Published: 2015-07-09
Key Benefits:
(a) Public health records relating to human immunodeficiency virus (HIV) or acquired immunodeficiency syndrome (AIDS), containing personally identifying information, that were developed or acquired by a state or local public health agency, or an agent of that agency, shall be confidential and shall not be disclosed, except as otherwise provided by law for public health purposes or pursuant to a written authorization by the person who is the subject of the record or by his or her guardian or conservator.
(b) In accordance with subdivision (g) of Section 121022, a state or local public health agency, or an agent of that agency, may disclose personally identifying information in public health records, as described in subdivision (a), to other local, state, or federal public health agencies or to corroborating medical researchers, when the confidential information is necessary to carry out the duties of the agency or researcher in the investigation, control, or surveillance of disease, as determined by the state or local public health agency.
(c) Any disclosures authorized by subdivision (a), (b), or this subdivision shall include only the information necessary for the purpose of that disclosure and shall be made only upon the agreement that the information will be kept confidential as described in subdivision (a). Except as provided in paragraphs (1) to (3), inclusive, or as otherwise provided by law, any disclosure authorized by subdivision (a) or (b) shall not be made without written authorization as described in subdivision (a). Any unauthorized further disclosure shall be subject to the penalties described in subdivision (e).
(1) Notwithstanding any other law, the following disclosures shall be authorized for the purpose of enhancing the completeness of reporting to the federal Centers for Disease Control and Prevention (CDC) of HIV/AIDS and coinfection with tuberculosis, syphilis, gonorrhea, chlamydia, hepatitis B, hepatitis C, and meningococcal infection:
(A) The local public health agency HIV surveillance staff may further disclose the information to the health care provider who provides HIV care to the HIV-positive person who is the subject of the record for the purpose of assisting in compliance with subdivision (a) of Section 121022.
(B) Local public health agency tuberculosis control staff may further disclose the information to state public health agency tuberculosis control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent the information is requested by the CDC and permitted by subdivision (b), for purposes of the investigation, control, or surveillance of HIV and tuberculosis coinfections.
(C) Local public health agency sexually transmitted disease control staff may further disclose the information to state public health agency sexually transmitted disease control staff, who may further disclose the information, without disclosing patient identifying information, to the CDC, to the extent it is requested by the CDC and permitted by subdivision (b), for the purposes of the investigation, control, or surveillance of HIV and syphilis, gonorrhea, or chlamydia coinfection.
(D) For purposes of the investigation, control, or surveillance of HIV and its coinfection with hepatitis B, hepatitis C, and meningococcal infection, local public health agency communicable disease staff may further disclose the information to state public health agency staff, who may further disclose the information, without disclosing patient identifying information, to the CDC to the extent the information is requested by the CDC and permitted by subdivision (b).
(2) Notwithstanding any other law, the following disclosures shall be authorized for the purpose of facilitating appropriate HIV/AIDS medical care and treatment:
(A) State public health agency HIV surveillance staff, AIDS Drug Assistance Program staff, and care services staff may further disclose the information to local public health agency staff, who may further disclose the information to the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her.
(B) AIDS Drug Assistance Program staff and care services staff in the State Department of Public Health may further disclose the information directly to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care, for the purpose of proactively offering and coordinating care and treatment services to him or her.
(C) Local public health agency staff may further disclose acquired or developed information to the HIV-positive person who is the subject of the record or the health care provider who provides his or her HIV care for the purpose of proactively offering and coordinating care and treatment services to him or her.
(3) Notwithstanding any other law, for the purpose of facilitating appropriate medical care and treatment of persons coinfected with HIV and tuberculosis, syphilis, gonorrhea, chlamydia, hepatitis B, hepatitis C, or meningococcal infection, local public health agency sexually transmitted disease control, communicable disease control, and tuberculosis control staff may further disclose the information to state or local public health agency sexually transmitted disease control, communicable disease control, and tuberculosis control staff, the HIV-positive person who is the subject of the record, or the health care provider who provides his or her HIV, tuberculosis, hepatitis B, hepatitis C, meningococcal infection, and sexually transmitted disease care.
(4) For the purposes of paragraphs (2) and (3), “staff” shall not include nongovernmental entities, but shall include state and local contracted employees who work within state and local public health departments.
(d) A confidential public health record, as defined in subdivision (c) of Section 121035, shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding.
(e) (1) A person who negligently discloses the content of a confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, as described in subdivision (a), or as otherwise authorized by law, shall be subject to a civil penalty in an amount not to exceed five thousand dollars ($5,000), plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose record was disclosed.
(2) A person who willfully or maliciously discloses the content of any confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, or as otherwise authorized by law, shall be subject to a civil penalty in an amount not less than five thousand dollars ($5,000) and not more than twenty-five thousand dollars ($25,000), plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose confidential public health record was disclosed.
(3) A person who willfully, maliciously, or negligently discloses the content of a confidential public health record, as defined in subdivision (c) of Section 121035, to a third party, except pursuant to a written authorization, or as otherwise authorized by law, that results in economic, bodily, or psychological harm to the person whose confidential public health record was disclosed, is guilty of a misdemeanor, punishable by imprisonment in a county jail for a period not to exceed one year, or a fine of not to exceed twenty-five thousand dollars ($25,000), or both, plus court costs, as determined by the court. The penalty and costs shall be paid to the person whose confidential public health record was disclosed.
(4) A person who commits an act described in paragraph (1), (2), or (3), shall be liable to the person whose confidential public health record was disclosed for all actual damages for economic, bodily, or psychological harm that is a proximate result of the act.
(5) Each violation of this section is a separate and actionable offense.
(6) This section does not limit or expand the right of an injured person whose confidential public health record was disclosed to recover damages under any other applicable law.
(f) In the event that a confidential public health record, as defined in subdivision (c) of Section 121035, is disclosed, the information shall not be used to determine employability, or insurability of a person.
(Amended by Stats. 2014, Ch. 566, Sec. 1. Effective January 1, 2015.)
(a) Notwithstanding subdivision (f) of Section 120980, Section 121010, subdivision (g) of Section 121022, subdivision (f) of Section 121025, Section 121115, and Section 121280, the State Department of Public Health and qualified entities may share with each other health records involving the diagnosis, care, and treatment of human immunodeficiency virus (HIV) or acquired immunodeficiency syndrome (AIDS) related to a beneficiary enrolled in federal Ryan White Act funded programs who may be eligible for services under the federal Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (Public Law 111-152). The qualified entities, who shall be covered entities under the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to the act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), may share records only for the purpose of enrolling the beneficiary in Medi-Cal, the bridge programs, Medicaid expansion programs, and any insurance plan certified by the California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code, or any other programs authorized under the federal Patient Protection and Affordable Care Act (Public Law 111-148), and for the purpose of continuing his or her access to those programs and plans without disruption.
(b) The information provided by the State Department of Public Health pursuant to this section shall be limited to only the information necessary for the purposes of this section and shall not include HIV or AIDS surveillance data. This information shall not be further disclosed by a qualified entity, except to any or all of the following as necessary for the purposes of this section:
(1) The person who is the subject of the record or to his or her guardian or conservator.
(2) The provider of health care for the person with HIV or AIDS to whom the information pertains.
(3) The Office of AIDS within the State Department of Public Health.
(c) For purposes of this section, the following definitions shall apply:
(1) “Contractor” means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care.
(2) “Provider of health care” means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code.
(3) “Qualified entity” means any of the following:
(A) The State Department of Health Care Services.
(B) The California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code.
(C) Medi-Cal managed care plans.
(D) Health plans participating in the Bridge Program.
(E) Health plans offered through the Exchange.
(F) County health departments delivering HIV or AIDS health care services.
(d) Notwithstanding any other law, information shared pursuant to this section shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding.
(e) This section shall be implemented only to the extent permitted by federal law. All employees and contractors of a qualified entity who have access to confidential HIV-related medical records pursuant to this section shall be subject to, and all information shared pursuant to this section shall be protected in accordance with, the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to that act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code).
(Amended by Stats. 2014, Ch. 71, Sec. 93. Effective January 1, 2015.)
(a) To the extent Chapter 7 (commencing with Section 120975) and Chapter 10 (commencing with Section 121075) apply to records or information that would be covered by this chapter, Chapters 7 and 10 shall supersede this chapter.
(b) This chapter supersedes Section 100330 to the extent it applies to records or information covered by Section 100325 or 100330.
(Added by Stats. 1995, Ch. 415, Sec. 7. Effective January 1, 1996.)
For purposes of this chapter:
(a) “Disclosed” or “disclosure” or “discloses” has the same meaning as set forth in subdivision (b) of Section 121125.
(b) “State or local public health agencies” are the department, and any local entity that a health officer, as defined in Section 120100, serves.
(c) “Confidential public health record or records” means any paper or electronic record maintained by the department or a local health department or agency, or its agent, that includes data or information in a manner that identifies personal information, including, but not limited to, name, social security number, address, employer, or other information that may directly or indirectly lead to the identification of the individual who is the subject of the record.
(Amended by Stats. 2006, Ch. 20, Sec. 8. Effective April 17, 2006.)
