities
associated with HIE be funded solely through federal funds,
private contributions, and funds generated by the
self-sustaining funding mechanism in 11) above.
EXISTING FEDERAL LAW :
1)Prohibits, under federal regulations implementing the federal
Health Insurance Portability and Accountability Act, a health
plan, health care clearinghouse, or a health care provider,
who transmits health information in electronic form (covered
entity), from using or disclosing protected health
information, for purposes other than medical treatment or
payment, or health care operations, as defined, without
written authorization of the patient, with exceptions.
2)Requires, under ARRA, covered entities and their business
associates to provide notice of medical privacy breaches
involving the unauthorized acquisition, access, use, or
disclosure of protected health information to each individual
whose information has been subject to a breach within 60 days
of the discovery of the breach.
3)Provides that if a law enforcement official determines that
notice of a medical privacy breach would impede a criminal
investigation or cause damage to national security, the notice
SB 337
Page 5
shall be delayed, in a specified manner.
EXISTING STATE LAW :
1)Prohibits, under the Confidentiality of Medical Information
Act (CMIA), licensed or certified health care professionals,
clinics and health facilities, health plans, and contracting
entities, as defined, from disclosing or using a patient's
medical information for any purpose not necessary to provide
health care services to the patient and related administrative
functions, without first obtaining authorization from the
patient or the patient's representative, as specified, with
exceptions.
2)Provides for administrative fines and civil penalties for
persons and entities subject to the CMIA who negligently
disclose, or who knowingly and willfully obtain, disclose, or
use, medical information in violation of the CMIA, and
authorizes the Attorney General, any district attorney, any
county counsel acting pursuant to an agreement with the
district attorney, or a city attorney, to seek civil penalties
for violations.
3)Requires every provider of health care to establish and
implement administrative, technical, and physical safeguards
to protect the privacy of patients' medical information, and
requires every provider to reasonably safeguard confidential
medical information from any unauthorized access or unlawful
access, use, or disclosure.
4)Defines unauthorized access as the inappropriate review or
viewing of patient medical information without a direct need
for diagnosis, treatment, or other lawful use of the
information.
5)Requires a clinic, health facility, home health agency, or
hospice to report any unlawful or unauthorized access to, or
use or disclosure of, a patient's medical information to DPH
and to the affected patient or patient's representative, no
later than five days after the unlawful or unauthorized
access, use, or disclosure has been detected by the entity.
Allows DPH to assess a penalty of $100 for each day the
unlawful or unauthorized access, use, or disclosure is not
reported, following the initial five-day period, not to exceed
SB 337
Page 6
$250,000 per reported event.
6)Requires other persons or businesses that own or license
computerized data that includes personal information,
including medical information, to disclose any breach of the
security of the system to a resident whose unencrypted
personal information was acquired by an unauthorized person.
Provides that the notification may be delayed if a law
enforcement agency determines that notification will impede a
criminal investigation, as specified.
FISCAL EFFECT : According to the Assembly Appropriations
Committee:
1)California is expected to qualify for $3 billion (federal) in
provider incentives and grants from 2011 to 2016. No state
match is required in 2010, but the state will be required to
provide contributions to draw down federal funding in future
years as follows: $1 for $10 of federal funds in 2011, $1 for
$7 of federal funds in 2012, and $1 for $3 of federal funds in
2013-2016. According to stakeholders, possibilities for
non-General Fund (GF) state contributions include support from
health technology industry groups, provider associations, or
non-profit groups. The state contribution may also be
generated via the self-funding mechanism described above.
2)Future GF savings in Medi-Cal likely if HIT efforts are
successful. The RAND Corporation estimates national net
annual savings of $34 billion following the adoption of HIT.
The Legislative Analyst's Office estimates savings to
fee-for-service Medi-Cal of up to $300 million GF annually by
increasing coordination and reducing duplication across a
variety of patient service areas.
COMMENTS : The author states this bill is intended to make two
revisions to existing medical privacy requirements in SB 541
(Alquist), Chapter 605, Statutes of 2008, that health facilities
notify patients and DPH when they detect any unlawful or
unauthorized access to, or use or disclosure of, a patient's
medical information. The first is to revise the timeline for
reporting such breaches from five days to five business days.
The second is to allow for a delay in the reporting of such
breaches when a law enforcement agency or official makes a
statement that it would impede a law enforcement investigation
SB 337
Page 7
of the breach. The author states that these are reasonable
revisions of the reporting requirements for medical privacy
breaches that are consistent with the intent of the original
legislation.
The author also states that ARRA, which includes $36 billion in
federal funding to encourage the adoption and use of HIT/HIE,
provides an unprecedented opportunity to develop and implement
the HIT/HIE infrastructure needed to modernize and improve
California's health care system. The author argues that this
bill is needed because it is critical that California implement
HIE as soon as possible, as it is the mechanism for sharing
health records across providers, and lack of HIE jeopardizes the
ability of the state and providers to meet ARRA requirements and
draw down an expected $3 billion in Medicare and Medicaid
incentive payments beginning in October 2010. According to the
author, the federal grant application for ARRA HIE funding is
due by October 16, 2009 and the state is expected to receive $40
million for HIE. Only the state or an SDE may submit an
application, and the federal government has indicated a desire
to distribute ARRA funds as expeditiously as possible. The
author contends that in order for California to establish HIE
before federal deadlines and draw down ARRA incentive payments,
legislation is needed immediately.
Analysis Prepared by : Marjorie Swartz and Allegra Kim / HEALTH
/ (916) 319-2097
FN: 0003122