Amended in Assembly April 21, 2014

California Legislature—2013–14 Regular Session

Assembly Bill No. 1830

Introduced by Assembly Member Conway

begin insert

(Coauthors: Assembly Members Hagman, Harkey, Olsen, Wagner, and Wilk)

end insert

February 18, 2014

An act to add Section 100509 to the Government Code, relating to health care coverage.

LEGISLATIVE COUNSEL’S DIGEST

AB 1830, as amended, Conway. California Health Benefit Exchange: confidentiality of personally identifiable information.

Existing law, the federal Patient Protection and Affordable Care Act (PPACA), requires each state to establish an American Health Benefit Exchange by January 1, 2014, that makes available qualified health plans to qualified individuals and small employers. PPACA prohibits an Exchange from using or disclosing the personally identifiable information it creates or collects other than to the extent necessary to carry out specified functions. Existing law also requires an Exchange to establish and implement privacy and security standards that are consistent with specified principles and to require the same or more stringent privacy and security standards as a condition of contract or agreement with individuals or entities. A person who knowingly and willfully uses or discloses information in violation of PPACA is subject to a civil penalty of no more than $25,000 per person or entity, per use or disclosure, in additional to any other penalties prescribed by law.

Existing state law establishes the California Health Benefit Exchange within state government, specifies the powers and duties of the board governing the Exchange, and requires the board to facilitate the purchase of qualified health plans through the Exchange by qualified individuals and small employers by January 1, 2014. Existing law requires the board to employ necessary staff and authorizes the board to enter into contracts. Under existing law, the board of the Exchange is required to submit fingerprint images to the Department of Justice for all employees, prospective employees, contractors, subcontractors, volunteers, or vendors of the Exchange whose duties include access to specified personal information for the purposes of obtaining state or federal conviction records, as specified.

This bill would, where the Exchange creates or collects personally identifiable information for the purpose of determining eligibility for specified plans and programs, authorize the Exchange to use or disclose that information only to the extent necessary to carry out specified functions authorized under PPACA begin insert or to carry out other nonspecified functions that satisfy certain federal criteria. The bill would require the Exchange to establish and implement privacy and security standards that are consistent with specified principles and to execute a contract with a non-Exchange entity that contains various provisions, including a provision requiring the non-Exchange entity to comply with the same privacy and security standards and to bind any downstream entity to those privacy and security standards end insert . The bill would prohibit a contractor, subcontractor, volunteer, or vendor of the Exchange who gains access to personally identifiable information in the course of fulfilling his, her, or its duties as a contractor, subcontractor, volunteer, or vendor from using or disclosing that information other than to the extent necessary to carry out those duties begin insert , except as specified end insert . begin delete The bill would require a contractor, subcontractor, volunteer, or vendor of the Exchange to comply with the privacy and security standards adopted by the Exchange pursuant to PPACA. end delete An individual or entity who knowingly and willfully violates begin delete these end delete begin insert the bill’s disclosure end insert provisions would be subject to a civil penalty of not more than $25,000 per individual or entity, per use or disclosure, in addition to any other penalties prescribed by law.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Section 100509 is added to the Government Code,
to read:

100509.  

(a) (1) Where the Exchange creates or collects
personally identifiable information for the purpose of determining
eligibility for enrollment in a qualified health plan, determining
eligibility for other insurance affordability programs, as defined
in Section 155.20 of Title 45 of the Code of Federal Regulations,
or determining eligibility for exemptions from the individual
responsibility provisions in Section 5000A of the federal Internal
Revenue Code, the Exchange may only use or disclose the
information to the extent necessary to carry out the functions
described in Section 155.200 of Title 45 of the Code of Federal
Regulations begin insert or to carry out the functions not described in Section
155.200 of Title 45 of the Code of Federal Regulations that satisfy
Section 155.260(a)(1)(ii) or (iii) of Title 45 of the Code of Federal
Regulations end insert .

(2) The Exchange shall not create, collect, use, or disclose
personally identifiable information begin delete while fulfilling its
responsibilities in accordance with this title and Section 155.200
of Title 45 of the Code of Federal Regulations end delete unless the creation,
collection, use, or disclosure is consistent with Section 155.260
of Title 45 of the Code of Federal Regulations.

begin insert

(3) The Exchange shall establish and implement privacy and
security standards that are consistent with the principles listed in
Section 155.260(a)(3) of Title 45 of the Code of Federal
Regulations.

end insert begin delete

(3)

end delete

begin insert (4) end insert  For purposes of this subdivision, “Exchange” includes a
member of the board or staff of the Exchange.

begin insert

(b) Prior to becoming a non-Exchange entity, the Exchange
shall execute a contract with the entity that includes all of the
following:

end insert begin insert

(1) A description of the functions to be performed by the
non-Exchange entity.

end insert begin insert

(2) A provision requiring the non-Exchange entity to comply
with the privacy and security standards adopted by the Exchange
pursuant to subdivision (c), and specifically listing or incorporating
those standards.

end insert begin insert

(3) A provision requiring the non-Exchange entity to monitor,
periodically assess, and update its security controls and related
system risks to ensure the continued effectiveness of those controls
in accordance with Section 155.260(a)(5) of Title 45 of the Code
of Federal Regulations.

end insert begin insert

(4) A provision requiring the non-Exchange entity to inform the
Exchange of any change in its administrative, technical, or
operational environments defined as material within the contract.

end insert begin insert

(5) A provision that requires the non-Exchange entity to bind
any downstream entities to the same privacy and security standards
and obligations to which the non-Exchange entity has agreed in
its contract or agreement with the Exchange under paragraph (2).

end insert begin insert

(c) When the collection, use, or disclosure of personally
identifiable information is not otherwise required by law, the
privacy and security standards to which the Exchange shall bind
a non-Exchange entity shall meet all of the following requirements:

end insert begin insert

(1) Be consistent with the principles and requirements listed in
Section 155.260(a)(1) to (6), inclusive, of Title 45 of the Code of
Federal Regulations.

end insert begin insert

(2) Comply with Section 155.260(c), (d), (f), and (g) of Title 45
of the Code of Federal Regulations.

end insert begin insert

(3) Take into consideration all of the following:

end insert begin insert

(A) The environment in which the non-Exchange entity is
operating.

end insert begin insert

(B) Whether the standards are relevant and applicable to the
non-Exchange entity’s duties and activities in connection with the
Exchange.

end insert begin insert

(C) Any existing legal requirements to which the non-Exchange
entity is bound in relation to its administrative, technical, and
operational controls and practices, including, but not limited to,
its existing data handling and information technology processes
and protocols.

end insert begin delete

(b)

end delete

begin insert (d) end insert  A contractor, subcontractor, volunteer, or vendor of the
Exchange who gains access to personally identifiable information
in the course of fulfilling his, her, or its duties as a contractor,
subcontractor, volunteer, or vendor of the Exchange shall not use
or disclose that information other than to the extent necessary to
carry out those duties. begin insert This subdivision shall not apply to a
contractor, subcontractor, volunteer, or vendor of the Exchange
who is a covered entity under the federal Health Insurance end insert
begin insert Portability and Accountability Act and the regulations issued
pursuant to Part C of that act (45 C.F.R. Parts 160 and 164),
provided that the contractor, subcontractor, volunteer, or vendor
otherwise complies with those federal laws and any other
requirements applicable to the contractor, subcontractor,
volunteer, or vendor pursuant to this section. end insert

begin delete

(c) A contractor, subcontractor, volunteer, or vendor of the
Exchange shall comply with the privacy and security standards
adopted by the Exchange pursuant to Section 155.260 of Title 45
of the Code of Federal Regulations.

(d)

end delete

begin insert (e) end insert  This section does not apply when the use or disclosure of
personally identifiable information is otherwise compelled by
judicial or administrative process or by any other provision of law,
except as otherwise provided in the federal act.

begin delete

(e)

end delete

begin insert (f) end insert  Where the Exchange or a begin delete contractor, subcontractor, volunteer,
or vendor of the Exchange end delete begin insert non-Exchange entity end insert has access to
federal tax return information, that information shall be kept
confidential and disclosed, used, and maintained only in accordance
with Section 6103 of the federal Internal Revenue Code.

begin delete

(f)

end delete

begin insert (g) end insert  An individual or entity who knowingly and willfully violates
begin delete this section end delete begin insert subdivision (a) or (d) end insert shall be subject to a civil penalty
of not more than twenty-five thousand dollars ($25,000) per
individual or entity, per use or disclosure, in addition to any other
penalties prescribed by law.

begin delete

(g)

end delete

begin insert (h) end insert  For purposes of this section, begin delete “personally end delete begin insert the following
definitions shall apply: end insert

begin insert

(1) “Non-Exchange entity” means an individual or entity that
does either of the following:

end insert begin insert

(A) Gains access to personally identifiable information
submitted to the Exchange.

end insert begin insert

(B) Collects, uses, or discloses personally identifiable
information gathered directly from applicants, qualified
individuals, or enrollees while that individual or entity is
performing functions agreed to with the Exchange.

end insert

begin insert (2) end insert begin insert   end insert begin insert “Personally end insert identifiable information” means information
that includes or contains any element of personal identifying
information sufficient to allow identification of the individual,
including, but not limited to, the individual’s name, address,
electronic mail address, telephone number, social security number,
credit card number, place or date of birth, biometric records, or
other information that, alone or in combination with other publicly
available information, reveals the individual’s identity.