SB 974, as introduced, Anderson. California Health Benefit Exchange: confidentiality of personal information.
Existing law, the federal Patient Protection and Affordable Care Act (PPACA), requires each state to establish an American Health Benefit Exchange by January 1, 2014, that makes available qualified health plans to qualified individuals and small employers. PPACA prohibits an Exchange from using or disclosing the personally identifiable information it creates or collects other than to the extent necessary to carry out specified functions. Existing law also requires an Exchange to establish and implement privacy and security standards that are consistent with specified principles and to require the same or more stringent privacy and security standards as a condition of contract or agreement with individuals or entities. A person who knowingly and willfully uses or discloses information in violation of PPACA is subject to a civil penalty of no more than $25,000 per person or entity, per use or disclosure, in additional to any other penalties prescribed by law.
Existing state law establishes the California Health Benefit Exchange within state government, specifies the powers and duties of the board governing the Exchange, and requires the board to facilitate the purchase of qualified health plans through the Exchange by qualified individuals and small employers by January 1, 2014. Existing law requires the board to employ necessary staff and authorizes the board to enter into contracts. Under existing law, the board of the Exchange is required to submit fingerprint images to the Department of Justice for all employees, prospective employees, contractors, subcontractors, volunteers, or vendors of the Exchange whose duties include access to specified personal information for the purposes of obtaining state or federal conviction records, as specified.
This bill would prohibit the Exchange, or any of its employees, agents, subcontractors, representatives, or partners from disclosing an individual’s personal information, as defined, to any other person or entity without explicit permission from the individual. The bill would also require the Exchange to report a disclosure of personal information in violation of these provisions to the individuals affected and to the appropriate policy committees of the Legislature within 5 business days of the date the disclosure is discovered.
This bill would declare that it is to take effect immediately as an urgency statute.
Vote: 2⁄3. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.
The people of the State of California do enact as follows:
Section 100509 is added to the Government Code,
2to read:
(a) The Exchange, or any of its employees, agents,
4subcontractors, representatives, or partners, shall not disclose an
5individual’s personal information to any other person or entity
6without explicit permission from the individual.
7(b) If the Exchange discovers that personal information has been
8disclosed in violation of subdivision (a), the Exchange shall report
9the incident to the individuals affected and to the appropriate policy
10committees of the Legislature within five business days of the date
11the disclosure is discovered.
12(c) For purposes of this section, “personal information” means
13any information that an individual has submitted to the Exchange
14through the Exchange’s
Internet Web site, call center, or other
15technology, or in person through the Exchange’s employees,
16agents, subcontractors, representatives, or partners.
This act is an urgency statute necessary for the
18immediate preservation of the public peace, health, or safety within
P3 1the meaning of Article IV of the Constitution and shall go into
2immediate effect. The facts constituting the necessity are:
3Protecting Californian’s privacy rights is of the utmost
4importance, and in order to protect the privacy rights of individuals
5applying for health care coverage through the California Health
6Benefit Exchange at the earliest possible time, it is necessary that
7this act take effect immediately.
O
99