Bill Text

Bill Information


Add To My Favorites | print page

AB-1687 Confidential information.(2007-2008)

SHARE THIS: share this bill in Facebook share this bill in Twitter
AB1687:v89#DOCUMENT

Assembly Bill No. 1687
CHAPTER 552

An act to amend Section 56.10 of, and to add Section 56.103 to, the Civil Code, relating to confidential information.

[ Approved by Governor  October 12, 2007. Filed with Secretary of State  October 12, 2007. ]

LEGISLATIVE COUNSEL'S DIGEST


AB 1687, Brownley. Confidential information.
(1) Existing law prohibits a provider of health care, a health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally sharing, selling, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. Existing law also permits that medical information to be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. Existing law provides that a violation of these provisions that results in economic loss or personal injury to a patient is punishable as a misdemeanor. Existing federal law defines “covered entity” for purposes of the federal Health Insurance Portability and Accountability Act.
This bill would provide that for purposes of these provisions, a provider of health care may disclose medical information to a county social worker, a probation officer, or any other person who is legally authorized to have custody or care of a minor, as defined, for the purpose of coordinating health care services and medical treatment provided to the minor. By expanding the definition of a crime, the bill would impose a state-mandated local program. The bill would also prohibit a county social worker, probation officer, or any other person who is legally authorized to have custody or care of a minor who receives medical information from further disclosing that information unless the disclosure is for the purpose of coordinating health care services and medical treatment of the minor and the disclosure is authorized by law. The bill would further provide that medical information disclosed pursuant to these provisions may not be admitted into evidence in any criminal or delinquency proceeding against the minor thereby requiring a 2/3 vote for enactment pursuant to the Victims’ Bill of Rights. The bill would provide that if a provider of health care determines that the disclosure of medical information concerning the diagnosis and treatment of a mental health condition of a minor is reasonably necessary for the purpose of assisting in coordinating the treatment and care of the minor, that medical information may be disclosed to a county social worker, probation officer, or any other person who is legally authorized to have custody or care of the minor. The bill would also prohibit the further disclosure of information concerning the diagnosis and treatment of a mental health condition of a minor unless the disclosure is for the purpose of coordinating mental health services and treatment of the minor and the disclosure is authorized by law. The bill would also make related legislative findings and declarations.
(2) The bill would also incorporate additional changes to Section 56.10 of the Civil Code proposed by AB 1687 and AB 1727, to be operative only if any or all of those bills are enacted and this bill is chaptered last.
(3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Vote: 2/3   Appropriation: NO   Fiscal Committee: YES   Local Program: YES  

The people of the State of California do enact as follows:


SECTION 1.

 The Legislature finds and declares all of the following:
(a) The State of California is responsible for the health care needs of children and youth who have been removed from their homes due to abuse, neglect, or delinquency, and for ensuring that their health care and mental health needs are met. Access to health care and mental health records is essential for ensuring that health care and mental health needs of foster children and youth are being met.
(b) A lack of clarity about who may be authorized to share health care and mental health records with caregivers of children and youth in the state’s care often results in inadequate health care information being available to caregivers, which jeopardizes the health of the children and youth in the state’s care.
(c) It is the intent of the Legislature to improve the sharing of health care and mental health information concerning children and youth in the state’s care by eliminating barriers caused by a lack of clarity in existing law regarding who may be authorized to share health care and mental health information. It is the further intent of the Legislature not to expand existing law and to clarify that existing provisions regarding confidentiality of medical records and the federal Health Insurance Portability and Accountability Act (HIPAA) authorizes psychotherapists to provide health care and mental health information to caregivers of children and youth in foster care to facilitate providing health care and mental health care that meets the needs of these children and youth.

SEC. 2.

 Section 56.10 of the Civil Code is amended to read:

56.10.
 (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).
(b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:
(1) By a court pursuant to an order of that court.
(2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority.
(3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency.
(4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.
(5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.
(6) By a search warrant lawfully issued to a governmental law enforcement agency.
(7) By the patient or the patient’s representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code.
(8) By a coroner, when requested in the course of an investigation by the coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or when otherwise authorized by the decedent’s representative. Medical information requested by the coroner under this paragraph shall be limited to information regarding the patient who is the decedent and who is the subject of the investigation and shall be disclosed to the coroner without delay upon request.
(9) When otherwise specifically required by law.
(c) A provider of health care or a health care service plan may disclose medical information as follows:
(1) The information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code.
(2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient.
(3) The information may be disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part.
(4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(5) The information in the possession of a provider of health care or health care service plan may be reviewed by a private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient-identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part.
(6) The information may be disclosed to the county coroner in the course of an investigation by the coroner’s office when requested for all purposes not included in paragraph (8) of subdivision (b).
(7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of a patient or violate this part.
(8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that part of the information that:
(A) Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding.
(B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed.
(9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.
(10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part.
(11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code.
(12) The information relevant to the patient’s condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship.
(13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms “tissue bank” and “tissue” have the same meaning as defined in Section 1635 of the Health and Safety Code.
(14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems.
(15) Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.
(16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information.
(17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.
(18) The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.
(19) The information may be disclosed as described in Section 56.103.
(d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, use for marketing, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient.
(e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to a person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer.

SEC. 2.5.

 Section 56.10 of the Civil Code is amended to read:

56.10.
 (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).
(b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:
(1) By a court pursuant to an order of that court.
(2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority.
(3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency.
(4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.
(5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.
(6) By a search warrant lawfully issued to a governmental law enforcement agency.
(7) By the patient or the patient’s representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code.
(8) By a coroner, when requested in the course of an investigation by the coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or when otherwise authorized by the decedent’s representative. Medical information requested by the coroner under this paragraph shall be limited to information regarding the patient who is the decedent and who is the subject of the investigation and shall be disclosed to the coroner without delay upon request.
(9) When otherwise specifically required by law.
(c) A provider of health care or a health care service plan may disclose medical information as follows:
(1) The information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code.
(2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient.
(3) The information may be disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part.
(4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(5) The information in the possession of a provider of health care or health care service plan may be reviewed by a private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient-identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part.
(6) The information may be disclosed to the county coroner in the course of an investigation by the coroner’s office when requested for all purposes not included in paragraph (8) of subdivision (b).
(7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of a patient or violate this part.
(8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that part of the information that:
(A) Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding.
(B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed.
(9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.
(10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part.
(11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code.
(12) The information relevant to the patient’s condition and care and treatment provided may be disclosed to a probate court investigator engaged in determining the need for an initial conservatorship or continuation of an existent conservatorship, if the patient is unable to give informed consent, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship.
(13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms “tissue bank” and “tissue” have the same meaning as defined in Section 1635 of the Health and Safety Code.
(14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems.
(15) Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.
(16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information.
(17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.
(18) The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.
(19) The information may be disclosed, consistent with applicable law and standards of ethical conduct, by a psychotherapist, as defined in Section 1010 of the Evidence Code, if the psychotherapist, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a reasonably foreseeable victim or victims, and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
(20) The information may be disclosed as described in Section 56.103.
(d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, use for marketing, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient.
(e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer.

SEC. 2.7.

 Section 56.10 of the Civil Code is amended to read:

56.10.
 (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).
(b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:
(1) By a court pursuant to an order of that court.
(2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority.
(3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency.
(4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.
(5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.
(6) By a search warrant lawfully issued to a governmental law enforcement agency.
(7) By the patient or the patient’s representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code.
(8) By a coroner, when requested in the course of an investigation by the coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or when otherwise authorized by the decedent’s representative. Medical information requested by the coroner under this paragraph shall be limited to information regarding the patient who is the decedent and who is the subject of the investigation and shall be disclosed to the coroner without delay upon request.
(9) When otherwise specifically required by law.
(c) A provider of health care or a health care service plan may disclose medical information as follows:
(1) The information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code.
(2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient.
(3) The information may be disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part.
(4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(5) The information in the possession of a provider of health care or health care service plan may be reviewed by a private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient-identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part.
(6) The information may be disclosed to the county coroner in the course of an investigation by the coroner’s office when requested for all purposes not included in paragraph (8) of subdivision (b).
(7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of a patient or violate this part.
(8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that part of the information that:
(A) Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding.
(B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed.
(9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.
(10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part.
(11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code.
(12) The information relevant to the patient’s condition and care and treatment provided may be disclosed to a probate court investigator in the course of any investigation required or authorized in a conservatorship proceeding under the Guardianship-Conservatorship Law as defined in Section 1400 of the Probate Code, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship.
(13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms “tissue bank” and “tissue” have the same meaning as defined in Section 1635 of the Health and Safety Code.
(14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems.
(15) Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.
(16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information.
(17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.
(18) The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.
(19) The information may be disclosed as described in Section 56.103.
(d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, use for marketing, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient.
(e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer.

SEC. 2.9.

 Section 56.10 of the Civil Code is amended to read:

56.10.
 (a) No provider of health care, health care service plan, or contractor shall disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).
(b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:
(1) By a court pursuant to an order of that court.
(2) By a board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority.
(3) By a party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency.
(4) By a board, commission, or administrative agency pursuant to an investigative subpoena issued under Article 2 (commencing with Section 11180) of Chapter 2 of Part 1 of Division 3 of Title 2 of the Government Code.
(5) By an arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum issued under Section 1282.6 of the Code of Civil Procedure, or any other provision authorizing discovery in a proceeding before an arbitrator or arbitration panel.
(6) By a search warrant lawfully issued to a governmental law enforcement agency.
(7) By the patient or the patient’s representative pursuant to Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code.
(8) By a coroner, when requested in the course of an investigation by the coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or when otherwise authorized by the decedent’s representative. Medical information requested by the coroner under this paragraph shall be limited to information regarding the patient who is the decedent and who is the subject of the investigation and shall be disclosed to the coroner without delay upon request.
(9) When otherwise specifically required by law.
(c) A provider of health care or a health care service plan may disclose medical information as follows:
(1) The information may be disclosed to providers of health care, health care service plans, contractors, or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and emergency medical personnel at a health facility licensed pursuant to Chapter 2 (commencing with Section 1250) of Division 2 of the Health and Safety Code.
(2) The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor, or any other person or entity responsible for paying for health care services rendered to the patient, to the extent necessary to allow responsibility for payment to be determined and payment to be made. If (A) the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure of medical information and (B) no other arrangements have been made to pay for the health care services being rendered to the patient, the information may be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient.
(3) The information may be disclosed to a person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified in paragraph (2). However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part.
(4) The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations as established by Congress in Public Law 97-248 in 1982, contractors, or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors, or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(5) The information in the possession of a provider of health care or health care service plan may be reviewed by a private or public body responsible for licensing or accrediting the provider of health care or health care service plan. However, no patient-identifying medical information may be removed from the premises except as expressly permitted or required elsewhere by law, nor shall that information be further disclosed by the recipient in any way that would violate this part.
(6) The information may be disclosed to the county coroner in the course of an investigation by the coroner’s office when requested for all purposes not included in paragraph (8) of subdivision (b).
(7) The information may be disclosed to public agencies, clinical investigators, including investigators conducting epidemiologic studies, health care research organizations, and accredited public or private nonprofit educational or health care institutions for bona fide research purposes. However, no information so disclosed shall be further disclosed by the recipient in any way that would disclose the identity of a patient or violate this part.
(8) A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that part of the information that:
(A) Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding.
(B) Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed.
(9) Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits.
(10) The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part.
(11) Nothing in this part shall prevent the disclosure by a provider of health care or a health care service plan to an insurance institution, agent, or support organization, subject to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code, of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code.
(12) The information relevant to the patient’s condition and care and treatment provided may be disclosed to a probate court investigator in the course of any investigation required or authorized in a conservatorship proceeding under the Guardianship-Conservatorship Law as defined in Section 1400 of the Probate Code, or to a probate court investigator, probation officer, or domestic relations investigator engaged in determining the need for an initial guardianship or continuation of an existent guardianship.
(13) The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant. For the purpose of this paragraph, the terms “tissue bank” and “tissue” have the same meaning as defined in Section 1635 of the Health and Safety Code.
(14) The information may be disclosed when the disclosure is otherwise specifically authorized by law, including, but not limited to, the voluntary reporting, either directly or indirectly, to the federal Food and Drug Administration of adverse events related to drug products or medical device problems.
(15) Basic information, including the patient’s name, city of residence, age, sex, and general condition, may be disclosed to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries.
(16) The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information so disclosed shall be further disclosed by the recipient in any way that would violate this part, including the unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information.
(17) For purposes of disease management programs and services as defined in Section 1399.901 of the Health and Safety Code, information may be disclosed as follows: (A) to an entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, if the disease management services and care are authorized by a treating physician, or (B) to a disease management organization, as defined in Section 1399.900 of the Health and Safety Code, that complies fully with the physician authorization requirements of Section 1399.902 of the Health and Safety Code, if the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians. Nothing in this paragraph shall be construed to require physician authorization for the care or treatment of the adherents of a well-recognized church or religious denomination who depend solely upon prayer or spiritual means for healing in the practice of the religion of that church or denomination.
(18) The information may be disclosed, as permitted by state and federal law or regulation, to a local health department for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events, including, but not limited to, birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions, as authorized or required by state or federal law or regulation.
(19) The information may be disclosed, consistent with applicable law and standards of ethical conduct, by a psychotherapist, as defined in Section 1010 of the Evidence Code, if the psychotherapist, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a reasonably foreseeable victim or victims, and the disclosure is made to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat.
(20) The information may be disclosed as described in Section 56.103.
(d) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall intentionally share, sell, use for marketing, or otherwise use any medical information for any purpose not necessary to provide health care services to the patient.
(e) Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no contractor or corporation and its subsidiaries and affiliates shall further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to any person or entity that is not engaged in providing direct health care services to the patient or his or her provider of health care or health care service plan or insurer or self-insured employer.

SEC. 3.

 Section 56.103 is added to the Civil Code, to read:

56.103.
 (a) A provider of health care may disclose medical information to a county social worker, a probation officer, or any other person who is legally authorized to have custody or care of a minor for the purpose of coordinating health care services and medical treatment provided to the minor.
(b) For purposes of this section, health care services and medical treatment includes one or more providers of health care providing, coordinating, or managing health care and related services, including, but not limited to, a provider of health care coordinating health care with a third party, consultation between providers of health care and medical treatment relating to a minor, or a provider of health care referring a minor for health care services to another provider of health care.
(c) For purposes of this section, a county social worker, a probation officer, or any other person who is legally authorized to have custody or care of a minor shall be considered a third party who may receive any of the following:
(1) Medical information described in Sections 56.05 and 56.10.
(2) Protected health information described in Section 160.103 of Title 45 of the Code of Federal Regulations.
(d) Medical information disclosed to a county social worker, probation officer, or any other person who is legally authorized to have custody or care of a minor shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating health care services and medical treatment of the minor and the disclosure is authorized by law. Medical information disclosed pursuant to this section may not be admitted into evidence in any criminal or delinquency proceeding against the minor. Nothing in this subdivision shall prohibit identical evidence from being admissible in a criminal proceeding if that evidence is derived solely from lawful means other than this section and is permitted by law.
(e) (1) Notwithstanding Section 56.104, if a provider of health care determines that the disclosure of medical information concerning the diagnosis and treatment of a mental health condition of a minor is reasonably necessary for the purpose of assisting in coordinating the treatment and care of the minor, that information may be disclosed to a county social worker, probation officer, or any other person who is legally authorized to have custody or care of the minor. The information shall not be further disclosed by the recipient unless the disclosure is for the purpose of coordinating mental health services and treatment of the minor and the disclosure is authorized by law.
(2) As used in this subdivision, “medical information” does not include psychotherapy notes as defined in Section 164.501 of Title 45 of the Code of Federal Regulations.
(f) The disclosure of information pursuant to this section is not intended to limit the disclosure of information when that disclosure is otherwise required by law.
(g) For purposes of this section, “minor” means a minor taken into temporary custody or as to who a petition has been filed with the court, or who has been adjudged to be a dependent child or ward of the juvenile court pursuant to Section 300 or 600 of the Welfare and Institutions Code.
(h) (1) Except as described in paragraph (1) of subdivision (e), nothing in this section shall be construed to limit or otherwise affect existing privacy protections provided for in state or federal law.
(2) Nothing in this section shall be construed to expand the authority of a social worker, probation officer, or custodial caregiver beyond the authority provided under existing law to a parent or a patient representative regarding access to medical information.

SEC. 4.

 (a) Section 2.5 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by both this bill and AB 1178. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2008, (2) each bill amends Section 56.10 of the Civil Code, (3) AB 1727 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after AB 1178, in which case Sections 2, 2.7, and 2.9 of this bill shall not become operative.
(b) Section 2.7 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by both this bill and AB 1727. It shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2008, (2) each bill amends Section 56.10 of the Civil Code, (3) AB 1178 is not enacted or as enacted does not amend that section, and (4) this bill is enacted after AB 1727 in which case Sections 2, 2.5, and 2.9 of this bill shall not become operative.
(c) Section 2.9 of this bill incorporates amendments to Section 56.10 of the Civil Code proposed by this bill, AB 1178, and AB 1727. It shall only become operative if (1) all three bills are enacted and become effective on or before January 1, 2008, (2) all three bills amend Section 56.10 of the Civil Code, and (3) this bill is enacted after AB 1178 and AB 1727, in which case Sections 2, 2.5, and 2.7 of this bill shall not become operative.

SEC. 5.

 No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.