(a)(1)Solely for the purpose of developing information for inclusion in a health care cost, quality, and equity database, and consistent with paragraph (9) of subdivision (b) of Section 56.10 of the Civil Code, a health care service plan, including a specialized health care service plan, an insurer licensed to provide health insurance, as defined in Section 106 of the Insurance Code, a supplier, as defined in paragraph (3) of subdivision (b) of Section 1367.50, or a provider, as defined in paragraph (2) of subdivision (b) of Section 1367.50, shall, and a self-insured employer, a multiemployer self-insured plan that is responsible for paying for health care services provided to beneficiaries, and the
trust administrator for a multiemployer self-insured plan may, provide all of the following to the Secretary of California Health and Human Services:
(A)Utilization data from the health care service plans’ and insurers’ medical, dental, and pharmacy claims or, in the case of entities that do not use claims data, including, but not limited to, integrated delivery systems, encounter data consistent with the core set of data elements for data submission proposed by the All-Payer Claims Database Council, the University of New Hampshire, and the National Association of Health Data Organizations.
(B)Pricing information for health care items, services, and medical and surgical episodes of care gathered from allowed charges for covered health care items and services or, in the case of
entities that do not use or produce individual claims, price information that is the best possible proxy to pricing information for health care items, services, and medical and surgical episodes of care available in lieu of actual cost data to allow for meaningful comparisons of provider prices and treatment costs.
(C)Information sufficient to determine the impacts of social determinants of health, including age, gender, race, ethnicity, limited English proficiency, sexual orientation and gender identity, ZIP Code, and any other factors for which there is peer-reviewed evidence.
(2)(A)The secretary may report an entity’s failure to comply with paragraph (1) to the entity’s regulating agency.
(B)The
regulating agency of an entity described in paragraph (1) may enforce paragraph (1) using its existing enforcement procedures. Notwithstanding any other law, moneys collected pursuant to this authorization shall be subject to appropriation by the Legislature, and the failure to comply with paragraph (1) is not a crime.
(b)(1)(A)Subject to paragraph (9) of subdivision (b) of Section 56.10 of the Civil Code, all uses and disclosures of data made pursuant to this section shall comply with all applicable state and federal laws for the protection of the privacy and security of data, including, but not limited to, the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), the Information Practices Act of 1977 (Chapter 1 (commencing with
Section 1798) of Title 1.8 of Part 4 of Division 3 of the Civil Code), Title 1.81 (commencing with Section 1798.80) of Part 4 of Division 3 of the Civil Code, and the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009 (Public Law 111-5), and implementing regulations.
(B)Use and disclosure of data pursuant to this section shall be consistent with privacy and security protections for individually identifiable health information and medical information under state and federal law, including any applicable exceptions to the requirement to obtain patient authorization, including, but not limited to, paragraph (9) of subdivision (b) of, and paragraph (7) of
subdivision (c) of, Section 56.10 of the Civil Code.
(2)(A)All policies and protocols developed pursuant to this section shall ensure that the privacy, security, and confidentiality of individually identifiable health information and medical information is protected. The secretary shall not disclose any unaggregated, individually identifiable health information or medical information and shall develop a protocol for assessing the risk of reidentification stemming from disclosure of any health information and medical information that is aggregated, individually identifiable health information, or medical information. This paragraph does not preclude sharing individually identifiable health information that is not aggregated with researchers for research purposes, consistent with paragraph (7) of subdivision (c) of
Section 56.10 of the Civil Code.
(B)For the purposes of this paragraph, the following terms have the following meanings:
(i)“Individually identifiable health information” has the same meaning as in Section 160.103 of Title 45 of the Code of Federal Regulations.
(ii)“Medical information” has the same meaning as in Section 56.05 of the Civil Code.
(3)Confidentially negotiated contract terms contained in a contract between a health care service plan or insurer and a provider or supplier shall be protected in any public disclosure of data made pursuant to this section. Individually identifiable proprietary contract information included in a contract between a
health care service plan or insurer and a provider or supplier shall not be disclosed in an unaggregated format.
(c)The secretary may enter into contracts or agreements to share the information collected under this section for the purposes of this chapter, provided that any use of that information complies with the requirements of this section.
(d)(1)The agency administering the California Health Care Cost, Quality, and Equity Database shall adopt rigorous standards of security protection to ensure as nearly as possible that the information contained in and collected for the purposes of the California Health Care Cost, Quality, and Equity Database is not compromised. This shall include, but is not limited to, requiring encryption.
(2)For the purposes of paragraph (1), the term “encryption” means the protection of data in electronic form, in storage or in transit, using an encryption technology that has been generally accepted by experts in the field of information security that renders data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of the data. “Encryption” includes appropriate management and safeguards of cryptographic keys to protect the integrity of the encryption.
(e)For purposes of this section, the California Health and Human Services Agency is an agency subject to Chapter 1 (commencing with Section 1798) of Title 1.8 of Part 4 of Division 3 of the Civil Code.