Existing law establishes procedures for providing access to various types of health care records, including patient records, as defined, by patients and persons having responsibility for decisions respecting the health care of others. Existing law gives health care providers, as defined, various responsibilities in connection with providing access to these records.

This bill would require certain health care providers at the time of creation of a patient record providers, no later than the date of the first service delivery, or as soon as reasonably practicable after an emergency treatment situation, to provide a statement to the patient, or the patients representative, that sets forth the patients rights and the intended retention period for the records. The bill would require those health care providers that plan to destroy patient records to notify the patient at least 60 days before a patients records are to be destroyed, as provided. The bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. The bill would authorize a health care provider to charge a patient for the actual costs of copying, mailing, or shipping the patients records under that provision. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations. Under the bill, if a group practice or clinic comprised of health care providers subject to the bill is the custodian of patient records for those health care providers, the group practice or clinic, rather than the individual health care provider, would be required to comply with the bills provisions.

Existing law establishes procedures for providing access to various types of health care records, including patient records, as defined, by patients and persons having responsibility for decisions respecting the health care of others. Existing law gives health care providers, as defined, various responsibilities in connection with providing access to these records.

This bill would require certain health care providers at the time of creation of a patient record to provide a statement to the patient, or the patients representative, that sets forth the patients rights and the intended retention period for the records. The bill would require certain those health care providers that plan to destroy patient records to notify the patient at least 60 days before a patients records are to be destroyed, as provided. The bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. The bill would authorize a health care provider to charge a patient for the actual costs of copying, mailing, or shipping the patients records under that provision. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations. Under the bill, if a group practice or clinic comprised of health care providers subject to the bill is the custodian of patient records for those health care providers, the group practice or clinic, rather than the individual health care provider, would be required to comply with the bills provisions.

Existing law establishes procedures for providing access to various types of health care records, including patient records, as defined, by patients and persons having responsibility for decisions respecting the health care of others. Existing law gives health care providers, as defined, various responsibilities in connection with providing access to these records.

This bill would require certain health care providers at the time of creation of a patient record to provide a statement to the patient, or the patients representative, that sets forth the patients rights and the intended retention period for the records. The bill would require certain health care providers that plan to destroy patient records to notify the patient at least 60 days before a patients records are to be destroyed, as provided. The bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. The bill would authorize a health care provider to charge a patient for the actual costs of copying, archiving, mailing, or shipping the patients records under that provision. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations.

Existing law establishes procedures for providing access to various types of health care records, including patient records, as defined, by patients and persons having responsibility for decisions respecting the health care of others. Existing law gives health care providers, as defined, various responsibilities in connection with providing access to these records.

This bill would require certain health care providers at the time of creation of a patient record to provide a statement to the patient, or the patients representative, that sets forth the patients rights and the intended retention period for the records. The bill would require certain health care providers that plan to destroy patient records to notify the patient at least 60 days before a patients records are to be destroyed, as provided. The bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. The bill would authorize a health care provider to charge a patient for the actual costs of copying, archiving, mailing, or shipping the patients records under that provision. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations.

Existing law establishes procedures for providing access to various types of health care records, including patient records, as defined, by patients and persons having responsibility for decisions respecting the health care of others. Existing law gives health care providers, as defined, various responsibilities in connection with providing access to these records.

This bill would require certain health care providers at the time of creation of a patient record to provide a statement to the patient, or the patients representative, that sets forth the patients rights and the intended retention period for the records. The bill would require certain health care providers that plan to destroy patient records to notify the patient at least 60 days before a patients records are to be destroyed, as provided. The bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. The bill would authorize a health care provider to charge a patient for the actual costs of copying, archiving, mailing, or shipping the patients records under that provision. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations.

Date of Hearing: August 8, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

SBPCA Bill Id:SB 1238

Author:(Roth) – As Amended Ver:June 28, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill relates to retention and destruction of medical records. Specifically, this bill:

1. Requires physicians, surgeons, podiatrists, dentists, optometrists, and chiropractors (health care providers) who create patient records to notify patients if their medical records will be destroyed and provide patients the opportunity to request their records, at patient expense for actual printing and delivery cost.
2. Requires providers to provide a statement to a patient describing their retention policy and the patient’s right to access their medical information, and to retain such a signed statement in a medical record.
3. Excludes psychiatric records and records maintained by licensed clinics from this bill, but applies this bill's requirements to other group practices and clinics comprised of health providers.

FISCAL EFFECT:

Indeterminate, potentially significant GF costs to California Department of Corrections and Rehabilitation (CDCR) associated with information technology, training, requiring statements to be signed by the patient, retaining the individual’s address of record, and providing copies of records.

COMMENTS:

1. Purpose. This bill is intended to ensure patients understand how their medical records will be retained and are notified prior to their records being destroyed. The author indicates patient care can suffer if records of past conditions and treatment are not available.
2. Background. There is no standard federal or state law requiring all healthcare providers to maintain medical records for a specific set of time. Professional organizations, regulators, and payers often have their own separate retention policies. Many professional organizations suggest that providers try to keep records as long as possible to protect the provider against liability. Providers treating Medi-Cal patients must keep records for a minimum of 10 years. There is currently no legal requirement to notify patients before records are destroyed.
3. Support and Opposition. This bill is supported by labor organizations and consumer advocates. Health care providers oppose this bill, citing administrative burden and limited benefit, particularly as it pertains to the requirement to send notices prior to destruction of records. The California Medical Association seeks amendments to address their concerns and remove the second notice prior to destruction of records.
4. Stakeholder Discussions. Stakeholders disagree on the relative costs and benefits of this bill's policies. Discussions are ongoing to resolve stakeholder concerns.

Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081

Date of Hearing: June 26, 2018

ASSEMBLY COMMITTEE ON HEALTH

Jim Wood, Chair

SBPCA Bill Id:SB 1238

Author:(Roth) – As Amended Ver:June 20, 2018

SENATE VOTE: 34-2

SUBJECT: Patient records: maintenance and storage.

SUMMARY: Requires physicians, surgeons, podiatrists, dentists, optometrists, and chiropractors (health care providers), at the time the initial patient record (record) is created to inform the patient of intended retention period for the records, as specified, and requires health care providers to notify the patient no fewer than 60 days if the health care provider plans to destroy the patient’s records. Specifically, this bill:

1. Requires a copy of the signed statement to include, the intended retention period for the records, as specified in applicable law or by the health care provider’s policy, the patient’s right to inspect, copy, and provide an addendum to their records.
2. If the patient or the patient’s representative refuses to sign the statement described in 1) above, the patient’s record will indicate that the patient refused to sign the statement.
3. Requires health care providers to notify the patient no fewer than 60 days via first-class mail, electronic mail, or both, if the health care provider plans to destroy the patient’s records.
4. Permits the statement, as described in 1) above, to be included in another form or statement provided to the patient, or the patient’s representative, at the time the initial patient record is created.
5. Permits a health care provider to charge a patient for the actual costs incurred by the health care provider for copying, mailing, or shipping the patient’s records.
6. Excludes health care providers from provisions described in 1) and 3) above if the health care provider utilizes electronic health records and those records are stored indefinitely.
7. Permits health care providers who violate the requirements of 1) and 3) above to be cited and assessed an administrative penalty, as specified.
8. Requires a group practice or clinic comprised of health care providers to comply with the requirements as specified above, if a group practice or clinic comprised of health care providers is the custodian of patient records for those health care providers.
9. Exempts clinics and psychotherapy notes from provisions in 1) and 3) above.

EXISTING LAW:

1. Establishes the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) which creates standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances.
2. Requires, under the Patient Access to Health Records law, any adult patient, any minor patient authorized by law to consent to medical treatment, and any patient representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available.
3. Entitles a patient, or former patient, to a copy at no charge, of the relevant portion of the patient’s records, upon presenting to the provider a written request, and proof that the records or supporting forms are needed to support a claim or appeal regarding eligibility for a public benefit program.
4. Entitles any adult patient, any minor patient authorized by law to consent to medical treatment, and any patient representative, to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available.
5. Requires any patient or patient’s representative to be entitled to copies of all or any portion of the patient records that they have a right to inspect, upon presenting a written request to the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that does not exceed $0.25 per page or $0.50 per page for records that are copied from microfilm and any additional reasonable clerical costs incurred in making the records available.
6. Defines patient records as records in any form or medium maintained by, or in the custody or control of, a health care provider relating to the health history, diagnosis, or condition of a patient, or relating to treatment provided or proposed to be provided to the patient.
7. Defines a clinic as an organized outpatient health facility that provides direct medical, surgical, dental, optometric, or podiatric advice, services, or treatment to patients who remain less than 24 hours, and can also provide diagnostic or therapeutic services to patients in the home as an incident to care provided at the clinic facility.
8. Requires optometrists to retain a patient’s records for a minimum of seven years from the date he or she completes treatment of the patient or if the patient is a minor, a minimum of seven years and at least until the patient reaches 19 years of age.

FISCAL EFFECT: According to the Senate Appropriations Committee, there are potential costs (in the low-mid thousands, special funds) for one-time development of regulations, ongoing compliance enforcement, and ongoing adjudication of appeals.

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, a patient’s ability to create and maintain a personal health record is an essential tool in empowering an individual to take control of their health. The author notes it is critical to the creation of a personal health record is access and retention of medical records created by a health care provider. The author states, unfortunately, there is no national standard on how long a health provider is required to maintain these records. While HIPAA provides strict guidelines as to how medical records are disposed of and accessed by patients, there is no final notice to a patient when their personal medical records will be destroyed. The author concludes that this bill ensures that a patient’s medical records, after January 1, 2019, most of which are now electronic health records (EHRs), are not destroyed until the patient has been notified 60 days prior to their destruction by electronic mail and/or via first-class mail.
2. BACKGROUND. Patient records do not belong to the patient. Medical records are the property of the medical provider, or facility that prepares the records. The patient has the right to view the originals, obtain copies, or provide an addendum to their records. The patient has the right to request their medical records at any point. According to the Office of the National Coordinator for Health Information Technology (ONC), patients having access to health information held by health care providers and health plans allows patients to be better managers of their health for several reasons, including that patients are able to make more informed treatment decisions. Currently providers do not have to notify patients before destroying medical records.
   1. Retention Periods. There is no standard federal or state law requiring all healthcare providers to maintain medical records for a specific set of time. In fact, each state has its own laws governing the retention of medical records. Professional organizations, regulators, and payors often have their own separate retention policies. However, many professional organizations suggest that providers try to keep records as long as possible to protect the provider against liability. Currently there are various requirements for certain providers, including:
      1. Providers treating Medi-Cal patients must keep records for a minimum of 10 years;
      2. Optometrists are required to keep records for seven years;
      3. The Department of Managed Health Care requires contracts between health plans and providers who regularly furnish services under the plan to require the provider to maintain records for at least two years;
      4. Health Maintenance Organization medical records must be maintained for a minimum of two years;
      5. Physician who dispense Schedule I, II, or IV drugs must keep records for three years; and,
      6. In Workers’ Compensation Cases, providers must keep records for five years.
   2. Patient Access to Medical Records. There are various reasons patients see a variety of providers throughout their lifetime including, relocating, changing health insurance plans, or changes in health issues. According to the Medical Board of California, the law only addresses the patient’s request for copies of their own medical records and does not address a patient’s request to transfer records between health care providers. Physicians require a patient to sign a records release form to transfer records. According to the ONC, recent data shows there are significant gaps in an individual’s exchange of medical information. Approximately 19% of individuals had to physically bring a test result (X-ray, MRI, etc.) to an appointment, 7% of individuals had to provide their own medical history because their chart could not be found, and 7% of individuals had to redo a test or procedure because the previous results were not available.
   3. Privacy. As currently drafted, this bill requires a notification be sent to patients via first-class mail, electronic mail, or both. Among stakeholders, there is no general consensus as to whether a notification sent to patients could violate privacy laws. In general, protections of patient medical records fall under two main bodies of law: HIPAA, and the Confidentiality of Medical Information Act (CMIA) in California. HIPAA provides federal protections for patient’s health information held by “covered entities” and any “business associates” that a covered entity engages to help it carry out its health care activities. A covered entity can be a provider, a health plan, or a health care clearinghouse that processes health information it receives from another entity. While HIPAA establishes a federal floor for minimum privacy protections and the right of patients to access their health information, states are permitted to enact laws that provide greater privacy protections or rights. HIPAA and CMIA provide different methods of notice and privacy protection as follows:
      1. HIPAA. Under HIPAA, providers (or “covered entities”) are required to provide a notice of their privacy practices, which describes the ways in which the covered entity uses and discloses protected health information (including medical records). While the notice must describe an individual’s right to complain if they believe their privacy rights have been violated, there is no specific requirement that this notice describe the ability of patients to access their medical records. This privacy notice is required to be given to patients at their first service encounter, and the provider must make a good faith effort to obtain written acknowledgment of receipt of the privacy notice; and,
      2. CMIA. In general, CMIA prohibits a health care provider, a health care service plan and their contractors or pharmaceutical companies from disclosing patient medical information absent an authorization signed by the patient or the patient’s legal representative that complies with strict statutory standards. Information that is not individually identifiable is not subject to CMIA and may be disclosed without the patient’s authorization. To be individually identifiable, the information must include any element of personal identifying information sufficient to allow identification, such as name, address, email address, telephone number, or other information that alone or in combination reveals the individual’s identity.
   4. Number of Patients. According to network adequacy requirements on health plans and patient to physician ratios, insurers are required to ensure at least the equivalent of one full-time primary care physician per 2,000 covered persons for each enrollment year. Many physicians contract with many different plans therefore; it is not uncommon for a physician to have over 6,000 patients in an enrollment year. According to a study by the American Dental Association and the Health Policy Institute, based on data from 1990 to 2016, the average dentist sees over 3,600 patients per year and that figure jumps to almost 4,700 for specialists. Assuming that the provider continues to see many of the same patients over the span of many years, dentists may still accumulate records for thousands of patients over their career in dentistry.
   5. Health care providers. Podiatrists, dentists, optometrists, and chiropractors practice in a variety of different health care facilities, though will often provide care in a private independent setting. Physicians work in a variety of settings, including acute-care hospitals, long-term care facilities, urgent care center; outpatient clinics, and emergency medical services, correctional facilities, and academic settings. It is important to note, that physicians may practice at various settings simultaneously during their career, such as providing care at a teaching hospital and may have their own practice as well. As this bill is written, physicians, surgeons, podiatrists, dentists, optometrists, and chiropractors at group practices or clinics are exempt from sending out a notification before destroying records. The requirement of sending out a notification would apply only to the group practice, and clinics are completely exempt from the provisions in this bill. According to the California Health Care Foundation, most California physicians practice in a group setting. The Kaiser Permanente medical groups, the largest group practices in the state, accounted for over 10% of physicians. Solo physician practices were most prevalent in the Central Coast, Orange, and Los Angeles regions.
   6. EHR Incentive Program. In 2009, the federal American Recovery Reinvest Act established the Health Information Technology (HITECH) Act. The HITECH Act instructed the Secretary of the Health and Human Services to strengthen individuals’ access rights in a variety of ways. One of the objectives of the HITECH Act is to integrate health information technology including EHRs into the initial and ongoing training of health professionals and others in the healthcare industry to improve the quality of healthcare thought the smooth and accurate electronic use and exchange of information. The HITECH Act authorized the EHR Incentive Program for Medicaid and Medicare providers. The EHR Incentive Program requires certain eligible hospitals to demonstrate meaningful use of certified EHR technology in order to receive incentive payments. Beginning in 2011, eligible Medi-Cal professionals and hospital were able to receive incentive payments to assist in purchasing, installing, and using EHRs in their practices. According to ONC 2016 data, approximately 47% of physicians in California have demonstrated meaningful use of EHR. The use of EHRs is increasing and it is likely that the percentage of providers using EHRs has increased since 2016.
3. SUPPORT. The California Nurses Association/National Nurses United (CNA) state that this bill requires health care providers to notify their patients at least 60 days before they destroy that patient’s medical records and also provides patients with the ability to obtain copies of their medical records before they are destroyed. CNA notes that many patients are unaware that their health care providers can destroy their records without providing them with any notice. CNA points out that medical records contain the important documentation of a patient’s medical history, symptoms, diagnoses, medications, lab tests, and other treatment over time and once medical information is destroyed it can be impossible to retrieve the records. Accurate and complete medical records are critically important when evaluating the health of a patient, particularly when that doctor or nurse may have never provided care to that specific patient before. CNA concludes that access to patient records is crucial especially for patients with serious or chronic health conditions.
4. OPPOSE UNLESS AMENDED. The California Medical Association (CMA) states that this bill would require physicians, podiatrists, dentists, optometrists, and chiropractors to provide multiple conflicting and redundant notices to patients regarding medical records. CMA argues that at a time when access to health care is paramount, this additional administrative burden will increase the cost of providing health care and subsequently decrease access for minimal benefit. CMA goes on to note that rural and smaller providers especially will not have the resources and ability to comply. CMA states that many health plans and health information exchanges now govern record maintenance and destruction, depending on how the health system is integrated and on the electronic health record system used. CMA concludes that this bill as written does not acknowledge these facts, and raises many operational issues of how this would work for providers that may practice in a variety of settings and given that the records themselves are maintained in the facility’s internal systems and do not follow the provider.
5. PREVIOUS LEGISLATION.
   1. SB 241 (Monning), Chapter 513, Statutes of 2017, revises provisions of law governing the right of patients to access and copy their medical records by conforming these requirements to HIPAA requirements, including requiring health care providers to provide the records in an electronic format if they are maintained electronically and if the patient requests the records in an electronic format, more clearly specifying the reasonable clerical costs that can by charged by the providers, and by making other technical, clarifying and conforming changes.
   2. SB 575 (Leyva), Chapter 626, Statutes of 2017, entitles a patient to a copy, at no charge, of the relevant portion of the patient’s records that are needed to support a claim regarding eligibility for specified public benefit programs. Adds to the list of public benefit programs the In-Home Supportive Services program, the California Work Opportunity and Responsibility to Kids program, federal veterans service-connected compensation and nonservice connected pension disability benefits, and CalFRESH.
   3. AB 1337 (Linder), Chapter 528, Statutes of 2015, creates an authorization form for disclosure of health information by medical providers, and requires electronic medical records requested prior to the filing of any action or appearance of a defendant in an action to be provided electronically if requested in an electronic format, and if it is readily producible in that format.
   4. SB 1415 (Kuehl) of 2008, would have required physicians, surgeons, podiatrists, dentists, optometrists, and chiropractors, at the time the initial patient records are created to inform the patient of intended retention period for the records, the patient’s right to inspect, copy, and provide an addendum to their records and require the health care provider to send a notification to the patient if the health care provider is going to destroy the patient’s records earlier than the retention period specified at the time of the initial patient record. SB 1415 was vetoed by the Governor who stated: “The historic delay in passing the 2008-09 State Budget has forced me to prioritize the bills sent to my desk at the end of the year's legislative session. Given the delay, I am only signing bills that are the highest priority for California. This bill does not meet that standard and I cannot sign it at this time.”
   5. AB 986 (Eng), Chapter 276, Statutes of 2007, among other provisions, required optometrists to retain a patient’s records for a minimum of seven years from the date treatment is completed, or in the case of minors, seven years from the completed treatment date and at least until the patient reaches 19 years of age.
6. SUGGESTED AMENDMENTS. As currently drafted, this bill allows the statement provided to the patient regarding the retention policy of their records to be included in another form or statement. This is to decrease the redundancy of information provided to patients and to streamline the process. The Committee may wish to amend the bill in order to ensure the retention policy is consistent with current HIPAA requirements. The Committee may also wish to amend the bill to change the timing of when a notification is sent to a patient.
7. POLICY COMMENT. This bill is substantially similar to the introduced version of SB 1415 (Kuehl) in 2008. Since 2009, there have been an increasing number of physicians, hospitals, and clinics using EHRs. How medical records are stored and provided to patients has dramatically changed within the past decade and continues to evolve. It is unknown how many patients on average request their medical records, but the number of physicians impacted by this bill could be substantial. Stakeholders, supporters and opponents of this bill all agree that relaying to the patient the retention period of their records is important. However, what is the best retention policy for a patient remains contentious. It is unclear if the administrative burden of the notification requirement outweighs the benefit of patients gaining access to their medical records.

REGISTERED SUPPORT / OPPOSITION:

Support

California Association of Health Underwriters

California Nurses Association/National Nurses United

California Labor Federation

California School Employees Association, AFL-CIO

Congress of California Seniors

Consumer Attorneys of California

Consumer Union-Advocacy Division of Consumer Reports

Health Access California

Western Center on Law and Poverty

Opposition

California Chiropractic Association (unless amended)

California Dental Association (unless amended)

California Health Information Management Association

California Medical Association (unless amended)

California Optometric Association

California Society of Plastic Surgeons

Analysis Prepared by: Monica Montano / HEALTH / (916) 319-2097

 THIRD READING  

Bill No: SB 1238

Author: Roth (D)

Amended: 4/9/18

Vote: 21

SENATE HEALTH COMMITTEE: 8-0, 4/4/18

AYES: Hernandez, Nguyen, Leyva, Mitchell, Monning, Newman, Nielsen, Roth

NO VOTE RECORDED: Pan

SENATE JUDICIARY COMMITTEE: 6-1, 4/24/18

AYES: Jackson, Moorlach, Hertzberg, Monning, Stern, Wieckowski

NOES: Anderson

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/22/18

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

SUBJECT: Patient records: maintenance and storage

SOURCE: Author

DIGEST:

This bill (1) requires physicians, podiatrists, dentists, optometrists, and chiropractors to provide a statement to a patient at the time an initial patient record is created that informs the patient of their right to inspect and copy their medical records, and of the intended retention period for the records; (2) requires the health care provider to notify the patient, at least 60 days prior to the planned destruction of medical records, using the patient’s last known mailing or electronic mail address; and (3) exempts providers from this bill if the health care provider utilizes electronic health records and those records are stored in perpetuity.

ANALYSIS:

Existing law:

1. Requires, under the Patient Access to Health Records (PAHR) law, any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment, and any patient representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available. [HSC §123100 et. seq.]
2. Defines “patient records,” for purposes of PAHR, as records in any form or medium maintained by, or in the custody or control of, a health care provider relating to the health history, diagnosis, or condition of a patient, or relating to treatment provided or proposed to be provided to the patient. [HSC §123105]
3. Defines “health care provider,” for purposes of PAHR, as a licensed health facility, clinic, or home health agency, or a licensed health care professional, as specified. [HSC §123105]
4. Requires any patient or patient’s representative to be entitled to copies of all or any portion of the patient records that he or she has a right to inspect, upon presenting a written request of the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that does not exceed $.25 per page of $.50 per page for records that are copied from microfilm and any additional reasonable clerical costs incurred in making the records available. [HSC §123110]
5. Establishes the Confidentiality of Medical Information Act (CMIA) in the Civil Code, which establishes protections for the use of medical information, which is defined as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. [CIV §56 et. seq.]
6. Requires, under the CMIA, upon the patient’s written request, that any entity the compiles or maintains medical information for any reason, to provide the patient, at no charge, with a copy of any medical profile, summary, or information maintained by the entity with respect to the patient. However, any patient records that are subject to inspection by the patient pursuant to PAHR are excluded from this requirement, and specifies that this requirement does not limit the right of a health care provider to charge a fee for the preparation of a summary of patient records as provided under PAHR. [CIV §56.07]

This bill:

1. Requires a “health care provider,” as defined, who create patient records, as defined, to provide a statement to be signed by the patient, at the time the initial patient record is created, that sets forth both of the following:
   1. The patient’s rights under specified provisions of existing law to inspect his or her medical records, obtain copies of his or her medical records, and to provide a written addendum with respect to any item or statement in the patient’s records that the patient believes to be incomplete or incorrect; and,
   2. The intended retention period for the records, as specified in applicable law or by the health care provider’s retention policy.
2. Defines a “health care provider,” for purposes of this bill, as a physician, podiatrist, dentist, optometrist, or chiropractor.
3. Requires a copy of the signed statement in 1) above to be provided to the patient. Requires the record to indicate if a patient is provided a statement at the time that the initial patient record is created, and the patient refuses to sign the statement.
4. Permits the statement required in 1) above to be included in another form or statement provided to the patient, or the patient’s representative, at the time the initial patient record is created.
5. Requires that if a health care provider plans to destroy patient records, to notify the patient no fewer than 60 days before the planned destruction via first-class mail, electronic mail, or both, to the patient’s last known mailing or electronic mail address, or both.
6. Requires the notification in 4) above to inform the patient that his or her records are scheduled to be destroyed and the date of the proposed destruction of records, and to also inform the patient of his or her rights under existing law to inspect his or her medical records.
7. Requires a health care provider to provide a patient with his or her original medical records that the provider plans to destroy earlier than the period specified in the signed statement if the patient makes a request for the records before the date of the proposed destruction of the records. Permits the patient to designate delivery of patient records either by personal pickup, mail, overnight delivery, or other delivery means.
8. Specifies that this bill does not reduce the length of record retention as otherwise required by law.
9. Permits a health care provider to charge a patient for the actual costs incurred by the health care provider for copying, mailing, or shipping the patient’s records under this section, in accordance with specified provisions of law that limit the costs that can be charged for copying. Specifies that this bill does not authorize a health care provider to charge a patient for maintenance of any patient records that the health care provider is obligated by law to maintain.
10. Exempts health care providers from this bill if the health care provider utilizes electronic health records and those records are stored in perpetuity.
11. Exempts health care providers from this bill for medical records that are created for a patient who is referred to the provider solely for a diagnostic evaluation, if the provider does not provide treatment to the patient and reports the results of the diagnostic evaluation to the patient’s referring provider.
12. Exempts patient records created by a psychiatrist, as defined, including psychotherapy notes, as defined, from the provisions of this bill.
13. Makes a violation of the provisions of this bill by a provider subject to an administrative penalty pursuant to specified provisions of existing law. Prohibits a citation from being issued for a first violation, and specifies that this administrative remedy constitutes the exclusive remedy for a violation of this bill.

Comments

1. Author’s statement. According to the author, a patient’s ability to create and maintain a personal health record is an essential tool in empowering an individual to take control of their health. Critical to the creation of a personal health record is access to medical records created by a health care provider. Unfortunately, there is no national standard on how long a health provider is required to maintain these records. While the federal Health Information Portability and Accountability Act of 1996 (HIPPA) provides strict guidelines for how medical records are disposed of and accessed by patients, there is no final notice to a patient when their personal medical records will be destroyed. This bill ensures that a patient’s medical records after January 1, 2019, for which most are now created as an electronic health record, are not destroyed until the patient has been notified 60 days prior to their destruction by electronic mail and/or via first-class mail.
2. Privacy and access to medical records. In general, patient protections of medical records fall under two main bodies of law: HIPAA, and the CMIA in California. HIPAA provides federal protections for patient’s health information held by “covered entities” and any “business associates” that a covered entity engages to help it carry out its health care activities. A covered entity can be a provider, a health plan, or a health care clearinghouse that processes health information it receives from another entity. While HIPAA establishes a federal floor for minimum privacy protections and the right of patients to access their health information, states are permitted to enact laws that provide greater privacy protections or rights. Separately, the two main bodies of state law govern patient access to medical records include PAHR in the Health and Safety Code, and provisions of law in the Evidence Code governing requests for medical information made by attorneys representing patients.
3. Notice requirement under HIPAA. Under HIPAA, providers (or “covered entities”) are required to provide a notice of their privacy practices, which describes the ways in which the covered entity uses and discloses protected health information (including medical records). While the notice must describe individual’s right to complain if they believe their privacy rights have been violated, there is no specific requirement that this notice describe the ability of patients to access their medical records. This privacy notice is required to be given to patients at their first service encounter, and the provider must make a good faith effort to obtain written acknowledgment of receipt of the privacy notice.
4. There is no general retention period for medical records in state or federal law. There is no general law applicable to all health care providers requiring a provider to maintain medical records for a specific period of time, though professional organizations, regulators, and payors often have their own policies or requirements. For example:
5. Medi-Cal providers must keep records of Medi-Cal patients for ten years after the date that the last service was rendered under the Medi-Cal program;
6. Optometrists must retain a patient’s records for a minimum of seven years from the date he or she completes treatment of a patient; and,
7. The Department of Managed Health Care regulations require contracts between health plans and providers who regularly furnish services under the plan to require the provider to maintain records for at least two years.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Committee on Appropriations:

• Potential costs (in the low-mid thousands, special funds) for one-time development of regulations, ongoing compliance enforcement, and ongoing adjudication of appeals.

SUPPORT: (Verified 5/23/18)

California Advocates for Nursing Home Reform

California Association of Health Underwriters

California Labor Federation

California School Employees Association

California Nurses Association/National Nurses United

Consumer Attorneys of California

Consumers Union

Congress of California Seniors

Medical Board of California

Older Women’s League of San Francisco

Western Center on Law and Poverty

1 Individual

OPPOSITION: (Verified 5/23/18)

California Health Information Association

California Medical Association

ARGUMENTS IN SUPPORT: Consumers Union states in support that in this dynamic health care environment, consumers may find themselves subject to more changes in coverage, networks and specific providers than ever. Consumers Union states that it is more important to assure that patients have ready access to their medical records and do not find they have been destroyed without their knowledge. The Congress of California Seniors (CCS) states in support that under current law, medical providers may destroy a patient’ medical records at will. Without medical records, CCS states that a patient may not be able to give future providers the precise information needed for future treatment, and duplicative tests and records may become necessary. CCS argues that older patients without up-to-date records may be denied continuation of long-term treatments until their need is re-established. CCS note that current law establishes the right of patients to access their medical records, but that right means nothing if the records have been destroyed. The California School Employees Association (CSEA) states in support that many patients are unaware that their health care providers can destroy their records without providing them with any notice, and that once medical information is destroyed, it may be impossible to retrieve these records. For example, CSEA states that cancer patients often receive radiation therapy. If the cancer returns or affects a different part of the body, a radiation oncologist must know how much radiation was given to know what can be safely administered to the patient the next time. California Advocates for Nursing Home Reform states in support that California gives patients ample rights related to their records but those rights lose considerable value when they are unknown.

ARGUMENTS IN OPPOSITION: The California Medical Association (CMA) is opposed to this bill unless amended. CMA states that in addition to creating various notices upon a patient’s first visits, would also create an ongoing rolling requirement on their providers to constantly send out notifications to each patient they have ever seen prior to destroying medical records. In addition, CMA states that we are entering into a new era of record storage that largely negates the need for the notices required by this bill. For example, CMA states that many health plans and health information exchanges now govern record maintenance and storage, depending on how the health system is integrated and the electronic health record system used. CMA states that this bill raises many operational issues of how this would work for providers that may practice in a variety of hospitals and clinics that would also have to participate in such a process as well, given that the records themselves are maintained in the facility’s internal systems and may not necessarily follow the provider. CMA notes that many health plans stipulate different record storage requirements for providers, as do laws around workers’ compensation and Medi-Cal patients. In addition, CMA states that the federal Centers for Medicare and Medicaid Services earlier this month announced their MyHealthEData Initiative, which would move toward a system and health care information model of storage that would allow patients to control their own data and have access to their full health care records directly at all times. CMA states that it is important that we do not create new unnecessary burdens on providers, given the quick evolution of such laws and practices on medical record retention. CMA states that it is request that the bill be amended to ensure consistency with current privacy laws, and that rather than creating a new unreasonable and

conflicting process, that the bill work within the constructs of the current notice of privacy practices that providers already give to their patients related to their rights regarding their medical records.

Prepared by:

5/24/18 13:51:39

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

SB 1238 (Roth) - Patient records: maintenance and storage

This bill does not meet the criteria for referral to the Suspense File.

Bill Summary:

SB 1238 would require certain health care providers, at the time an initial patient record is created, to provide a statement to a patient that informs the patient of their right to inspect and copy their medical records, and the records’ intended retention period.

This bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. Additionally, this bill would authorize the issuance of citations and the assessment of administrative penalties for violations of these provisions.

Fiscal Impact:

• Potential costs (in the low-mid thousands, special funds) for one-time development of regulations, ongoing compliance enforcement, and ongoing adjudication of appeals.

Background:

Under the Patient Access to Health Records (PAHR) law, any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment, and any patient representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available. Existing law requires any patient or patient’s representative to be entitled to copies of all or any portion of the patient records that he or she has a right to inspect, upon presenting a written request of the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that does not exceed $.25 per page of $.50 per page for records that are copied from microfilm and any additional reasonable clerical costs incurred in making the records available. [HSC §123110]

There is no general law applicable to all health care providers requiring a provider to maintain medical records for a specific period of time, though professional organizations, regulators, and payors often have their own policies or requirements. For example: a) Medi-Cal providers must keep records of Medi-Cal patients for ten years after the date that the last service was rendered under the Medi-Cal program; b) Optometrists must retain a patient’s records for a minimum of seven years from the date he or she completes treatment of a patient; and, c) The Department of Managed Health Care regulations require contracts between health plans and providers who regularly furnish services under the plan to require the provider to maintain records for at least two years. (see Senate Committee on Health, SB 1238 (Roth, 2018) Analysis, Apr. 4, 2018.)

Proposed Law:

Senate Bill 1238 would require physicians, podiatrists, dentists, optometrists, and chiropractors, at the time an initial patient record is created, to provide a statement to a patient that informs the patient of their right to inspect and copy their medical records, and the records’ intended retention period.

Patient Notification. The bill would require to provide, no fewer than 60 days prior to the patient’s records to be destroyed, notify the patient through first-class mail, electronic mail, or both, to the last known mailing address or electronic mail address, or both.

Cost Recovery Provision. The bill would authorize a health provider to charge a patient for the actual cost for copying, mailing, or shipping the patient’s records.

Exemptions. The bill would provide exemptions under specified circumstances, including when:

• Medical records that are created for a patient who is referred to the provider solely for a diagnostic evaluation, if the provider does not provide treatment to the patient and reports the results of the diagnostic evaluation to the patient’s referring provider.
• A specified health care provider utilizes electronic health records and those records are stored in perpetuity.
• Patient records created by a psychiatrist, as defined, including psychotherapy notes, as defined.

The bill would a violation of the provisions of this bill by a provider subject to an administrative penalty pursuant to specified provisions of existing law.

Penalties. The bill would authorize the issuance of citations and the assessment of administrative penalties for violations of these provisions for the second and subsequent violation by a health care provider, as specified. The bill would prohibit a citation from being issued for a first violation, and specifies that this administrative remedy constitutes the exclusive remedy for a violation of the bill.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: SB 1238 (Author:Roth)

Version: April 9, 2018

Hearing Date: April 24, 2018

Fiscal: Yes

Urgency: No

Consultant: MS

SUBJECT

Patient records: maintenance and storage

DESCRIPTION

This bill would require certain health care providers to provide a statement to a patient at the time an initial patient record is created that informs the patient of their right to inspect and copy their medical records, and of the intended retention period for the records. This bill would require a health care provider to provide a patient with his or her original medical records that the provider plans to destroy if the patient makes a request for the records to the provider before the date of the proposed destruction of the records. Additionally, this bill would authorize the issuance of citations and the assessment of administrative penalties for violations of these provisions.

BACKGROUND

Medical records are created when a patient is treated by a health care provider and generally include a patient’s medical history, relevant lifestyle information (such as smoking), and family medical history. Medical records also contain laboratory test results, information on prescribed medications, and reports that indicate the results of operations and other medical procedures.

Medical records form the basis for planning patient care; documenting communications between health care providers and other health professionals who contribute to a patient’s care; assisting in protecting the legal interests of a patient and his or her health care provider; and documenting the care and services provided to a patient. Such uses stem from proper retention and sharing of these critical documents.

The Legislature has long sought to strike the right balance between retention of medical records, patient access, and patient privacy. In California, the protection of these sensitive records typically falls under two main bodies of law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the Confidentiality of Medical Information Act (CMIA). HIPAA, and its attendant regulations, serve to protect the privacy and security of patients’ health information but also serve as a patient bill of rights. One of the core rights that HIPAA and its underlying regulations provide individuals is the ability to access and obtain a copy of a patient’s personal health information. Patient access to medical records is further expanded upon in California by the Patient Access to Health Records (PAHR) Act and provisions within the Evidence Code governing requests for medical information made by attorneys in their efforts to represent patients.

This bill would further expand upon a patient’s right of access to their medical records by requiring physicians, podiatrists, dentists, optometrists, and chiropractors to provide a statement to a patient at the time an initial patient record is created to inform the patient of their right to inspect and copy their medical records, and of the intended retention period for the records. Additionally, this bill would require the health care provider to notify the patient no fewer than 60 days before the planned destruction via first-class mail, electronic mail, or both. The bill also would make the violation of its provisions by a provider subject to an administrative penalty pursuant to specified provisions of existing law.

CHANGES TO EXISTING LAW

Existing law requires, under the Patient Access to Health Records (PAHR) law, any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment, and any patient representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available. (Health & Saf. Code Sec. 123100 et seq.)

Existing law defines “patient records,” for the purposes of PAHR, as records in any form or medium maintained by, or in the custody or control of, a health care provider relating to the health history, diagnosis, or condition of a patient, or relating to treatment provided or proposed to be provided to the patient. (Health & Saf. Code Sec. 123105.)

Existing law defines “health care provider,” for the purposes of PAHR, as a licensed health facility, clinic, or home health agency, or a licensed health care professional, as specified. (Health & Saf. Code Sec. 123105.)

Existing law requires any patient or patient’s representative to be entitled to copies of all or any portion of the patient records that he or she has a right to inspect, upon presenting a written request to the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that does not exceed $.25 per page or $.50 per page for records that are copied from microfilm and any additional reasonable clerical costs incurred in making the records available. (Health & Saf. Code Sec. 123110.)

Existing law establishes the Confidentiality of Medical Information Act (CMIA), which establishes protections for the use of medical information, which is defined as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. (Civ. Code Sec. 56 et seq.)

Existing law requires, under the CMIA, upon the patient’s written request, that any entity that compiles or maintains medical information for any reason, to provide the patient, at no charge, with a copy of any medical profile, summary, or information maintained by the entity with respect to the patient. However, any patient records that are subject to inspection by the patient pursuant to PAHR are excluded from this requirement, and specifies that this requirement does not limit the right of a health care provider to charge a fee for the preparation of a summary of patient records as provided under PAHR. (Civ. Code Sec. 56.07.)

Existing law provides that any board, bureau, or commission within the Department of Consumer Affairs, the board created by the Chiropractic Initiative Act, and the Osteopathic Medical Board of California, may establish by regulation, a system for the issuance to a licensee of a citation which may contain an order of abatement or an order to pay an administrative fine assessed by the board, bureau, or commission where the licensee is in violation of the applicable licensing act or any regulation adopted pursuant thereto. (Bus. & Prof. Code Sec. 125.9.)

Existing law provides that this citation system shall contain the following provisions:

• citations shall be in writing and describe with particularity the nature of the violation, including specific reference to the provision of law determined to have been violated;
• whenever appropriate, the citation shall contain an order of abatement fixing a reasonable time for abatement of the violation;
• in no event shall the administrative fine assessed exceed $5,000 for each inspection or each investigation made, or $5,000 for each violation or count if the violation involves fraudulent billing submitted to an insurance company, the Medi-Cal program, or Medicare;
• in an assessing the fine, the board, bureau, or commission shall give due consideration to the appropriateness of the amount of the fine with respect to factors such as the gravity of the violation, the good faith of the licensee, and the history of previous violations;
• a citation or fine assessment issued pursuant to a citation shall inform the licensee that if he or she desires a hearing to contest the finding of a violation, that hearing shall be requested by written notice to the board, bureau, or commission within 30 days of the date of issuance of the citation or assessment. If a hearing is not requested pursuant to this section, payment of any fine shall not constitute an admission of the violation; and
• failure of a licensee to pay a fine within 30 days of the date of assessment, unless the citation is being appealed, may result in disciplinary action being taken by the board, bureau, or commission. Where a citation is not contested and fine is not paid, the full amount of the assessed fine shall be added to the fee for renewal of the license. A license shall not be renewed without payment of the renewal fee and fine. (Bus. & Prof. Code Sec. 125.9(b).)

Existing law provides that the citation system may contain the following provisions:

• a citation may be issued without the assessment of an administrative fine; and
• assessment of administrative fines may be limited to only particular violations of the applicable licensing act. (Bus. & Prof. Code Sec. 125.9(c).)

Existing law provides that if a fine is paid to satisfy an assessment based on the finding of a violation, payment of the fine shall be represented as satisfactory resolution of the matter for purposes of public disclosure. (Bus. & Prof. Code Sec. 125.9(d).)

Existing law provides that administrative fines shall be deposited in the special fund of the particular board, bureau, or commission.

This bill would require a “health care provider,” as defined, who creates patient records to provide a statement to be signed by the patient, at the time the initial patient record is created, that sets forth both of the following:

• the patient’s rights under specified provisions of existing law to inspect his or her medical records, obtain copies of his or her medical records, and to provide a written addendum with respect to any item or statement in the patient’s records that the patient believes to be incomplete or incorrect; and
• the intended retention period for the records, as specified in applicable law or by the health care provider’s retention policy.

This bill would define “health care provider” as the following:

• a physician or surgeon;
• a podiatrist;
• a dentist;
• an optometrist; and
• a chiropractor.

This bill would require a copy of the signed statement to be provided to the patient, and would require the record indicate if a patient is provided a statement at the time that the initial record is created and the patient refused to sign the statement.

This bill would provide that if a health care provider, as defined, plans to destroy patient records, the health care provider shall notify the patient no fewer than 60 days before the patient’s records are to be destroyed, notify the patient, via first class mail, electronic mail, or both, to the patient’s last known mailing or electronic mail address, or both.

This bill would require that the notification of plans to destroy patient records inform the patient that their records are scheduled to be destroyed, the date of the proposed destruction, and their right to inspect their records.

This bill would require the health care provider, as defined, to provide a patient with his or her original medical records, which the provider plans to destroy, earlier than the period specified in the signed statement if the patient makes a request for the records to the health care provider before the date of the proposed destruction of the records. The patient, or their authorized representative, would be able to designate delivery by personal pickup, mail, overnight delivery, or other means.

This bill would specify that these changes do not reduce the length of record retention as otherwise required by law.

This bill would provide that a health care provider, as defined, may charge a patient for the actual costs incurred by the health care provider for copying, archiving, mailing or shipping the patient’s records under this section. This section does not authorize a provider to charge a patient for maintenance of any patient records that the health care provider is obligated by law to maintain.

This bill would provide that a health care provider, as defined, shall not be subject to this section for medical records that are created for a patient who is referred to the provider solely for diagnostic evaluation, if the provider does not provide treatment to the patient and reports the results of the diagnostic evaluation to the patient’s referred provider.

This bill would provide that a health care provider who violates this section may be cited and assessed an administrative penalty. Such a citation shall not be issued and a penalty shall not be assessed upon the first violation. Upon the second and subsequent violations, a citation may be issued and an administrative penalty may be assessed after appropriate notice and the opportunity for hearings.

This bill would specify that this bill does not affect other existing rights, duties, or remedies provided by existing law.

This bill would provide that the patient records created by a psychiatrist, including psychotherapy notes, are not subject to this section.

COMMENT

1. Stated need for this bill

According to the author:

A patient’s ability to create and maintain a personal health record is an essential tool in empowering an individual to take control of their health. Critical to the creation of a personal health record is access to medical records created by a health care provider. Unfortunately, there is no national standard on how long a health provider is required to maintain these records. While HIPPA provides strict guidelines how medical records are disposed of and accessed by patients, there is no final notice to a patient when their personal medical records will be destroyed. This bill ensures that a patient’s medical records after January 1, 2019, for which most are now created as an electronic health record (EHR), are not destroyed until the patient has been notified 60 days prior to their destruction by electronic mail and/or via first-class mail.

1. Standard requirements for retention of records

As noted when this bill was heard by the Senate Committee on Health, there is no general retention period for medical records in state or federal law. The Senate Committee on Health’s analysis specifically states:

There is no general law applicable to all health care providers requiring a provider to maintain medical records for a specific period of time, though professional organizations, regulators, and payors often have their own policies or requirements. For example:

a) Medi-Cal providers must keep records of Medi-Cal patients for ten years after the date that the last service was rendered under the Medi-Cal program;

b) Optometrists must retain a patient’s records for a minimum of seven years from the date he or she completes treatment of a patient; and,

c) The Department of Managed Health Care regulations require contracts between health plans and providers who regularly furnish services under the plan to require the provider to maintain records for at least two years. (see Senate Committee on Health, SB 1238 (Roth, 2018) Analysis, Apr. 4, 2018.)

Thus, it is possible under existing law that a patient could go to request copies of their medical records, as provided, only to find that those records no longer exist. This bill would ensure patients are given notice prior to the destruction of their medical records, so that patients could then choose whether they want to obtain copies of that information while still possible.

In support, the Western Center on Law and Poverty writes:

Many of the low-income people that Western Center serves have complicated medical histories. When medical records are not available, providers cannot make appropriate treatment decisions based on what has been tried in the past. Additionally, many public benefits programs rely on medical records for program eligibility determinations such as Supplemental Security Insurance, Medi-Cal programs based on disability, and certain veterans’ benefits. Other programs rely on medical records to determine whether a beneficiary should be required to work or should be exempt from certain requirements, such as CalWORKs and CalFresh (food stamps). As such, we sponsored SB 575 (Leyva, CHH. 626, Stats. of 2017) last year to ensure that people who relied on these records could access them for free when needed for various program determinations. However, the protections of SB 575 will not work if the underlying records themselves are destroyed without notice.

Finally, medical records are also used in a variety of legal proceedings and can help determine who has custody of a child, whether a company is liable for harm, or whether an employee has a claim against an employer. Consumers must be informed when their medical records are in jeopardy so they can preserve the documents that may dictate their rights in the future.

In opposition, the California Medical Association writes:

CMA recognizes the desire to ensure patients are aware of medical privacy and medical record laws, however, we also want to ensure that we do not create additional conflicting and confusing process on top of existing processes that already serve this purpose.

As the overall health care system changes, how records are stored and maintained changed. Many of those policies now lie at different points than the provider. For example, many health plans and health information exchanges now govern record maintenance and storage, depending on how the health system is integrated and the electronic health record system used. This bill as written does not acknowledge that fact, and raises many operation issues of how this would work for providers that may practice in a variety of hospitals and clinics that would also have to participate in such a process as well, if it was to be meaningful, given that the records themselves are maintained in the facility’s internal systems and may not necessarily follow the provider.

1. Privacy of medical records

Under existing law, HIPAA set the federal floor for the minimum privacy protections medical records must have. HIPAA also established a patient’s right to access and obtain a copy of a patient’s personal health information. With limited exceptions, the HIPAA Privacy Rule (the Privacy Rule) provides individuals with a legal, enforceable right to see and receive copies upon request of the information in their medical and other health records maintained by their health care providers and health plans. The Privacy Rule is found in Title 45 of the Code of Federal Regulations in Part 160 and Subparts A and E of Part 164.

Currently, HIPAA regulations require health care providers to provide an individual with “access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.” Furthermore, if the requested information is maintained electronically, and the individual requests an electronic copy, the covered entity “must provide the individual with access to the protected health information in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual.” SB 241 (Monning, Ch. 513, Stats. of 2017) inserted these provisions into California law, ensuring state laws on the privacy of and access to medical records were in-line with HIPAA.

Additionally, the Privacy Rule permits certain health plans and health care providers to impose a reasonable, cost-based fee when individuals request copies of their protected health information. However, such a fee may include only the cost of: (1) labor for copying the protected health information requested by the individual, whether in paper or electronic form; (2) supplies for creating the paper copy or electronic media (e.g., CD or USB drive) if the individual requests that the electronic copy be provided on portable media; (3) postage, when the individual requests that the copy, or the summary or explanation, be mailed; and (4) preparation of an explanation or summary of the protected health information, if agreed to by the individual. Federal regulations specifically prohibit the fee from including costs associated with verification; documentation; searching for and retrieving the health information; maintaining systems; recouping capital for data access, storage, or infrastructure; or other costs not listed. The United States Health and Human Services guidance indicates that additional costs, even if authorized by state law, shall not be included in any fee charged for health records.

This bill specifies that these provisions do not affect other existing rights, duties, or remedies provided by existing law. Thus, application of existing privacy provisions would ensure that this sensitive information continues to receive a high level of protection. Regardless, writing in opposition, the California Health Information Association (CHIA) states their concern regarding a potential increase in breaches of protected health information. Specifically, CHIA writes:

Sending a letter to the last known address of the patient would be problematic because the last known address on file may not be accurate, resulting in a high risk of breach of protected health information. In particular consideration of deceased patients, California’s transient population and minor patients, the likelihood that the provider is able to appropriately communicate with these patients is very low.

There is nothing in this bill that would provide for sensitive material to be mailed to a last known address. It provides only for notification to the patient that medical records are set to be destroyed. The individual who received this notification would still face the burden of obtaining these records (that were set to be destroyed) subject to existing restraints on the process for accessing one’s medical records. Arguably, the changes proposed by this bill therefore would not drastically increase the risk of breach.

Support: California Labor Federation; California School Employees Association; Western Center on Law and Poverty; One Individual

Opposition: California Health Information Association; California Medical Association

HISTORY

Source: Author

Related Pending Legislation: None Known

Prior Legislation:

SB 241 (Monning, Ch. 513, Stats. of 2017) revised and recast provisions of law governing the right of patients to access and copy their medical records by conforming these requirements to HIPAA requirements, including requiring health care providers to provide the records in an electronic format if they are maintained electronically and if the patient requests the records in an electronic format, more clearly specifying the reasonable clerical costs that can be charged by the providers, and by making other technical, clarifying and conforming changes.

SB 575 (Leyva, Ch. 626, Stats. 2017) expanded a provision of law that entitles a patient to a copy, at no charge, of the relevant portion of the patient’s records that are needed to support an appeal regarding eligibility for certain public benefit programs, by including initial applications in addition to appeals, and by expanding the list of public benefit programs to include In-Home Supportive Services, the California Work Opportunity and Responsibility to Kids program, CalFresh, and certain veterans related benefits.

AB 1337 (Linder, Ch. 528, Stats. 2015) amended the Evidence Code to create an authorization form for disclosure of health information by medical providers, and required electronic medical records requested prior to the filing of any action or appearance of a defendant in an action to be provided electronically if requested in an electronic format, and if it is readily producible in that format.

SB 1415 (Kuehl, 2008) was substantially similar to this bill. SB 1415 was vetoed by the Governor Schwarzenegger, who stated in his veto message that the historic delay in passing the 2008-09 State Budget had forced him to prioritize the bills sent to his desk, that he was only signing bills that were the highest priority for California, and that this bill did not meet the standard.

AB 986 (Eng, Ch. 276, Stats. 2007) among other things, required optometrists to retain a patient’s records for a minimum of seven years from the date treatment is completed, or in the case of minors, seven years from the completed treatment date and at least until the patient reaches 19 years of age.

AB 1311 (Goldberg, Ch. 325, Stats. 2001) required a health care provider, within 30 days of a written request from a patient, former patient, or patient’s representative, to provide a free copy of that portion of the patient’s medical records relevant to the patient’s appeal from the denial of eligibility for a public benefit program, as specified.

Prior Vote: Senate Health Committee (Ayes 8, Noes 0)

**************

SENATE COMMITTEE ON HEALTH

Senator Ed Hernandez, O.D., Chair

BILL NO: SB 1238

SUBJECT: Patient records: maintenance and storage

SUMMARY:

Requires physicians, podiatrists, dentists, optometrists, and chiropractors to provide a statement to a patient at the time an initial patient record is created that informs the patient of their right to inspect and copy their medical records, and of the intended retention period for the records. Requires the health care provider to notify the patient, at least 60 days prior to the planned destruction of medical records, using the patient’s last known mailing or electronic mail address.

Existing law:

1. Requires, under the Patient Access to Health Records (PAHR) law, any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment, and any patient representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available. [HSC §123100 et. seq.]
2. Defines “patient records,” for purposes of PAHR, as records in any form or medium maintained by, or in the custody or control of, a health care provider relating to the health history, diagnosis, or condition of a patient, or relating to treatment provided or proposed to be provided to the patient. [HSC §123105]
3. Defines “health care provider,” for purposes of PAHR, as a licensed health facility, clinic, or home health agency, or a licensed health care professional, as specified. [HSC §123105]
4. Requires any patient or patient’s representative to be entitled to copies of all or any portion of the patient records that he or she has a right to inspect, upon presenting a written request of the health care provider specifying the records to be copied, together with a fee to defray the cost of copying, that does not exceed $.25 per page of $.50 per page for records that are copied from microfilm and any additional reasonable clerical costs incurred in making the records available. [HSC §123110]
5. Establishes the Confidentiality of Medical Information Act (CMIA) in the Civil Code, which establishes protections for the use of medical information, which is defined as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. [CIV §56 et. seq.]
6. Requires, under the CMIA, upon the patient’s written request, that any entity the compiles or maintains medical information for any reason, to provide the patient, at no charge, with a copy of any medical profile, summary, or information maintained by the entity with respect to the patient. However, any patient records that are subject to inspection by the patient pursuant to PAHR are excluded from this requirement, and specifies that this requirement does not limit the right of a health care provider to charge a fee for the preparation of a summary of patient records as provided under PAHR. [CIV §56.07]

This bill:

1. Requires a “health care provider,” as defined, who create patient records, as defined, to provide a statement to be signed by the patient, at the time the initial patient record is created, that sets forth both of the following:
2. The patient’s rights under specified provisions of existing law to inspect his or her medical records, obtain copies of his or her medical records, and to provide a written addendum with respect to any item or statement in the patient’s records that the patient believes to be incomplete or incorrect; and,
3. The intended retention period for the records, as specified in applicable law or by the health care provider’s retention policy.
4. Defines a “health care provider,” for purposes of this bill, as a physician, podiatrist, dentist, optometrist, or chiropractor.
5. Requires a copy of the signed statement in 1) above to be provided to the patient. Requires the record to indicate if a patient is provided a statement at the time that the initial patient record is created, and the patient refuses to sign the statement.
6. Requires that if a health care provider plans to destroy patient records, to notify the patient no fewer than 60 days before the planned destruction via first-class mail, electronic mail, or both, to the patient’s last known mailing or electronic mail address, or both.
7. Requires the notification in 4) above to inform the patient that his or her records are scheduled to be destroyed and the date of the proposed destruction of records, and to also inform the patient of his or her rights under existing law to inspect his or her medical records.
8. Requires a health care provider to provide a patient with his or her original medical records that the provider plans to destroy earlier than the period specified in the signed statement if the patient makes a request for the records before the date of the proposed destruction of the records. Permits the patient to designate delivery of patient records either by personal pickup, mail, overnight delivery, or other delivery means.
9. Specifies that this bill does not reduce the length of record retention as otherwise required by law.
10. Permits a health care provider to charge a patient for the actual costs incurred by the health care provider for copying, archiving, mailing, or shipping the patient’s records under this section. Specifies that this bill does not authorize a health care provider to charge a patient for maintenance of any patient records that the health care provider is obligated by law to maintain.
11. Exempts health care providers from this bill for medical records that are created for a patient who is referred to the provider solely for a diagnostic evaluation, if the provider does not provide treatment to the patient and reports the results of the diagnostic evaluation to the patient’s referring provider.
12. Exempts patient records created by a psychiatrist, as defined, including psychotherapy notes, as defined, from the provisions of this bill.
13. Makes a violation of the provisions of this bill by a provider subject to an administrative penalty pursuant to specified provisions of existing law. Prohibits a citation from being issued for a first violation, and specifies that this administrative remedy constitutes the exclusive remedy for a violation of this bill.

FISCAL EFFECT:

This bill has not been analyzed by a fiscal committee.

COMMENTS:

1. Author’s statement. According to the author, a patient’s ability to create and maintain a personal health record is an essential tool in empowering an individual to take control of their health. Critical to the creation of a personal health record is access to medical records created by a health care provider. Unfortunately, there is no national standard on how long a health provider is required to maintain these records. While the federal Health Information Portability and Accountability Act of 1996 (HIPPA) provides strict guidelines for how medical records are disposed of and accessed by patients, there is no final notice to a patient when their personal medical records will be destroyed. This bill ensures that a patient’s medical records after January 1, 2019, for which most are now created as an electronic health record, are not destroyed until the patient has been notified 60 days prior to their destruction by electronic mail and/or via first-class mail.
2. Privacy and access to medical records. In general, patient protections of medical records fall under two main bodies of law: HIPAA, and the Confidentiality of Medical Information Act (CMIA) in California. HIPAA provides federal protections for patient’s health information held by “covered entities” and any “business associates” that a covered entity engages to help it carry out its health care activities. A covered entity can be a provider, a health plan, or a health care clearinghouse that processes health information it receives from another entity. While HIPAA establishes a federal floor for minimum privacy protections and the right of patients to access their health information, states are permitted to enact laws that provide greater privacy protections or rights. Separately, the two main bodies of state law govern patient access to medical records include PAHR in the Health and Safety Code, and provisions of law in the Evidence Code governing requests for medical information made by attorneys representing patients.
3. Notice requirement under HIPAA. Under HIPAA, providers (or “covered entities”) are required to provide a notice of their privacy practices, which describes the ways in which the covered entity uses and discloses protected health information (including medical records). While the notice must describe individual’s right to complain if they believe their privacy rights have been violated, there is no specific requirement that this notice describe the ability of patients to access their medical records. This privacy notice is required to be given to patients at their first service encounter, and the provider must make a good faith effort to obtain written acknowledgment of receipt of the privacy notice.
4. There is no general retention period for medical records in state or federal law. There is no general law applicable to all health care providers requiring a provider to maintain medical records for a specific period of time, though professional organizations, regulators, and payors often have their own policies or requirements. For example:
5. Medi-Cal providers must keep records of Medi-Cal patients for ten years after the date that the last service was rendered under the Medi-Cal program;
6. Optometrists must retain a patient’s records for a minimum of seven years from the date he or she completes treatment of a patient; and,
7. The Department of Managed Health Care regulations require contracts between health plans and providers who regularly furnish services under the plan to require the provider to maintain records for at least two years.
8. Double referral. This bill is double referred. Should it pass out of this committee, it will be referred to the Senate Judiciary Committee.
9. Prior legislation. SB 241 (Monning, Chapter 513, Statutes of 2017) revises and recasts provisions of law governing the right of patients to access and copy their medical records by conforming these requirements to HIPAA requirements, including requiring health care providers to provide the records in an electronic format if they are maintained electronically and if the patient requests the records in an electronic format, more clearly specifying the reasonable clerical costs that can be charged by the providers, and by making other technical, clarifying and conforming changes.

SB 575 (Leyva, Chapter 626, Statutes of 2017) expands a provision of law that entitles a patient to a copy, at no charge, of the relevant portion of the patient’s records that are needed to support an appeal regarding eligibility for certain public benefit programs, by including initial applications in addition to appeals, and by expanding the list of public benefit programs to include In-Home Supportive Services, the California Work Opportunity and Responsibility to Kids program, CalFresh, and certain veterans related benefits.

AB 1337 (Linder, Chapter 528, Statutes of 2015) amended the Evidence Code to create an authorization form for disclosure of health information by medical providers, and required electronic medical records requested prior to the filing of any action or appearance of a defendant in an action to be provided electronically if requested in an electronic format, and if it is readily producible in that format.

AB 1415 (Kuehl of 2008) was substantially similar to this bill. AB 1415 was vetoed by the Governor, who stated in his veto message that the historic delay in passing the 2008-09 State Budget had forced him to prioritize the bills sent to his desk, that he was only signing bills that were the highest priority for California, and that this bill did not meet the standard.

AB 986 (Eng, Chapter 276, Statutes of 2007) among other things, required optometrists to retain a patient’s records for a minimum of seven years from the date treatment is completed, or in the case of minors, seven years from the completed treatment date and at least until the patient reaches 19 years of age

AB 1311 (Goldberg, Chapter 325, Statutes of 2001) required a health care provider, within 30 days of a written request from a patient, former patient, or patient's representative, to provide a free copy of that portion of the patient's medical records relevant to the patient's appeal from the denial of eligibility for a public benefit program, as specified.

1. Support. Consumers Union states in support that in this dynamic health care environment, consumers may find themselves subject to more changes in coverage, networks and specific providers than ever. Consumers Union states that it is more important to assure that patients have ready access to their medical records and do not find they have been destroyed without their knowledge. The Congress of California Seniors (CCS) states in support that under current law, medical providers may destroy a patient’ medical records at will. Without medical records, CCS states that a patient may not be able to give future providers the precise information needed for future treatment, and duplicative tests and records may become necessary. CCS argues that older patients without up-to-date records may be denied continuation of long-term treatments until their need is re-established. CCS note that current law establishes the right of patients to access their medical records, but that right means nothing if the records have been destroyed. The California School Employees Association (CSEA) states in support that many patients are unaware that their health care providers can destroy their records without providing them with any notice, and that once medical information is destroyed, it may be impossible to retrieve these records. For example, CSEA states that cancer patients often receive radiation therapy. If the cancer returns or affects a different part of the body, a radiation oncologist must know how much radiation was given to know what can be safely administered to the patient the next time. California Advocates for Nursing Home Reform states in support that California gives patients ample rights related to their records but those rights lose considerable value when they are unknown.
2. Oppose unless amended. The California Medical Association (CMA) is opposed to this bill unless amended. CMA states that in addition to creating various notices upon a patient’s first visits, would also create an ongoing rolling requirement on their providers to constantly send out notifications to each patient they have ever seen prior to destroying medical records. In addition, CMA states that we are entering into a new era of record storage that largely negates the need for the notices required by this bill. For example, CMA states that many health plans and health information exchanges now govern record maintenance and storage, depending on how the health system is integrated and the electronic health record system used. CMA states that this bill raises many operational issues of how this would work for providers that may practice in a variety of hospitals and clinics that would also have to participate in such a process as well, given that the records themselves are maintained in the facility’s internal systems and may not necessarily follow the provider. CMA notes that many health plans stipulate different record storage requirements for providers, as do laws around workers’ compensation and Medi-Cal patients. In addition, CMA states that the federal Centers for Medicare and Medicaid Services earlier this month announced their MyHealthEData Initiative, which would move toward a system and health care information model of storage that would allow patients to control their own data and have access to their full health care records directly at all times. CMA states that it is important that we do not create new unnecessary burdens on providers, given the quick evolution of such laws and practices on medical record retention. CMA states that it is request that the bill be amended to ensure consistency with current privacy laws, and that rather than creating a new unreasonable and conflicting process, that the bill work within the constructs of the current notice of privacy practices that providers already give to their patients related to their rights regarding their medical records.
3. Policy comments.
   1. Should this bill apply to providers who keep records indefinitely? As more and more providers and health plans transition to electronic health records which are stored indefinitely on computer servers, an obligation to inform patient of their document retention policy may not be necessary. Should providers who utilize electronic health records and store those records permanently be exempted from this bill?
   2. Should providers be permitted to incorporate this new notice into the existing HIPAA privacy notice? As noted under prior legislation, this bill is a reintroduction of AB 1415 (Kuehl) of 2008, which was vetoed. One of the few differences between AB 1415 and this bill is that AB 1415 included a provision that permitted the required notification to be “included in another form or statement provided to the patient, or the patient’s representative, at the time the initial patient record is created.” The author may wish to consider whether this provision should be included in this bill, so that providers could simply revise their required HIPAA notice with this bill’s notice of the record retention policy, since the HIPAA privacy notice is already required to be signed by the patient.
   3. Ability of providers to charge for actual costs should conform to existing cost provisions in PAHR. This bill permits a provider to charge a patient for the “actual costs incurred by the healthcare provider for copying, archiving, mailing, or shipping the patient’s records.” However, existing law under PAHR includes specific limitations on the costs that health providers may charge for providing copies of medical records. The author may wish to simply reference the provisions of PAHR with regard to the ability of a provider to recoup costs.

SUPPORT AND OPPOSITION:

Support: California Advocates for Nursing Home Reform

California School Employees Association

Consumers Union

Congress of California Seniors

Oppose: California Medical Association (unless amended)

-- END --