AB 352: Health information.
- Session Year: 2023-2024
- House: Assembly
- Latest Version Date: 2023-09-27
Current Status:
Passed
(2023-09-27: Chaptered by Secretary of State - Chapter 255, Statutes of 2023.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
What does this bill do?
This bill stops California health providers, plans, contractors, employers, and electronic health record vendors from sharing electronic records that would identify people seeking or obtaining abortions that are legal in California with individuals or agencies from other states. It also requires businesses that store such records to add tools to separate and lock parts of a patient’s record and block out‑of‑state access, and it allows sharing only with a patient’s written permission, sealed court order, when federal law requires it, or for limited uses like payment, accreditation, or approved research.
The summary is provided by generative AI which can make mistakes. For original language, please view the details in the table below.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing law prohibits the state from denying or interfering with a persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the person.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA requires every provider of health care, health care service plan, pharmaceutical company, or contractor who, among other things, maintains or stores medical information to do so in a manner that preserves the confidentiality of the information contained therein. The CMIA also prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services, and contraception, as specified. The bill would additionally prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. The bill would exempt a provider of health care from liability for damages or from civil or enforcement actions relating to cooperating with, or providing medical information to, another state or a federal law enforcement agency before January 31, 2026, if the provider of health care is working diligently and in good faith to comply with the prohibition. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
Existing law requires the California Health and Human Services Agency, in consultation with stakeholders and local partners, to establish the California Health and Human Services Data Exchange Framework that includes a single data sharing agreement and common set of policies and procedures that govern and require the exchange of health information among health care entities and government agencies in California. Existing law requires, on or before January 31, 2024, that specified entities, including general acute care hospitals and skilled nursing facilities, exchange health information, as defined, in real time.
This bill would exclude the exchange of health information related to abortion and abortion-related services from automatically being shared on the California Health and Human Services Data Exchange Framework.
This bill would incorporate additional changes to Section 130290 of the Health and Safety Code proposed by SB 582 to be operative only if this bill and SB 582 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing law prohibits the state from denying or interfering with a persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the person.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA requires every provider of health care, health care service plan, pharmaceutical company, or contractor who, among other things, maintains or stores medical information to do so in a manner that preserves the confidentiality of the information contained therein. The CMIA also prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services, and contraception, as specified. The bill would additionally prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. The bill would exempt a provider of health care from liability for damages or from civil or enforcement actions relating to cooperating with, or providing medical information to, another state or a federal law enforcement agency before January 31, 2026, if the provider of health care is working diligently and in good faith to comply with the prohibition. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
Existing law requires the California Health and Human Services Agency, in consultation with stakeholders and local partners, to establish the California Health and Human Services Data Exchange Framework that includes a single data sharing agreement and common set of policies and procedures that govern and require the exchange of health information among health care entities and government agencies in California. Existing law requires, on or before January 31, 2024, that specified entities, including general acute care hospitals and skilled nursing facilities, exchange health information, as defined, in real time.
This bill would exclude the exchange of health information related to abortion and abortion-related services from automatically being shared on the California Health and Human Services Data Exchange Framework.
This bill would incorporate additional changes to Section 130290 of the Health and Safety Code proposed by SB 582 to be operative only if this bill and SB 582 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing law prohibits the state from denying or interfering with a persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the person.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA requires every provider of health care, health care service plan, pharmaceutical company, or contractor who, among other things, maintains or stores medical information to do so in a manner that preserves the confidentiality of the information contained therein. The CMIA also prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, gender affirming care, abortion and abortion-related services, and contraception, as specified. The bill would additionally prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. The bill would exempt a provider of health care from liability for damages or from civil or enforcement actions relating to cooperating with, or providing medical information to, another state or a federal law enforcement agency before January 31, 2026, if the provider of health care is working diligently and in good faith to comply with the prohibition. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
Existing law requires the California Health and Human Services Agency, in consultation with stakeholders and local partners, to establish the California Health and Human Services Data Exchange Framework that includes a single data sharing agreement and common set of policies and procedures that govern and require the exchange of health information among health care entities and government agencies in California. Existing law requires, on or before January 31, 2024, that specified entities, including general acute care hospitals and skilled nursing facilities, exchange health information, as defined, in real time.
This bill would exclude the exchange of health information related to abortion and abortion-related services from automatically being shared on the California Health and Human Services Data Exchange Framework.
This bill would incorporate additional changes to Section 130290 of the Health and Safety Code proposed by SB 582 to be operative only if this bill and SB 582 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing law prohibits the state from denying or interfering with a persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the person.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA requires every provider of health care, health care service plan, pharmaceutical company, or contractor who, among other things, maintains or stores medical information to do so in a manner that preserves the confidentiality of the information contained therein. The CMIA also prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. The bill would additionally prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
Existing law requires, subject to an appropriation, the California Health and Human Services Agency to establish the California Health and Human Services Data Exchange Framework, and requires the framework to include a single data-sharing agreement and common set of policies and procedures that will govern and require the exchange of health information among health care entities and government agencies in the state. Existing law requires, on or before January 31, 2024, specified entities, with exceptions, to exchange health information or provide access to health information to and from every other entity in real time pursuant to the frameworks data-sharing agreement for treatment, payment, or health care operations. Existing law requires the agency to convene a stakeholder advisory group to advise on the development and implementation of the framework, and requires the advisory group to provide certain information and advice to the agency on health information technology issues.This bill would require the advisory group, as part of the above-described information, to identify policies and procedures to ensure appropriate safeguards to prevent electronic health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state. The bill would exempt health information related to sensitive services from that real time health information sharing requirement, to the extent not in conflict with federal law, until the previously described policies and procedures are implemented. The bill would define sensitive services for these purposes to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing law prohibits the state from denying or interfering with a persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the person.
Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA requires every provider of health care, health care service plan, pharmaceutical company, or contractor who, among other things, maintains or stores medical information to do so in a manner that preserves the confidentiality of the information contained therein. The CMIA also prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action. Existing law makes a violation of the CMIA that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. The bill would additionally prohibit a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. Because the bill would expand the scope of an existing crime, it would impose a state-mandated local program.
Existing law requires, subject to an appropriation, the California Health and Human Services Agency to establish the California Health and Human Services Data Exchange Framework, and requires the framework to include a single data-sharing agreement and common set of policies and procedures that will govern and require the exchange of health information among health care entities and government agencies in the state. Existing law requires, on or before January 31, 2024, specified entities, with exceptions, to exchange health information or provide access to health information to and from every other entity in real time pursuant to the frameworks data-sharing agreement for treatment, payment, or health care operations. Existing law requires the agency to convene a stakeholder advisory group to advise on the development and implementation of the framework, and requires the advisory group to provide certain information and advice to the agency on health information technology issues.
This bill would require the advisory group, as part of the above-described information, to identify policies and procedures to ensure appropriate safeguards to prevent electronic health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state. The bill would exempt health information related to sensitive services from that real time health information sharing requirement, to the extent not in conflict with federal law, until the previously described policies and procedures are implemented. The bill would define sensitive services for these purposes to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes provisions relating to the confidentiality of health records.This bill would state the intent of the Legislature to enact legislation to protect reproductive and sexual health information.Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes provisions relating to the confidentiality of health records.
This bill would state the intent of the Legislature to enact legislation to protect reproductive and sexual health information.
(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.
(b)(1)An electronic health record system or electronic medical record system shall do all of the following:
(A)Protect and preserve the integrity of electronic medical information.
(B)Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2)A patients right to access or receive a copy of the patients electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c)(1)A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
(A)Limit user access privileges to information systems that contain medical information related to gender affirming care, abortion and abortion-related services, and contraception only to those persons who are authorized to access specified medical information.
(B)Prevent the disclosure, access, transfer, transmission, or processing of medical information related to gender affirming care, abortion and abortion-related services, and contraception to persons and entities outside of this state in accordance to this part.
(C)Segregate medical information related to gender affirming care, abortion and abortion-related services, and contraception from the rest of the patients record.
(D)Provide the ability to automatically disable access to segregated medical information related to gender affirming care, abortion and abortion-related services, and contraception by individuals and entities in another state.
(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3)For the purposes of this subdivision, gender affirming care means gender affirming health care and gender affirming mental health care as defined in subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.
(4)This subdivision does not apply to a provider of health care, as defined in Section 56.05.
(d)This section shall apply to an electronic medical record or electronic health record that meets the definition of electronic health record, as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.Section 56.108 of the Civil Code is amended to read:56.108.(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another states laws that interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(b)A provider of health care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):
(1)Enforcement of another states law that would interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.
(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
SEC. 3.Section 56.110 is added to the Civil Code, to read:56.110.(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
(1)In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.
(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patients privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:
(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).
(2)In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patients identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.
(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
(d)A provider of health care, as defined in Section 56.05, shall not be subject to liability for damages or to civil or enforcement actions, including disciplinary actions, fines, or penalties, for failure to meet the requirements of this section before January 31, 2026, if the provider of health care is working diligently and in good faith to come into compliance with this section.
SEC. 4.Section 130290 of the Health and Safety Code is amended to read:130290.(a)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(1)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(2)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(1)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(2)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(3)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(4)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(5)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(1)General acute care hospitals, as defined by Section 1250.
(2)Physician organizations and medical groups.
(3)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(4)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)Acute psychiatric hospitals, as defined by Section 1250.
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 4.5.Section 130290 of the Health and Safety Code is amended to read:130290.(a)(1)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(2)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(3)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(4)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), the information blocking provisions of the federal 21st Century Cures Act (Public Law 114-255), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(5)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(6)For purposes of this section, EHR vendor means a company, other than a health care provider that self-develops health information technology for its own use, that sells electronic health records, as defined in Section 17921 of Title 42 of the United States Code.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)(1)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(2)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(3)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(4)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)(i)Identify which data beyond health information as defined in paragraph (5) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(ii)In discussing data elements that are required to be exchanged, the stakeholder advisory group shall consider data needed for administrative functions of a medical practice, including intake forms and questionnaires, patient scheduling, insurance card upload and verification, invoicing and payment data, and patient-to-provider messaging.
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(L)Consider whether standards for including EHR vendors in the California Health and Human Services Data Exchange Framework would be appropriate, and, if determined to be appropriate, develop those standards.
(5)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(6)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (4) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)(1)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(A)General acute care hospitals, as defined by Section 1250.
(B)Physician organizations and medical groups.
(C)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(D)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(E)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(F)Acute psychiatric hospitals, as defined by Section 1250.
(2)If the stakeholder advisory group develops standards for including EHR vendors in the California Health and Human Services Data Exchange Framework, EHR vendors shall execute the California Health and Human Services Data Exchange Framework data sharing agreement no later than 12 months after the completion of the standards, and in alignment with existing federal standards and policies pursuant to subdivision (a).
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)(1)Any fees charged by an EHR vendor to enable compliance with the California Health and Human Services Data Exchange Framework shall be reasonable, consistent with Sections 171.302(a) and 171.303 of Title 45 of the Code of Federal Regulations.
(2)Reasonable fees shall be sufficient to include the cost of enabling the collection and sharing of all data required to be exchanged under this section, as specified in the California Health and Human Services Data Sharing Agreement.
(k)As part of any other oversight activities authorized and developed with respect to this section, the California Health and Human Services Agency, in consultation with the stakeholder advisory group or subsequent governing board, may establish administrative oversight and enforcement authority to monitor fees charged by EHR vendors to entities described in paragraph (2) of subdivision (b) for compliance with the federal standards required under subdivision (j). The oversight and enforcement authority may include the imposition of fines and penalties against an EHR vendor that is found not in compliance with the federal standards required under subdivision (j).
(l)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 5.Section 4.5 of this bill incorporates amendments to Section 130290 of the Health and Safety Code proposed by both this bill and Senate Bill 582. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 130290 of the Health and Safety Code, and (3) this bill is enacted after Senate Bill 582, in which case Section 4 of this bill shall not become operative.
SEC. 6.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.
(b)(1)An electronic health record system or electronic medical record system shall do all of the following:
(A)Protect and preserve the integrity of electronic medical information.
(B)Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2)A patients right to access or receive a copy of the patients electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c)(1)A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
(A)Limit user access privileges to information systems that contain medical information related to gender affirming care, abortion and abortion-related services, and contraception only to those persons who are authorized to access specified medical information.
(B)Prevent the disclosure, access, transfer, transmission, or processing of medical information related to gender affirming care, abortion and abortion-related services, and contraception to persons and entities outside of this state in accordance to this part.
(C)Segregate medical information related to gender affirming care, abortion and abortion-related services, and contraception from the rest of the patients record.
(D)Provide the ability to automatically disable access to segregated medical information related to gender affirming care, abortion and abortion-related services, and contraception by individuals and entities in another state.
(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3)For the purposes of this subdivision, gender affirming care means gender affirming health care and gender affirming mental health care as defined in subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.
(4)This subdivision does not apply to a provider of health care, as defined in Section 56.05.
(d)This section shall apply to an electronic medical record or electronic health record that meets the definition of electronic health record, as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.Section 56.108 of the Civil Code is amended to read:56.108.(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another states laws that interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(b)A provider of health care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):
(1)Enforcement of another states law that would interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.
(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
SEC. 3.Section 56.110 is added to the Civil Code, to read:56.110.(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
(1)In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.
(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patients privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:
(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).
(2)In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patients identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.
(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
(d)A provider of health care, as defined in Section 56.05, shall not be subject to liability for damages or to civil or enforcement actions, including disciplinary actions, fines, or penalties, for failure to meet the requirements of this section before January 31, 2026, if the provider of health care is working diligently and in good faith to come into compliance with this section.
SEC. 4.Section 130290 of the Health and Safety Code is amended to read:130290.(a)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(1)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(2)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(1)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(2)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(3)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(4)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(5)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(1)General acute care hospitals, as defined by Section 1250.
(2)Physician organizations and medical groups.
(3)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(4)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)Acute psychiatric hospitals, as defined by Section 1250.
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 4.5.Section 130290 of the Health and Safety Code is amended to read:130290.(a)(1)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(2)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(3)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(4)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), the information blocking provisions of the federal 21st Century Cures Act (Public Law 114-255), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(5)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(6)For purposes of this section, EHR vendor means a company, other than a health care provider that self-develops health information technology for its own use, that sells electronic health records, as defined in Section 17921 of Title 42 of the United States Code.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)(1)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(2)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(3)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(4)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)(i)Identify which data beyond health information as defined in paragraph (5) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(ii)In discussing data elements that are required to be exchanged, the stakeholder advisory group shall consider data needed for administrative functions of a medical practice, including intake forms and questionnaires, patient scheduling, insurance card upload and verification, invoicing and payment data, and patient-to-provider messaging.
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(L)Consider whether standards for including EHR vendors in the California Health and Human Services Data Exchange Framework would be appropriate, and, if determined to be appropriate, develop those standards.
(5)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(6)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (4) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)(1)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(A)General acute care hospitals, as defined by Section 1250.
(B)Physician organizations and medical groups.
(C)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(D)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(E)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(F)Acute psychiatric hospitals, as defined by Section 1250.
(2)If the stakeholder advisory group develops standards for including EHR vendors in the California Health and Human Services Data Exchange Framework, EHR vendors shall execute the California Health and Human Services Data Exchange Framework data sharing agreement no later than 12 months after the completion of the standards, and in alignment with existing federal standards and policies pursuant to subdivision (a).
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)(1)Any fees charged by an EHR vendor to enable compliance with the California Health and Human Services Data Exchange Framework shall be reasonable, consistent with Sections 171.302(a) and 171.303 of Title 45 of the Code of Federal Regulations.
(2)Reasonable fees shall be sufficient to include the cost of enabling the collection and sharing of all data required to be exchanged under this section, as specified in the California Health and Human Services Data Sharing Agreement.
(k)As part of any other oversight activities authorized and developed with respect to this section, the California Health and Human Services Agency, in consultation with the stakeholder advisory group or subsequent governing board, may establish administrative oversight and enforcement authority to monitor fees charged by EHR vendors to entities described in paragraph (2) of subdivision (b) for compliance with the federal standards required under subdivision (j). The oversight and enforcement authority may include the imposition of fines and penalties against an EHR vendor that is found not in compliance with the federal standards required under subdivision (j).
(l)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 5.Section 4.5 of this bill incorporates amendments to Section 130290 of the Health and Safety Code proposed by both this bill and Senate Bill 582. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 130290 of the Health and Safety Code, and (3) this bill is enacted after Senate Bill 582, in which case Section 4 of this bill shall not become operative.
SEC. 6.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.
(b)(1)An electronic health record system or electronic medical record system shall do all of the following:
(A)Protect and preserve the integrity of electronic medical information.
(B)Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2)A patients right to access or receive a copy of the patients electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c)(1)A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
(A)Limit user access privileges to information systems that contain medical information related to sensitive services gender affirming care, abortion and abortion-related services, and contraception only to those persons who are authorized to access specified medical information.
(B)Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services gender affirming care, abortion and abortion-related services, and contraception to persons and entities outside of this state in accordance to this part.
(C)Segregate medical information related to sensitive services gender affirming care, abortion and abortion-related services, and contraception from the rest of the patients record.
(D)Provide the ability to automatically disable access to segregated medical information related to sensitive services gender affirming care, abortion and abortion-related services, and contraception by individuals and entities in another state.
(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3)An existing electronic health records system that is substantially customized to fit the individual needs of a provider of health care or health care service plan shall be exempt from the requirement specified in paragraph (1). However, if the substantially customized electronic health records system is modified, other than for basic maintenance, the system shall no longer be exempt, and shall meet the requirement specified in paragraph (1).(4)For purposes of this subdivision, substantially customized means significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a clients specifications.(3)For the purposes of this subdivision, gender affirming care means gender affirming health care and gender affirming mental health care as defined in subdivision (b) of Section 16010.2 of the Welfare and Institutions Code.
(4)This subdivision does not apply to a provider of health care, as defined in Section 56.05.
(d)This section shall apply to an electronic medical record or electronic health record that meets the definition of electronic health record, as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.Section 56.108 of the Civil Code is amended to read:56.108.(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another states laws that interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(b)A provider of health care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):
(1)Enforcement of another states law that would interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.
(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
SEC. 3.Section 56.110 is added to the Civil Code, to read:56.110.(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
(1)In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.
(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patients privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:
(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).
(2)In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patients identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.
(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
(d)A provider of health care, as defined in Section 56.05, shall not be subject to liability for damages or to civil or enforcement actions, including disciplinary actions, fines, or penalties, for failure to meet the requirements of this section before January 31, 2026, if the provider of health care is working diligently and in good faith to come into compliance with this section.
SEC. 4.Section 130290 of the Health and Safety Code is amended to read:130290.(a)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(1)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(2)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act of 1996 (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f), except those identified in paragraph (2), (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(1)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(2)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(3)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(4)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(5)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(1)General acute care hospitals, as defined by Section 1250.
(2)Physician organizations and medical groups.
(3)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(4)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)Acute psychiatric hospitals, as defined by Section 1250.
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 4.5.Section 130290 of the Health and Safety Code is amended to read:130290.(a)(1)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(1)(2)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals they serve.
(2)(3)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)(4)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act of 1996 (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), the information blocking provisions of the federal 21st Century Cures Act (Public Law 114-255), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)(5)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(6)For purposes of this section, EHR vendor means a company, other than a health care provider that self-develops health information technology for its own use, that sells electronic health records, as defined in Section 17921 of Title 42 of the United States Code.
(b)(1)On or before January 31, 2024, and except as provided in paragraphs (2) and (3), the entities listed in subdivision (f), except those identified in paragraph (2), (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion and abortion-related services.
(c)(1)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(1)(2)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on.
(2)(3)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(3)(4)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)(i)Identify which data beyond health information as defined in paragraph (4) (5) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(ii)In discussing data elements that are required to be exchanged, the stakeholder advisory group shall consider data needed for administrative functions of a medical practice, including intake forms and questionnaires, patient scheduling, insurance card upload and verification, invoicing and payment data, and patient-to-provider messaging.
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(L)Consider whether standards for including EHR vendors in the California Health and Human Services Data Exchange Framework would be appropriate, and, if determined to be appropriate, develop those standards.
(4)(5)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(5)(6)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) (4) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)(1)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a):
(1)(A)General acute care hospitals, as defined by Section 1250.
(2)(B)Physician organizations and medical groups.
(3)(C)Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records.
(4)(D)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)(E)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)(F)Acute psychiatric hospitals, as defined by Section 1250.
(2)If the stakeholder advisory group develops standards for including EHR vendors in the California Health and Human Services Data Exchange Framework, EHR vendors shall execute the California Health and Human Services Data Exchange Framework data sharing agreement no later than 12 months after the completion of the standards, and in alignment with existing federal standards and policies pursuant to subdivision (a).
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)(1)Any fees charged by an EHR vendor to enable compliance with the California Health and Human Services Data Exchange Framework shall be reasonable, consistent with Sections 171.302(a) and 171.303 of Title 45 of the Code of Federal Regulations.
(2)Reasonable fees shall be sufficient to include the cost of enabling the collection and sharing of all data required to be exchanged under this section, as specified in the California Health and Human Services Data Sharing Agreement.
(k)As part of any other oversight activities authorized and developed with respect to this section, the California Health and Human Services Agency, in consultation with the stakeholder advisory group or subsequent governing board, may establish administrative oversight and enforcement authority to monitor fees charged by EHR vendors to entities described in paragraph (2) of subdivision (b) for compliance with the federal standards required under subdivision (j). The oversight and enforcement authority may include the imposition of fines and penalties against an EHR vendor that is found not in compliance with the federal standards required under subdivision (j).
(j)(l)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 5.Section 4.5 of this bill incorporates amendments to Section 130290 of the Health and Safety Code proposed by both this bill and Senate Bill 582. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2024, (2) each bill amends Section 130290 of the Health and Safety Code, and (3) this bill is enacted after Senate Bill 582, in which case Section 4 of this bill shall not become operative.
SEC. 4.SEC. 6.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.
(b)(1)An electronic health record system or electronic medical record system shall do all of the following:
(A)Protect and preserve the integrity of electronic medical information.
(B)Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2)A patients right to access or receive a copy of the patients electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c)(1)A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
(A)Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information.
(B)Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state in accordance to this part.
(C)Segregate medical information related to sensitive services from the rest of the patients record.
(D)Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3)An existing electronic health records system that is substantially customized to fit the individual needs of a provider of health care or health care service plan shall be exempt from the requirement specified in paragraph (1). However, if the substantially customized electronic health records system is modified, other than for basic maintenance, the system shall no longer be exempt, and shall meet the requirement specified in paragraph (1).
(4)For purposes of this subdivision, substantially customized means significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a clients specifications.
(d)This section shall apply to an electronic medical record or electronic health record that meets the definition of electronic health record, as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.Section 56.108 of the Civil Code is amended to read:56.108.(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another states laws that interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(b)A provider of health care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):
(1)Enforcement of another states law that would interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.
(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
SEC. 3.Section 56.110 is added to the Civil Code, to read:56.110.(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
(1)In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.
(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patients privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:
(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).
(2)In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patients identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.
(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
SEC. 4.Section 130290 of the Health and Safety Code is amended to read:130290.(a)(1)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data-sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.(2)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals whom they serve.(3)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.(4)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.(5)For the purposes of this section, health information means:(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.(b)(1) On or before January 31, 2024, the entities listed in subdivision (f), except those identified in paragraphs (2) and (3), shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data-sharing agreement for treatment, payment, or health care operations.(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to sensitive services, as defined in Section 56.05 of the Civil Code, to the extent not in conflict with federal law, until policies and procedures are implemented in the state to ensure appropriate safeguards for health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.(c)(1)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.(2)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues on which the stakeholder advisory group will advise.(3)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all of the following:(A)The State Department of Health Care Services.(B)The State Department of Social Services.(C)The Department of Managed Health Care.(D)The Department of Health Care Access and Information.(E)The State Department of Public Health.(F)The Department of Insurance.(G)The Public Employees Retirement System.(H)The California Health Benefit Exchange.(I)Health care service plans and health insurers.(J)Physicians, including those with small practices.(K)Hospitals, including public, private, rural, and critical access hospitals.(L)Clinics, long-term care facilities, behavioral health facilities, substance use disorder facilities, or providers of sensitive services, as defined in Section 56.05 of the Civil Code.(M)Consumers.(N)Organized labor.(O)Privacy and security professionals.(P)Health information technology professionals.(Q)Community health information organizations.(R)County health, social services, and public health.(S)Community-based organizations providing social services.(4)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:(A)Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.(ii)Translation, mapping, controlled vocabularies, coding, and data classification.(iii)Storage, maintenance, and management of health information.(iv)Linking, sharing, exchanging, and providing access to health information.(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.(J)Assess governance structures to help guide policy decisions and general oversight.(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.(L)Identify policies and procedures to ensure appropriate safeguards to prevent electronic health information related to the provision of sensitive services, as defined in Section 56.05 of the Civil Code, from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state. (5)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).(6)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (4) of subdivision (c).(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.(f)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data-sharing agreement pursuant to subdivision (a):(1)General acute care hospitals, as defined in Section 1250.(2)Physician organizations and medical groups.(3)Skilled nursing facilities, as defined in Section 1250, that currently maintain electronic records.(4)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.(5)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.(6)Acute psychiatric hospitals, as defined in Section 1250.(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop, in consultation with the stakeholder advisory group in subdivision (c), a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.(j)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data-sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.SEC. 5.SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)Every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties provided under subdivisions (b) and (c) of Section 56.36.
(b)(1)An electronic health record system or electronic medical record system shall do the following:
(A)Protect and preserve the integrity of electronic medical information.
(B)Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion shall include the identity of the person who accessed and changed the medical information, the date and time the medical information was accessed, and the change that was made to the medical information.
(2)A patients right to access or receive a copy of his or her the patients electronic medical records upon request shall be consistent with applicable state and federal laws governing patient access to, and the use and disclosures of, medical information.
(c)(1)A business, as described in Section 56.06, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer, shall develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
(A)Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information.
(B)Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state in accordance to this part.
(C)Segregate medical information related to sensitive services from the rest of the patients record.
(D)Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
(2)Any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with this subdivision shall be consistent with Section 171.302 of Title 45 of the Code of Federal Regulations.
(3)An existing electronic health records system that is substantially customized to fit the individual needs of a provider of health care or health care service plan shall be exempt from the requirement specified in paragraph (1). However, if the substantially customized electronic health records system is modified, other than for basic maintenance, the system shall no longer be exempt, and shall meet the requirement specified in paragraph (1).
(4)For purposes of this subdivision, substantially customized means significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a clients specifications.
(c)(d)This section shall apply to an electronic medical record or electronic health record that meets the definition of electronic health record, as that term is defined in Section 17921(5) of Title 42 of the United States Code.
SEC. 2.Section 56.108 of the Civil Code is amended to read:56.108.(a)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not release medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another states laws that interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) or a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(b)A provider of health care, health care service plan, contractor, or employer shall not release medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by subdivision (a):
(1)Enforcement of another states law that would interfere with a persons rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
(2)Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
(c)Notwithstanding subdivisions (b) and (c) of Section 56.10 or subdivision (c) of Section 56.20, a provider of health care, health care service plan, contractor, or employer shall not cooperate with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110.
(d)This section does not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
SEC. 3.Section 56.110 is added to the Civil Code, to read:56.110.(a)Notwithstanding subdivision (c) of Section 56.10, a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
(1)In accordance with a valid, written authorization pursuant to Section 56.11 that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
(2)In accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate this part.
(3)In accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 for the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
(4)In accordance with paragraph (7) of subdivision (c) of Section 56.10, for the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patients privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
(b)Notwithstanding subdivision (a), the content of the health records containing medical information described in subdivision (a) shall be disclosed to any of the following:
(1)A patient, or their personal representative, consistent with the Patient Access to Health Records Act (Chapter 1 (commencing with Section 123100) of Part 1 of Division 106 of the Health and Safety Code).
(2)In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patients identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
(3)When expressly required by federal law that preempts California law, but only to the extent expressly required.
(c)Nothing in this section shall prohibit a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
SEC. 4.Section 130290 of the Health and Safety Code is amended to read:130290.(a)(1)On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing data-sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California.
(1)(2)The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using national standards and a common set of policies in order to improve the health outcomes of the individuals whom they serve.
(2)(3)The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among health care providers and payers through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)(4)The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act of 1996 (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)(5)For the purposes of this section, health information means:
(A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity.
(B)For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.
(b)(1) On or before January 31, 2024, the entities listed in subdivision (f), except those identified in paragraph (2), paragraphs (2) and (3), shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency pursuant to the California Health and Human Services Data Exchange Framework data sharing data-sharing agreement for treatment, payment, or health care operations.
(2)The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)The requirement in paragraph (1) shall not apply to the exchange of health information related to sensitive services, as defined in Section 56.05 of the Civil Code, to the extent not in conflict with federal law, until policies and procedures are implemented in the state to ensure appropriate safeguards for health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
(c)(1)The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework.
(1)(2)The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues on which the stakeholder advisory group will advise on. advise.
(2)(3)The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all of the following:
(A)The State Department of Health Care Services.
(B)The State Department of Social Services.
(C)The Department of Managed Health Care.
(D)The Department of Health Care Access and Information.
(E)The State Department of Public Health.
(F)The Department of Insurance.
(G)The Public Employees Retirement System.
(H)The California Health Benefit Exchange.
(I)Health care service plans and health insurers.
(J)Physicians, including those with small practices.
(K)Hospitals, including public, private, rural, and critical access hospitals.
(L)Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities. facilities, or providers of sensitive services, as defined in Section 56.05 of the Civil Code.
(M)Consumers.
(N)Organized labor.
(O)Privacy and security professionals.
(P)Health information technology professionals.
(Q)Community health information organizations.
(R)County health, social services, and public health.
(S)Community-based organizations providing social services.
(3)(4)The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health information technology issues, including all of the following:
(A)Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(B)Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)Storage, maintenance, and management of health information.
(iv)Linking, sharing, exchanging, and providing access to health information.
(C)Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities.
(E)Identify ways to incorporate relevant data on behavioral health and substance use disorder conditions.
(F)Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health information sharing broadly implements national frameworks and agreements consistent with federal rules and programs.
(H)Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards.
(I)Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)Assess governance structures to help guide policy decisions and general oversight.
(K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange.
(L)Identify policies and procedures to ensure appropriate safeguards to prevent electronic health information related to the provision of sensitive services, as defined in Section 56.05 of the Civil Code, from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
(4)(5)The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(5)(6)The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) (4) of subdivision (c).
(e)On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing data-sharing agreement pursuant to subdivision (a):
(1)General acute care hospitals, as defined by in Section 1250.
(2)Physician organizations and medical groups.
(3)Skilled nursing facilities, as defined by in Section 1250, that currently maintain electronic records.
(4)Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)Acute psychiatric hospitals, as defined by in Section 1250.
(g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(h)On or before July 31, 2022, the California Health and Human Services Agency shall develop develop, in consultation with the stakeholder advisory group in subdivision (c) (c), a strategy for unique, secure digital identities capable of supporting master patient indices to be implemented by both private and public organizations in California.
(i)For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No person hired or otherwise retained pursuant to this subdivision shall be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term person, as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(j)All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing data-sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
SEC. 5.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SECTION 1.It is the intent of the Legislature to enact legislation to protect reproductive and sexual health information. REVISIONS: HeadingLine 2.It is the intent of the Legislature to enact legislation to protect reproductive and sexual health information.
|
Date
|
Status
|
|---|---|
| Sep 27, 2023 | Chaptered by Secretary of State - Chapter 255, Statutes of 2023. |
| Sep 27, 2023 | Approved by the Governor. |
| Sep 21, 2023 | Enrolled and presented to the Governor at 3:30 p.m. |
| Sep 14, 2023 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 64. Noes 14. Page 3529.). |
| Sep 13, 2023 | In Assembly. Concurrence in Senate amendments pending. |
| Sep 13, 2023 | Read third time. Passed. Ordered to the Assembly. (Ayes 32. Noes 7. Page 2702.). |
| Sep 11, 2023 | Read second time. Ordered to third reading. |
| Sep 8, 2023 | Read third time and amended. Ordered to second reading. |
| Aug 15, 2023 | Read second time. Ordered to third reading. |
| Aug 14, 2023 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8. |
| Jul 13, 2023 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 10. Noes 0.) (July 12). Re-referred to Com. on APPR. |
| Jun 28, 2023 | From committee: Do pass and re-refer to Com. on HEALTH. (Ayes 10. Noes 1.) (June 27). Re-referred to Com. on HEALTH. |
| Jun 14, 2023 | Referred to Coms. on JUD. and HEALTH. |
| Jun 1, 2023 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 31, 2023 | Read third time. Passed. Ordered to the Senate. (Ayes 64. Noes 12. Page 2000.) |
| May 22, 2023 | Read second time. Ordered to third reading. |
| May 18, 2023 | Read second time and amended. Ordered returned to second reading. |
| May 18, 2023 | From committee: Amend, and do pass as amended. (Ayes 11. Noes 4.) (May 18). |
| May 10, 2023 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| Apr 26, 2023 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 8. Noes 2.) (April 25). Re-referred to Com. on APPR. |
| Apr 26, 2023 | Coauthors revised. |
| Apr 12, 2023 | From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 11. Noes 3.) (April 11). Re-referred to Com. on P. & C.P. |
| Mar 27, 2023 | Re-referred to Com. on HEALTH. |
| Mar 23, 2023 | Referred to Coms. on HEALTH and P. & C.P. |
| Mar 23, 2023 | From committee chair, with author's amendments: Amend, and re-refer to Com. on HEALTH. Read second time and amended. |
| Feb 1, 2023 | From printer. May be heard in committee March 3. |
| Jan 31, 2023 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 14, 2023 | AB 352 Bauer-Kahan Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Sep 13, 2023 | Assembly 3rd Reading AB352 Bauer-Kahan et al. By Atkins | Senate Floor |
Passed |
|
| Jul 12, 2023 | Do pass, but first be re-referred to the Committee on [Appropriations] | Senate Standing Committee on Health |
Passed |
|
| Jun 27, 2023 | Do pass, but first be re-referred to the Committee on [Health] | Senate Standing Committee on Judiciary |
Passed |
|
| May 31, 2023 | AB 352 Bauer-Kahan Assembly Third Reading | Assembly Floor |
Passed |
|
| May 18, 2023 | Do pass as amended. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 25, 2023 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| Apr 11, 2023 | Do pass and be re-referred to the Committee on [Privacy and Consumer Protection] | Assembly Standing Committee on Health |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| American Civil Liberties Union California Action | ** Support | |
| American College Of Obstetricians And Gynecologists District Ix | ** Support | |
| ARIA Medical Clinic | * Support | Apr 25, 2023 |
| Attorney General Rob Bonta | ** Support | |
| Black Women For Wellness Action Project | * Support | Apr 11, 2023 |
| California Academy Of Family Physicians | ** Support | |
| California Health Plus Advocates | * Support | Jul 12, 2023 |
| California Latinas for Reproductive Justice | * Support | Apr 25, 2023 |
| California Legislative Women's Caucus | ** Support | |
| California Medical Association | * Support | Apr 11, 2023 |
| California Nurse Midwives Association | ** Support | |
| California Nurses Association | * Support | Jul 12, 2023 |
| California Pan - Ethnic Health Network | ** Support | |
| Electronic Frontier Foundation | ** Support | |
| Equal Rights Advocates | * Support | Jun 27, 2023 |
| Essential Access Health | * Support | Jul 12, 2023 |
| Lieutenant Governor | * Support | Jul 12, 2023 |
| Lieutenant Governor Eleni Kounalakis | ** Support | |
| Maternal and Child Health Access | * Support | Apr 11, 2023 |
| NARAL Pro-Choice California | ** Support | |
| Oakland Privacy | ** Support | |
| Planned Parenthood Affiliates Of California | ** Support | |
| Privacy Rights Clearinghouse | ** Support | |
| Right to Life League | ** Against | |
| San Francisco City Attorney Office | ** Support | |
| UCSF School of Medicine | * Support | Apr 25, 2023 |
CONCURRENCE IN SENATE AMENDMENTS
CSA1 Bill Id:AB 352
Author:(Bauer-Kahan)
As Amended Ver:September 8, 2023
Majority vote
SUMMARY
Requires specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services, and contraception, as specified. Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless authorized. Exempts a health care provider from legal liability for damages or from civil or enforcement actions, as specified. Excludes the exchange of abortion and abortion-related services health information from automatically being shared on the California Health and Human Services Data Exchange Framework.
Senate Amendments
Replace sensitive services medical information with gender affirming care, abortion and abortion-related services, and contraception. Add the health care provider exemption from legal liability for damages or from actions, and Framework exclusion for abortion and abortion-related health information. Incorporate changes proposed by SB 582 (Becker) of the current legislative session to be operative only and if this bill and SB 582 are enacted, as specified.
COMMENTS
The federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals' trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as reproductive health information.
- Federal guidance. According to the United States Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. HHSA writes that access to comprehensive reproductive health care services, including abortion care, is essential to individual health and well-being. The HIPAA Privacy Rule supports such access by giving individuals confidence that their PHI including information relating to abortion and other sexual and reproductive health care, will be kept private.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women's Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe vs. Wade and Planned Parenthood vs. Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHSA Office for Civil Rights issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things: a) addresses how federal law and regulations protect individuals' PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and, b) addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals' privacy when using period trackers and other health information apps.
- California abortion coverage. According to the California Health Benefits Review Program, under the Reproductive Privacy Act, California law prohibits the State from denying or interfering with a woman's right to choose or obtain an abortion prior to viability of the fetus, or when medically necessary. The state defines viability as the point in a pregnancy when, in the good faith medical judgment of a physician, there is a reasonable likelihood that a fetus will survive outside the uterus without "extraordinary medical measures." Abortion is considered a basic health care service in California.
In May 2021, Texas Governor Greg Abbott signed legislation (S.B. 8) to ban abortion at six weeks of gestation, so early in pregnancy that many people may not even know that they are pregnant. Among other harms, it could force many people to travel dramatically longer distances to obtain abortion care. S.B. 8 has made national news as it allows anyone who is opposed to abortion, regardless of where they live or whether they have any association with a patient, to sue an abortion provider or anyone who helps a patient obtain an abortion, such as by providing financial help or transportation.
This bill prevents information on sexual health, abortion, and other sensitive services in health information exchanges (HIEs) from being automatically shared, especially outside of California. According to the author, there is precedent for protecting sensitive information, even in health care settings. Federal regulations protect the records of substance abuse treatment from being seen without explicit patient consent. Patients are empowered to give and revoke consent to sharing of their substance abuse treatment data. It allows patients to specify who, specifically, can receive that data through an HIE.
According to the Author
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. The author concludes that this bill prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
Arguments in Support
Planned Parenthood Affiliates of California, sponsor, writes that this bill will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services. NARAL Pro-Choice California writes in support that this bill prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to any inquiry or investigation by an individual, agency, or department from another state or federal law enforcement agency that would identify an individual seeking or obtaining an abortion or abortion-related services that are legal in California. Oakland Privacy writes in support that bans and restrictions on healthcare procedures such as abortions and gender-affirming care are a civil rights issue, a privacy issue, and a safety and security issue. These restrictive laws relegate people to being second-class citizens, restricting bodily autonomy, the freedom of interstate travel, and are an invasion of privacy. The Electronic Frontier Foundation, also in support states, patients must feel safe in the hands of their medical providers and should not have to worry that information from their medical record will expose them to investigation or prosecution. As states diverge on the issue of abortion, it is vitally important that California pass this bill to maintain its status as a sanctuary for those seeking abortions and other reproductive care.
Arguments in Opposition
The Right to Life League writes in opposition that this bill shields abortionists and human and child traffickers by further complicating law enforcements' requests for information and will frustrate enforcement of foreign laws against abortionists, abusers and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
FISCAL COMMENTS
According to the Senate Appropriations Committee, pursuant to Senate Rule 28.8, negligible state costs.
VOTES:
ASM HEALTH: 11-3-1
YES: Wood, Aguiar-Curry, Arambula, Boerner Horvath, Wendy Carrillo, Maienschein, McCarty, Rodriguez, Santiago, Villapudua, Weber
NO: Waldron, Vince Fong, Joe Patterson
ABS, ABST OR NV: Flora
ASM PRIVACY AND CONSUMER PROTECTION: 8-2-1
YES: Gabriel, Bauer-Kahan, Bennett, Irwin, Lowenthal, Papan, Wicks, Wilson
NO: Joe Patterson, Vince Fong
ABS, ABST OR NV: Essayli
ASM APPROPRIATIONS: 11-4-1
YES: Holden, Bryan, Calderon, Wendy Carrillo, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega
NO: Megan Dahle, Dixon, Mathis, Sanchez
ABS, ABST OR NV: Robert Rivas
ASSEMBLY FLOOR: 64-12-4
YES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones‑Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NO: Megan Dahle, Dixon, Essayli, Vince Fong, Gallagher, Lackey, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
ABS, ABST OR NV: Chen, Davies, Flora, Hoover
UPDATED
VERSION: September 8, 2023
CONSULTANT: Kristene Mapile / HEALTH / (916) 319-2097 FN: 0002230
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 352 |
THIRD READING
Bill No: AB 352
Author: Bauer-Kahan (D), et al.
Amended: 9/8/23 in Senate
Vote: 21
SENATE JUDICIARY COMMITTEE: 10-1, 6/27/23
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Stern, Wiener
NOES: Niello
SENATE HEALTH COMMITTEE: 10-0, 7/12/23
AYES: Eggman, Glazer, Gonzalez, Hurtado, Limón, Menjivar, Roth, Rubio, Wahab, Wiener
NO VOTE RECORDED: Nguyen, Grove
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 64-12, 5/31/23 - See last page for vote
SUBJECT: Health information
SOURCE: American College of Obstetricians and Gynecologists District IX Planned Parenthood Affiliates of California
DIGEST:
This bill enacts protections for medical information related to gender affirming care, abortion and abortion-related services, and contraception instead of sensitive services by requiring businesses that store or maintain that information to develop specified capabilities, policies, and procedures to enable safeguards regarding accessing the information by July 1, 2024. This bill also prohibits certain health entities from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law.
Senate Floor Amendments of 9/8/23 (1) apply the bill’s provisions to gender affirming care, abortion and abortion-related services, and contraception instead of sensitive services; (2) specify that existing provisions of law requiring specified entities to share health information in real time does not apply to abortion and abortion-related services; (3) limit a provider of health care’s liability for damages or from civil enforcement actions relating to cooperating with, or providing medical information to, another state or federal agency before January 31, 2026 if the provider is working diligently and in good faith to comply with the bill’s prohibition; and (4) make chaptering amendments with SB 582.
ANALYSIS:
Existing law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.) Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. Specifies that this provision is intended to further the constitutional right to privacy guaranteed by Section 1 of Article I of the California Constitution, and the constitutional right to not be denied equal protection guaranteed by Section 7 of Article I of the California Constitution, and that nothing herein narrows or limits the right to privacy or equal protection. (Cal. Const., art. I, § 1.1.)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions and, therefore, it is the public policy of the State of California that:
- Every individual has the fundamental right to choose or refuse birth control; and
- Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions.
- Establishes the Confidentiality of Medical Information Act (CMIA), which establishes protections for the use of medical information and defines various terms for these purposes. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
- Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, is deemed a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(a).)
- Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
- Provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in CMIA. (Civ. Code § 56.06(d)-(e).)
- Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code § 56.36.)
- Requires specified health providers to exchange health information or provide access to health information to other providers in real time as specified by the California Health and Human Services Agency, except as provided. (Health & Saf. Code § 130290(b).)
This bill:
- Requires a business, as described in Section 56.06 of the Civil Code, that electronically stores or maintains medical information on the provision of gender affirming care, abortion and abortion-related services, and contraception, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, as provided.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply with this bill to be consistent with existing federal law.
- Prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized as provided.
- Specifies that the above provisions do not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
- Requires the content of the health records containing medical information described in 3), above, to be disclosed to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act.
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
- Provides a provider is not subject to liability for damages or to civil or enforcement actions for failure to meet the requirements of 3) through 5), above, before January 31, 2026, if the provider of health care is working diligently and in good faith to come into compliance.
- Adds abortion and abortion related services as an exception to the requirement to exchange health information in real time.
Comments
Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022 the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion (Dobbs v. Jackson Women’s Health (2022) 142 S. Ct. 2228.). As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. Some states have even begun criminalizing abortion care. In addition, a growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.[1]
The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.). This was the first time an individual’s right to abortion was upheld in a court. In 1972 the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1972 gen. elec.). California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.). In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation.[2] In September 2021, more than 40 organizations came together to form the California Future Abortion Council to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians but all who seek care in the state.
In response to the Dobbs decision, California enacted a comprehensive package of legislation expanding, protecting, and strengthening access to reproductive health care, including abortions, for all Californians and people seeking such care in our state.[3] One such law, AB 1666 (Bauer-Kahan, Chapter 42, Statutes of 2022) provided that a law of another state that authorizes a person to bring a civil action against a person or entity who receives, seeks, performs, or induces an abortion, or knowingly engages in conduct that aids or abets the performance or inducement of an abortion, or attempts or intends to engage in such conduct, is contrary to the public policy of this state (Gov. Code § 123467.5.) Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
As California and other states have implemented policies to ensure that transgender individuals are not discriminated against and can obtain gender-affirming care, other states have targeted transgender individuals and providers of gender affirming care. According to Human Rights Watch, as of March 2022, legislatures nationwide had introduced over 300 anti-LGBTQ+ bills, over 130 of which specifically targeted transgender people.[4] Many states have been enacting statutes that potentially impose civil and criminal liability for providing to a minor, or helping a minor obtain, gender-affirming care. For example, Alabama recently enacted a bill that makes it a felony to provide, or help to provide, certain types of gender-affirming care.[5] Arkansas prohibits a physician or other healthcare provider from providing or referring certain types of gender-affirming care for a minor; a violation or “threatened violation” can be punished through a professional board or a civil action.[6] SB 107 (Wiener, Chapter 810, Statutes of 2022), among other things, prohibits the sharing of medical records regarding the receipt of gender-affirming care, the enforcement of out-of-state subpoenas seeking information regarding the receipt of gender-affirming medical care in California, and the enforcement of laws of another state that authorize the removal of a child from their parent or guardian and enforcement of out-of-state criminal laws related to gender-affirming health care. On September 29, 2022, Governor Newsom issued a signing statement for SB 107 that said “[i]n California we believe in equality and acceptance. We believe that no one should be prosecuted or persecuted for getting care they need – including gender-affirming care.[7]”
In response to the assault on reproductive rights and legislation targeting transgender people, this bill provides increased protections to electronically stored or maintained medical information. The author and sponsors of the bill note that, though California has enacted extensive protections for abortion within the state, there are still major gaps when people come to California for care. Critically, they state that physicians in states that ban abortion can easily see all details of abortion care through health information exchanges (HIE) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers. This bill enacts similar provisions to the federal regulations that prohibit the sharing of patient information for substance use disorders. (42 U.S.C. 290dd; 82 Fed. Regs. 6115)
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
SUPPORT: (Verified 9/11/23)
American College of Obstetricians and Gynecologists District IX (co-source)
Planned Parenthood Affiliates of California (co-source)
Attorney General Rob Bonta
Lieutenant Governor Eleni Kounalakis
American Civil Liberties Union California Action
California Academy of Family Physicians
California Nurse Midwives Association
California Pan - Ethnic Health Network
Electronic Frontier Foundation
NARAL Pro-Choice California
Oakland Privacy
San Francisco City Attorney’s Office
OPPOSITION: (Verified 9/11/23)
Right to Life League
ARGUMENTS IN SUPPORT: The American College of Obstetricians and Gynecologists District IX writes in support:
Given the federal climate, anyone supporting someone in obtaining an abortion could face arrest and extradition under other states’ current law. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California. Critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
AB 352 addresses this problem head-on by preventing information on sexual health abortion, and other sensitive services in health information exchanges from being automatically shared, especially outside of California. Parties must be appropriately authorized to view medical information related to sensitive services.
ARGUMENTS IN OPPOSITION: The Right to Life League writes in opposition stating:
On its face, AB 352 blatantly violates the Full Faith and Credit Clause in Article 4 of the U.S. Constitution by instructing healthcare providers, contractors and employers not to comply with valid information requests from other states. Subsection 56.108 impermissibly forbids health care providers, contractors and employers from complying with valid court orders, such as subpoenas, issued in foreign states.
The U.S. Constitution is the supreme law of our land. Thanks to the recent U.S. Supreme Court decision in Dobbs, states regulate abortion. Dobbs did not change the applicability of the Full Faith and Credit Clause in Article 4. California may proclaim itself an “Abortion Sanctuary”; however, California may not thwart the laws of other states to suit its radical pro-abortion agenda.
ASSEMBLY FLOOR: 64-12, 5/31/23
AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NOES: Megan Dahle, Dixon, Essayli, Vince Fong, Gallagher, Lackey, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
NO VOTE RECORDED: Chen, Davies, Flora, Hoover
Prepared by: Amanda Mattson / JUD. / (916) 651-4113
9/11/23 18:24:18
**** END ****
For a more detailed analysis of these issues please refer to the Senate Judiciary Committee analysis of AB 352 (Reg. Sess. 2023-24) as amended May 18, 2023. ↑
California Proclamation on Reproductive Freedom (May 31, 2019) available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf. ↑
Kristen Hwang, Newsom signs abortion protections into law, CalMatters (Sept. 27, 2022), available at https://calmatters.org/health/2022/09/california-abortion-bills/. ↑
Human Rights Watch, Press Release, ICYMI: As Lawmakers Escalate Attacks on Transgender Youth Across the Country, Some GOP Leaders Stand Up for Transgender Youth (Mar. 24, 2022), https://www.hrc.org/press-releases/icymi-as-lawmakers-escalate-attacks-on-transgender-youth-across-the-country-some-gop-leaders-stand-up-for-transgender-youth. ↑
See Al. Code, § 26-26-4. ↑
Ark. Stats. §§ 20-9-1502 & 20-9-1504. ↑
Governor’s singing statement on Sen. Bill 107 (2021-22 Reg. Sess.), available at https://www.gov.ca.gov/wp-content/uploads/2022/09/SB-107-SIGNING.pdf?emrc=1a80c5. ↑
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 352 |
THIRD READING
Bill No: AB 352
Author: Bauer-Kahan (D), et al.
Amended: 5/18/23 in Assembly
Vote: 21
SENATE JUDICIARY COMMITTEE: 10-1, 6/27/23
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Stern, Wiener
NOES: Niello
SENATE HEALTH COMMITTEE: 10-0, 7/12/23
AYES: Eggman, Glazer, Gonzalez, Hurtado, Limón, Menjivar, Roth, Rubio, Wahab, Wiener
NO VOTE RECORDED: Nguyen, Grove
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 64-12, 5/31/23 - See last page for vote
SUBJECT: Health information
SOURCE: American College of Obstetricians and Gynecologists District IX
Planned Parenthood Affiliates of California
DIGEST:
This bill enacts protections for certain sensitive medical information by requiring businesses that store or maintain that information to develop specified capabilities, policies, and procedures to enable safeguards regarding accessing the information by July 1, 2024. This bill also prohibits a provider of health care, a health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law.
ANALYSIS:
Existing law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
- Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. Specifies that this provision is intended to further the constitutional right to privacy guaranteed by Section 1 of Article I of the California Constitution, and the constitutional right to not be denied equal protection guaranteed by Section 7 of Article I of the California Constitution, and that nothing herein narrows or limits the right to privacy or equal protection. (Cal. Const., art. I, § 1.1.)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions and, therefore, it is the public policy of the State of California that:
- Every individual has the fundamental right to choose or refuse birth control; and,
- Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions.
- Establishes the Confidentiality of Medical Information Act (CMIA), which establishes protections for the use of medical information and defines various terms for these purposes. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
- Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, is deemed a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(a).)
- Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
- Provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in CMIA. (Civ. Code § 56.06(d)-(e).)
- Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code § 56.36.)
This bill:
- Requires a business, as described in Section 56.06 of the Civil Code, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of as provided.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply with this bill to be consistent with existing federal law.
- Exempts an existing EHR system that is substantially customized to fit the individual needs of a health care provider or health care service plan from the requirement specified in 1) above, except that if a substantially customized EHR system is modified, other than for basic maintenance, then 1) above applies.
- Defines “substantially customized” to mean that significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications.
- Prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized as provided.
- Specifies that the above provisions do not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
- Requires the content of the health records containing medical information described in 7), above, to be disclosed to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act.
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
Comments
Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022 the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion (Dobbs v. Jackson Women’s Health (2022) 142 S. Ct. 2228.). As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. Some states have even begun criminalizing abortion care. In addition, a growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.[1]
The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.) This was the first time an individual’s right to abortion was upheld in a court. In 1972 the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1972 gen. elec.) California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.) In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation.[2] In September 2021, more than 40 organizations came together to form the California Future Abortion Council to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians but all who seek care in the state.
In response to the Dobbs decision, California enacted a comprehensive package of legislation expanding, protecting, and strengthening access to reproductive health care, including abortions, for all Californians and people seeking such care in our state.[3] One such law, AB 1666 (Bauer-Kahan, Chapter 42, Statutes of 2022) provided that a law of another state that authorizes a person to bring a civil action against a person or entity who receives, seeks, performs, or induces an abortion, or knowingly engages in conduct that aids or abets the performance or inducement of an abortion, or attempts or intends to engage in such conduct, is contrary to the public policy of this state (Gov. Code § 123467.5.) Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
As California and other states have implemented policies to ensure that transgender individuals are not discriminated against and can obtain gender-affirming care, other states have targeted transgender individuals and providers of gender affirming care. According to Human Rights Watch, as of March 2022, legislatures nationwide had introduced over 300 anti-LGBTQ+ bills, over 130 of which specifically targeted transgender people.[4] Many states have been enacting statutes that potentially impose civil and criminal liability for providing to a minor, or helping a minor obtain, gender-affirming care. For example, Alabama recently enacted a bill that makes it a felony to provide, or help to provide, certain types of gender-affirming care.[5] Arkansas prohibits a physician or other healthcare provider from providing or referring certain types of gender-affirming care for a minor; a violation or “threatened violation” can be punished through a professional board or a civil action.[6] SB 107 (Wiener, Chapter 810, Statutes of 2022), among other things, prohibits the sharing of medical records regarding the receipt of gender-affirming care, the enforcement of out-of-state subpoenas seeking information regarding the receipt of gender-affirming medical care in California, and the enforcement of laws of another state that authorize the removal of a child from their parent or guardian and enforcement of out-of-state criminal laws related to gender-affirming health care. On September 29, 2022, Governor Newsom issued a signing statement for SB 107 that said “[i]n California we believe in equality and acceptance. We believe that no one should be prosecuted or persecuted for getting care they need – including gender-affirming care.[7]”
In response to the assault on reproductive rights and legislation targeting transgender people, this bill provides increased protections to electronically stored or maintained medical information. The author and sponsors of the bill note that, though California has enacted extensive protections for abortion within the state, there are still major gaps when people come to California for care. Critically, they state that physicians in states that ban abortion can easily see all details of abortion care through health information exchanges (HIE) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers. This bill enacts similar provisions to the federal regulations that prohibit the sharing of patient information for substance use disorders. (42 U.S.C. 290dd; 82 Fed. Regs. 6115)
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes
SUPPORT: (Verified 8/16/23)
American College of Obstetricians and Gynecologists District IX (co-source)
Planned Parenthood Affiliates of California (co-source)
Attorney General Rob Bonta
Lieutenant Governor Eleni Kounalakis
American Civil Liberties Union California Action
California Academy of Family Physicians
California Nurse Midwives Association
California Pan - Ethnic Health Network
Electronic Frontier Foundation
NARAL Pro-Choice California
Oakland Privacy
San Francisco City Attorney’s Office
OPPOSITION: (Verified 8/16/23)
Right to Life League
ARGUMENTS IN SUPPORT: The author writes:
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. AB 352 prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
The American College of OB/GYN’s District IX writes in support:
Given the federal climate, anyone supporting someone in obtaining an abortion could face arrest and extradition under other states’ current law. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California. Critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
AB 352 addresses this problem head-on by preventing information on sexual health abortion, and other sensitive services in health information exchanges from being automatically shared, especially outside of California. Parties must be appropriately authorized to view medical information related to sensitive services.
ARGUMENTS IN OPPOSITION: The Right to Life League writes in opposition stating:
On its face, AB 352 blatantly violates the Full Faith and Credit Clause in Article 4 of the U.S. Constitution by instructing healthcare providers, contractors and employers not to comply with valid information requests from other states. Subsection 56.108 impermissibly forbids health care providers, contractors and employers from complying with valid court orders, such as subpoenas, issued in foreign states.
The U.S. Constitution is the supreme law of our land. Thanks to the recent U.S. Supreme Court decision in Dobbs, states regulate abortion. Dobbs did not change the applicability of the Full Faith and Credit Clause in Article 4. California may proclaim itself an “Abortion Sanctuary”; however, California may not thwart the laws of other states to suit its radical pro-abortion agenda.
ASSEMBLY FLOOR: 64-12, 5/31/23
AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NOES: Megan Dahle, Dixon, Essayli, Vince Fong, Gallagher, Lackey, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
NO VOTE RECORDED: Chen, Davies, Flora, Hoover
Prepared by: Amanda Mattson / JUD. / (916) 651-4113
8/16/23 16:26:22
For a more detailed analysis of these issues please refer to the Senate Judiciary Committee analysis of AB 352 (Reg. Sess. 2023-24) as amended May 18, 2023. ↑
California Proclamation on Reproductive Freedom (May 31, 2019) available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf. ↑
Kristen Hwang, Newsom signs abortion protections into law, CalMatters (Sept. 27, 2022), available at https://calmatters.org/health/2022/09/california-abortion-bills/. ↑
Human Rights Watch, Press Release, ICYMI: As Lawmakers Escalate Attacks on Transgender Youth Across the Country, Some GOP Leaders Stand Up for Transgender Youth (Mar. 24, 2022), https://www.hrc.org/press-releases/icymi-as-lawmakers-escalate-attacks-on-transgender-youth-across-the-country-some-gop-leaders-stand-up-for-transgender-youth (all links current as of August 29, 2022). ↑
See Al. Code, § 26-26-4. ↑
Ark. Stats. §§ 20-9-1502 & 20-9-1504. ↑
Governor’s singing statement on Sen. Bill 107 (2021-22 Reg. Sess.), available at https://www.gov.ca.gov/wp-content/uploads/2022/09/SB-107-SIGNING.pdf?emrc=1a80c5. ↑
SENATE COMMITTEE ON HEALTH
Senator Dr. Susan Talamantes Eggman, Chair
BILL NO: AB 352
AUTHOR: | Bauer-Kahan | ||
VERSION: | May 18, 2023 | ||
HEARING DATE: | July 12, 2023 | ||
CONSULTANT: | Vincent D. Marchand | ||
SUBJECT: Health information
SUMMARY:
Prohibits a health care provider, health plan, contractor, or employer from cooperating with any investigation, or provide medical information to, any individual or agency from another state, that would identify an individual and that is related to seeking or obtaining an abortion or abortion-related services. Prohibits a health care provider, health plan, pharmaceutical company, contractor, or employer from disclosing, transmitting, or granting access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, or aiding in the performance of an abortion to any individual or entity from another state, unless authorized, as specified. Requires a business that electronically stores or maintains medical information on the provision of sensitive services on behalf of a provider or health plan to develop the capability to segregate medical information related to sensitive services from the rest of the patient’s medical record and to automatically disable access to segregated medical information on sensitive services by individuals and entities in another state.
Existing law:
- Establishes the Reproductive Privacy Act, which prohibits the state from denying or interfering with a woman’s right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the woman. [HSC §123460, et seq.]
- Establishes the Confidentiality of Medical Information Act (CMIA), which prohibits a health care provider, health care service plan, or contractor from disclosing medical information regarding a patient without first obtaining authorization. [CIV §56, et. seq.]
- Defines “medical information,” for purposes of the CMIA, as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. [CIV §56.05]
- Requires any business organized for the purposes of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for the purposes of allowing the individual to manage his or her information, or for the diagnosis or treatment of the individual, to be deemed a provider of health care subject to the CMIA. [CIV §56.06(a)]
- Defines “sensitive services” to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorders, gender affirming care, and intimate partner violence, obtained by a patient at or above the minimum age specified for consenting to the service specified in law. [CIV §56.05(p)]
- Requires a health care provider, health plan, or contractor to disclose medical information, if the disclosure is compelled by certain official actions, including a court order, a board or administrative agency for purposes of adjudication pursuant to its lawful authority, or a search warrant lawfully issued to a governmental law enforcement agency. [CIV §56.10(b)]
- Permits a provider of health care or a health plan to disclose medical information for certain purposes, including for purposes of diagnosis or treatment of the patient, or for purposes of payment for health care services. [CIV §56.10(c)]
- Requires, under the Patient Access to Health Records (PAHR) law, any adult patient of a health care provider, any minor patient authorized by law to consent to medical treatment, and any patient’s personal representative, to be entitled to inspect patient records upon presenting a health care provider with a written request for those records and upon payment of reasonable clerical costs incurred in locating and making the records available. [HSC §123110(a)]
- Establishes, in federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which provides privacy protections for a patient’s “protected health information,” and prohibits a “covered entity,” defined as a health plan, health care provider, or health care clearing house, from using or disclosing protected health information except as specified or as authorized by the patient in writing. [45 CFR §164.500, et seq.]
This bill:
- Prohibits a health care provider, health plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency, that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under this bill as described in 2) below. Exempts compliance with an investigation of an activity that is punishable as a crime under the laws of California from this provision and related provisions of existing law.
- Prohibits, notwithstanding provisions of law that permit disclosing medical information for certain authorized purposes, a health care provider, health plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
- In accordance with a valid, written authorization that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization;
- In accordance with provisions of law permitting disclosure for purposes of bill and payment, to the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate the CMIA;
- In accordance with provisions of law permitting the disclosure of medical information for purposes of accreditation, reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges; or,
- In accordance with provisions of law permitting the disclosure of medical information for the purpose of bona fide research, and requires Institutional Review Boards to consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
- Requires, notwithstanding other provisions of this bill, the disclosure of the content of health records containing medical information to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act;
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with provisions of law governing the disclosure of medical records to law enforcement agencies, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record; and,
- When expressly required by a federal law that preempts California law, but only to the extent expressly required.
- Prohibits anything in this bill from prohibiting a provider of health care, health plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
- Requires a business that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to on an electronic health record system or electronic medical record system, on behalf of a provider of health care, health plan, pharmaceutical company, contractor, or employer, to develop capabilities, policies, and procedures, by July 1, 2024, to enable all of the following:
- Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information;
- Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state;
- Segregate medical information related to sensitive services from the rest of the patient’s record; and,
- Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
- Requires any fees charged to providers of health care, health plans, pharmaceutical companies, contractors, employers, or patients to comply with the provisions of this bill to be consistent with federal regulations that determine when the practice of charging fees related to electronic health information is considered information blocking (which is prohibited), so that the fees must be reasonably related to the cost of providing the services, among other requirements.
- Exempts an existing electronic health records system that is substantially customized to fit the individual needs of a provider of health care or health care service plan from the requirements in this bill. However, if the substantially customized electronic health records system is modified, other than for basic maintenance, specifies that the system is no longer exempt and is required to meet the provisions of this bill. Defines “substantially customized” as significant changes made to existing off-the-shelf technology, or a system entirely custom built by a vendor according to a client’s specifications.
FISCAL EFFECT:
This bill has been amended since the bill was analyzed in Assembly Appropriations Committee to remove an advisory committee that was the bulk of the costs identified with this bill.
PRIOR VOTES:
Senate Judiciary Committee: | 10 – 1 |
Assembly Floor: | 64 - 12 |
Assembly Appropriations Committee: | 11 - 4 |
Assembly Privacy and Consumer Protection Committee: | 8 – 2 |
Assembly Health Committee: | 11 - 3 |
COMMENTS:
- Author’s statement. According to the author, in a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. This bill prevents the automatic sharing of sensitive information in medical records so that anyone coming to California for care is protected.
- Abortion. According to the Center for Disease Control and Prevention (CDC), a legal induced abortion is defined as an intervention performed by a licensed clinician that is intended to terminate an ongoing pregnancy. Ending a pregnancy with medications is an option for women who are less than ten weeks pregnant and would like to have an abortion at home with a less invasive procedure. The CDC reports that a total of 629,898 abortions were reported nationally from 49 reporting areas in 2019. From 2018 to 2019, the total number of abortions increased 2%, and from 2010 to 2019, the total number of reported abortions decreased 18%. In 2019, women in their 20s accounted for more than half of abortions (56.9%). By contrast, adolescents under 15 years (0.2%) and women over 40 (3.7%) years accounted for the lowest percentages of abortions. In 2019, 79.3% of abortions were performed at or less than nine weeks’ gestation, and nearly all (92.7%) were performed at or less than 13 weeks gestation. In 2019, the highest proportion of abortions were performed by surgical abortion at or less than 13 weeks gestation (49.0%), followed by early medication abortion at or less than nine weeks’ gestation (42.3%). In 2018, the most recent year for which data were reviewed for pregnancy-related deaths, two women died as a result of complications from legal induced abortion.
According to the Guttmacher Institute, in 2017, there were 1,587 facilities providing abortion in the U.S., representing a 5% decrease from the 1,671 facilities in 2014. Sixteen percent of facilities in 2017 were abortion clinics (i.e., clinics where more than half of all patient visits were for abortion), 35% were nonspecialized clinics, 33% were hospitals and 16% were private physicians' offices. Sixty percent of all abortions were provided at abortion clinics, 35% at nonspecialized clinics, 3% at hospitals and 1% at physicians' offices. In 2017, 89% of U.S. counties had no clinics providing abortions. Any of the 38% of reproductive-age women living in those counties who needed an abortion during that time would have had to travel out of their county to obtain an abortion. Of patients who had an abortion in 2014, one-third had to travel more than 25 miles one way to reach a facility. - Aftermath of Dobbs ruling has left many areas of country without access to abortion. On June 24, 2022, Roe v. Wade was overruled by Dobbs v. Jackson Women’s Health, finding that contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion, and that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws. According an analysis by the Guttmacher Institute published in June, one year after Dobbs, abortion is completely banned in the following 13 states: Alabama, Arkansas, Idaho, Kentucky, Louisiana, Mississippi, Missouri, North Dakota, Oklahoma, South Dakota, Tennessee, Texas, and West Virginia. Additionally, abortion is unavailable in Wisconsin because of ongoing legal complexities, and several other states have bans that have been blocked by courts. In Florida, a six-week abortion ban was signed into law in April 2023, but is pending a ruling from the Florida Supreme Court deciding the legality of a 15-week abortion ban passed in 2022. If that ban is upheld, the six week ban will go into effect 30 days later. Some states are further testing the legal limits of the post-Roe landscape by passing extreme restrictions, such as a ban on helping a young person travel out of state to access legal abortion care.
- Privacy and access to medical records. In general, patient protections of medical records fall under two main bodies of law: the federal HIPAA and CMIA in California. HIPAA and CMIA generally govern the use and protection of health information by health care providers, health plans and their business associates. HIPAA provides federal protections for patient’s health information held by “covered entities” and any “business associates” that a covered entity engages to help it carry out its health care activities. A covered entity can be a provider, a health plan, or a health care clearinghouse that processes health information it receives from another entity. While HIPAA establishes a federal floor for minimum privacy protections and the right of patients to access their health information, states are permitted to enact laws that provide greater privacy protections or rights. Under CMIA, a health care provider, health plan, or contractor cannot disclose medical information regarding a patient without getting the patient’s written authorization.
Separately, two bodies of state law govern patient access to those records: PAHR in the Health and Safety Code, and provisions of law in the Evidence Code governing requests for medical information made by attorneys representing patients. HIPAA also provides for patient access to medical records, and sets minimum requirements on providers, although state law can be more restrictive. Under PAHR, generally speaking, the person who consents for the treatment is the one authorized to inspect and make copies of the medical record. For most routine care, the medical records of a minor patient are accessible by the parent or other representative of the minor, since the parent provided consent for the care on behalf of the minor patient. However, state law specifies certain types of care that minors, typically those 12 years of age or older, can consent to care without involving their parent. In those instances, only the minor can have access to the health records of those services.
With the rules against information blocking from the 21st Century Cures Act, unless health information is subject to one of the eight “reasonable and necessary” exceptions identified in the final rule, or if the medical provider is following a state or federal law, health information is required to be made available. - What is a health information exchange? Health information exchanges are digital services that operate across health organizations to share health care information. Health information exchanges store and exchange information about health conditions, medications, and allergies. It can also include procedures, notes and lab results. Once an organization is part of an exchange, or a member of a health information network, they have access to the information in the exchange based on the policy of the health information exchange. Because of federal regulations, information that is not exchanged includes substance abuse treatment, which would require written authorization from a patient
- 21st Century Cures Act and related rules. The 21st Century Cures Act (Cures Act) was signed into law on December 13, 2016, and according to the federal Food and Drug Administration, was designed to help accelerate medical product development and bring new innovations and advances to patients who need them faster and more efficiently. While there were a number of provisions in this law, the section on information blocking is relevant to this bill. The Office of the National Coordinator for Health Information Technology (ONC) Cures Act Final Rule, published in 2020, implemented key provisions of the Cures Act, including addressing occurrences of “information blocking.” Information blocking is a practice by a health care provider, developer of health information technology (IT), a health information network, or a health information exchange that, except as required by law or specified as a reasonable and necessary activity, is likely to interfere with access, exchange, or use of electronic health information. According to ONC, examples of practices that could constitute information blocking include implementing health IT in nonstandard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information. The rule identifies eight categories of reasonable and necessary activities that do not constitute information blocking, provided certain conditions are met. Exceptions include engaging in practices to prevent harm, to protect an individual’s privacy, to protect the security of electronic health information, or if the request for access or use of health information is infeasible. Additionally, if a health care provider’s information blocking practice is required by state or federal law, then it also is not considered a violation of the rule.
- Double referral. This bill was heard in the Senate Judiciary Committee on June 27, 2023, and passed with a 10-1 vote.
- Related legislation. AB 254 (Bauer-Kahan) adds “reproductive or sexual health application information” to the definition of “medical information” in the CMIA. AB 254 passed the Senate Health Committee by a vote of 11-1 on July 5, 2023.
AB 1194 (Carrillo) provides strong privacy protections pursuant to the California Consumer Privacy Act where the consumer information relates to specified reproductive health services. AB 1194 passed the Senate Judiciary Committee by a vote of 10-0 on June 20, 2023. - Prior legislation. SB 245 (Gonzalez, Chapter 11, Statutes of 2022) prohibits cost-sharing, restrictions, delays, prior authorization and annual or lifetime limits on all abortion services.
SB 1142 (Caballero, Chapter 566, Statutes of 2022) requires the California Health and Human Services Agency (CHHSA), or a designated entity, to establish a website where the public can access specified information about abortion services.
SB 1245 (Kamlager, Chapter 567, Statutes of 2022) establishes the Los Angeles (LA) County Abortion Access Safe Haven Pilot Program for the purpose of expanding and improving access to the full spectrum of sexual and reproductive health care, including abortion, in LA County.
AB 2091 (Bonta, Chapter 628, Statutes of 2022) establishes requirements to protect the private information of individuals who seek or consider an abortion.
AB 1184 (Chiu, Chapter 190, Statutes of 2021) revises and recasts provisions to require a health plan or insurer to accommodate requests for confidential communication of medical information regardless of whether there is a situation involving sensitive services or a situation in which disclosure would endanger the individual. AB 1184 prohibits a health plan or insurer from requiring a protected individual, as defined, to obtain the policyholder, primary subscriber, or other enrollee or insured's authorization to receive health care services or to submit a claim, if the protected individual has the right to consent to care. AB 1184 requires the health plan or insurer to direct all communications regarding a protected individual's receipt of sensitive health care services directly to the protected individual, and prohibits the disclosure of that information to the policyholder, primary subscriber, or any plan enrollees or insureds without the authorization of the protected individual, as provided.
- Support. This bill is co-sponsored by Planned Parenthood Affiliates of California (PPAC) and the American College of Obstetricians and Gynecologists (ACOG), District IX. According to PPAC, the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization opened the door for states to ban and criminalize abortion services, impacting patients and providers across the country. Currently, 18 states have enacted a ban on abortion services or have severely restricted access to abortion. PPAC states that these efforts to restrict reproductive abortion rights are intertwined with policies banning trans rights and gender affirming care, which have been introduced in hostile states across the country. These bans have caused patients to seek care wherever they can, including traveling to California for care. While reproductive health services remain legal and accessible in California, there is no legitimate fear that accessing or providing care can lead to civil or criminal penalties. To ensure patients feel safe access care and providers continue to be able to offer abortion services and other reproductive health services, it is critical to protect information shared through health information exchange. ACOG states that, critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges, even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers. ACOG states this bill address this problem by preventing information on abortion and other sensitive services in health information exchanges from being automatically shared, especially outside of California.
- Opposition. This bill is opposed by the Right to Life League, which states that it will shield abortionists and human and child traffickers by further complicating law enforcement requests for information. The Right to Life League states that this bill will frustrate enforcement against abortionists, abusers, and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
SUPPORT AND OPPOSITION:
Support: American College of Obstetricians and Gynecologists District IX (co-sponsor)
Planned Parenthood Affiliates of California (co-sponsor)
American Civil Liberties Union California Action
Attorney General Rob Bonta
California Legislative Women's Caucus
California Academy of Family Physicians
California Health+ Advocates
California Nurse Midwives Association
California Nurses Association
California Pan - Ethnic Health Network
Electronic Frontier Foundation
NARAL Pro-choice California
Oakland Privacy
Office of Lieutenant Governor Eleni Kounalakis
Privacy Rights Clearinghouse
San Francisco City Attorney's Office
Oppose: Right to Life League
-- END --
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: AB 352 (Author:Bauer-Kahan)
Version: May 18, 2023
Hearing Date: June 27, 2023
Fiscal: Yes
Urgency: No
Consultant: AM
SUBJECT
Health information
DIGEST
This bill seeks to enact protections for certain sensitive medical information by requiring businesses that store or maintain that information to develop specified capabilities, policies, and procedures to enable safeguards regarding accessing the information by July 1, 2024. The bill also prohibits a provider of health care, a health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law.
EXECUTIVE SUMMARY
Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022 the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion. As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. Some states have even begun criminalizing abortion care. In addition, a growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child. This bill seeks to provide additional safeguards by requiring specified protections and procedures for information regarding sensitive medical services that is electronically stored or maintained, including abortion care and gender affirming care, as provided.
The bill is sponsored by American College of Obstetricians and Gynecologists District IX and Planned Parenthood Affiliates of California and is supported by various reproductive rights organizations, medical associations, and other organizations. Should this bill pass out of this Committee, it will next be heard in the Senate Health Committee.
PROPOSED CHANGES TO THE LAW
Existing federal law:
- Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
- Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)
Existing state law:
- Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, § 1.)
- Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
- Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. Specifies that this provision is intended to further the constitutional right to privacy guaranteed by Section 1 of Article I of the California Constitution, and the constitutional right to not be denied equal protection guaranteed by Section 7 of Article I of the California Constitution, and that nothing herein narrows or limits the right to privacy or equal protection. (Cal. Const., art. I, § 1.1.)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions and, therefore, it is the public policy of the State of California that:
- every individual has the fundamental right to choose or refuse birth control; and
- every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions
- Establishes the Confidentiality of Medical Information Act (CMIA), which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
- Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
- Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code § 56.101.)
- Defines “patient,” for purposes of CMIA, to mean any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (Civ. Code § 56.05(k).)
- Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code § 56.05(j).)
- Defines “health care service plan” to mean any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975. (Civ. Code § 56.05(g).)
- Defines a “licensed health care professional,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or the Health and Safety Code, as specified. (Civ. Code § 56.05(h).)
- Defines “provider of health care,” for purposes of CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code § 56.05(m).)
- Defines “sensitive services” to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. (Civ. Code § 56.05(p).)
- Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, is deemed a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(a).)
- Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of CMIA. (Civ. Code § 56.06(b).)
- Provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in CMIA. (Civ. Code § 56.06(d)-(e).)
- Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code § 56.36.)
This bill:
- Requires a business, as described in Section 56.06 of the Civil Code, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
- Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information.
- Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state.
- Segregate medical information related to sensitive services from the rest of the patient’s record.
- Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply with this bill to be consistent with existing federal law.
- Exempts an existing EHR system that is substantially customized to fit the individual needs of a health care provider or health care service plan from the requirement specified in 1) above, except that if a substantially customized EHR system is modified, other than for basic maintenance, then 1) above applies.
- Defines “substantially customized” to mean that significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications.
- Prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under 7), below.
- Specifies that the above provisions do not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
- Prohibits a provider of health care, health care service plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
- In accordance with a valid, written authorization that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization, as provided.
- To the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate the CMIA, as provided.
- For the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges, as provided.
- For the purpose of bona fide research. Institutional Review Boards shall consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state, as provided.
- Requires the content of the health records containing medical information described in 7), above, to be disclosed to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act.
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with Section 1543 of the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
COMMENTS
- Stated need for the bill
The author writes:
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. AB 352 prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
- Protections for medical information
HIPAA, enacted in 1996, guarantees privacy protection for individuals with regards to specific health information. (Pub.L. 104–191, 110 Stat. 1936.) Generally, protected health information is any information held by a covered entity which concerns health status, provision of healthcare, or payment for healthcare that can be connected to an individual. HIPAA privacy regulations require healthcare providers and organizations to develop and follow procedures that ensure the confidentiality and security of personal health information when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information, and to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.
CMIA (Civ. Code § 56 et seq.) allows adult patients in California to keep their personal health information confidential and decide whether and when to share that information. These provisions are guided to protect every Californians’ fundamental right to privacy. (Cal. Const., art. I, § 1.) CMIA protects “medical information,” and generally regulates what providers of health care, and health care service plans, can do with such information.
Health Information Exchanges (HIE) are digital services that operate across health organizations to share health care information. HIEs store and exchange information about health conditions, medications, and allergies. It can also include procedures, notes and lab results.[1] Once an organization is part of an exchange, or a member of a health information network, they have access to the information in the exchange based on the policy of the HIE. Information that cannot be exchanged, due to federal regulations, includes substance abuse treatment, which requires written authorization from a patient. (42 U.S.C. 290dd; 82 Fed. Regs. 6115.)
- Reproductive rights
Roe v. Wade was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. ((1973) 410 U.S. 113; overruled by Dobbs v. Jackson Women’s Health (2022) 142 S. Ct. 2228.) Roe has been one of the most debated U.S. Supreme Court decisions and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022 the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe.[2] The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability. (see Miss. Code Ann. §41-41-191.) The majority opinion upholds the Mississippi law finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.[3]
- Out-of-state statutes denying or chilling access to reproductive health care
Texas perniciously enacted a law with an enforcement scheme that was designed to avoid judicial scrutiny of the law’s clearly unconstitutional, at the time of enactment, provisions under the holding of Roe and Casey.[4] Texas abortion providers filed a case in an attempt to stop the law before it took effect seeking pre-enforcement review of the law and an injunction barring its enforcement. On certiorari from the Fifth Circuit, the U.S. Supreme Court held that a pre-enforcement challenge to the law under the U.S. Constitution may only proceed against certain defendants but not others.[5] The court did not address whether the law was constitutionally sound. However, the court’s ruling essentially insulated the private enforcement of the law from challenge, allowing the law to remain in effect. The inability to challenge the law pre-enforcement allows it to stand as an ominous threat to all persons seeking or performing an abortion. This Texas law may very well be found to be constitutional under the holding of Dobbs.
The Texas law prohibits a physician from knowingly performing or inducing an abortion on a pregnant woman if the physician detected a fetal heartbeat for the unborn child, as specified, or failed to perform a test to detect a fetal heartbeat. (Tex. Health & Safety Code § 171.201 et seq. (enacted through Texas Senate Bill 8).) This law essentially places a near-categorical ban on abortions beginning six weeks after a person’s last menstrual period, which is before many people even realize they are pregnant and occurs months before fetal viability.[6] The Texas law has far reaching implications, not only for the person receiving an abortion or performing abortion services. This is evidenced in the provisions that prohibit anyone from “aiding and abetting” a person in obtaining an abortion, which could implicate and impose significant civil liability upon a person providing transportation to or from an abortion clinic, a person donating to a fund to assist individuals receiving an abortion, or even a person who simply discusses getting an abortion with someone. (Tex. Health & Safety Code § 171.208.) The Texas law provides that any person, other than an officer or employee of a state or local governmental entity in Texas, may bring a civil action to enforce its provisions, which includes liability of $10,000 plus costs and fees if a plaintiff prevails while a defendant is prohibited from recovering their own costs and fees if they prevail. (Id. at § 171.201(b) & (i).) Other states have already followed suit.
Additionally, many abortion bans attach criminal and administrative penalties in addition to civil liability. For example, in Texas it is a felony to perform an abortion, unless it is needed to save the life of the patient, and provides for civil liability and licensure revocation. (Tex. Health & Safety Code § 171.201 et. seq.) In six states with abortion bans—Arkansas, Georgia, Idaho, Missouri, North Dakota, and Tennessee—prosecutors can criminally prosecute health care professionals for performing abortions and providers are only allowed to offer evidence that the procedure was necessary to save the patient until after they are charged.[7] Oklahoma made performing an abortion a felony, with a punishment of up to 10 years in prison and a fine of up to $100,000 in August of 2022.[8] This year, the Governor of Idaho signed a bill into law that makes it illegal for an adult to help a minor get an abortion without parental consent. The law essentially bans adults from obtaining abortion pills for a minor or “recruiting, harboring or transporting the pregnant minor” without parental consent.[9] If convicted, a person could face two to five years in prison and may be sued by the minor’s parent.
- California is a Reproductive Freedom State
The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.) This was the first time an individual’s right to abortion was upheld in a court. In 1972 the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1972 gen. elec.) California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.) In 2019 Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation.[10] In September 2021, more than 40 organizations came together to form the California Future Abortion Council (CA FAB) to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians but all who seek care in the state.
In response to the Dobbs decision, California enacted a comprehensive package of legislation expanding, protecting, and strengthening access to reproductive health care, including abortions, for all Californians and people seeking such care in our state.[11] One such law, AB 1666 (Bauer-Kahan, Ch. 42, Stats. 2022) provided that a law of another state that authorizes a person to bring a civil action against a person or entity who receives, seeks, performs, or induces an abortion, or knowingly engages in conduct that aids or abets the performance or inducement of an abortion, or attempts or intends to engage in such conduct, is contrary to the public policy of this state (Gov. Code § 123467.5.) Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
- Out of state bans on gender-affirming care and California policies to protect patients receiving such care
As California and other states have implemented policies to ensure that transgender individuals are not discriminated against and can obtain gender-affirming care, other states have targeted transgender individuals and providers of gender affirming care. According to Human Rights Watch, as of March 2022, legislatures nationwide had introduced over 300 anti-LGBTQ+ bills, over 130 of which specifically targeted transgender people.[12] Many states have been enacting statutes that potentially impose civil and criminal liability for providing to a minor, or helping a minor obtain, gender-affirming care. For example, Alabama recently enacted a bill that makes it a felony to provide, or help to provide, certain types of gender-affirming care.[13] Arkansas prohibits a physician or other healthcare provider from providing or referring certain types of gender-affirming care for a minor; a violation or “threatened violation” can be punished through a professional board or a civil action.[14] SB 107 (Wiener, 2022; Ch. 810, Stats. 2022), among other things, prohibits the sharing of medical records regarding the receipt of gender-affirming care, the enforcement of out-of-state subpoenas seeking information regarding the receipt of gender-affirming medical care in California, and the enforcement of laws of another state that authorize the removal of a child from their parent or guardian and enforcement of out-of-state criminal laws related to gender-affirming health care. On September 29, 2022, Governor Newsom issued a signing statement for SB 107 that said “[i]n California we believe in equality and acceptance. We believe that no one should be prosecuted or persecuted for getting care they need – including gender-affirming care.[15]”
- This bill seeks to provide additional protections to information regarding sensitive services under the CMIA
In response to the assault on reproductive rights and legislation targeting transgender people, this bill seeks to provide increased protections to electronically stored or maintained medical information. The author and sponsors of the bill note that, though California has enacted extensive protections for abortion within the state, there are still major gaps when people come to California for care. Critically, they state that physicians in states that ban abortion can easily see all details of abortion care through health information HIEs – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers. This bill seeks to enact similar provisions to the federal regulations that prohibit the sharing of patient information for substance use disorders. (42 U.S.C. 290dd; 82 Fed. Regs. 6115)
This bill requires any business subject to the CMIA that electronically stores or maintains medical information on the provision of sensitive services to develop capabilities, policies, and procedures, by July 1, 2024 that do all of the following:
- limit user access privileges to information systems that contain such information only to those persons who are authorized to access the information;
- prevent the disclosure, access, transfer, transmission, or processing of such information to persons and entities outside of this state;
- segregate medical information related to sensitive services from the rest of the patient’s record; and
- provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
Sensitive services is defined under the CMIA as all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. (Civ. Code § 56.05(p).)
The bill provides an exception to the above provisions for an existing electronic health records system that is substantially customized to fit the individual needs of a provider of health care or health care service plan. A system is substantially customized if significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications. The bill specifies that any fees charged to providers of health care, health care service plans, pharmaceutical company, contractors, employers, or patients to comply with these provisions must be consistent with federal regulations governing fees for accessing, exchanging, or using electronic health information pursuant to Section 171.302 of Title 45 of the Code of Federal Regulations.
- This bill seeks to provide additional protections to information regarding abortion or abortion-related services
The bill also prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized. The bill specifies that these provisions do not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state.
The bill also prohibits a provider of health care, health care service plan, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized in accordance with specified existing provisions of law. These provisions include granting of access under any of the following conditions:
- In accordance with a valid, written authorization pursuant to Section 56.11 of the Civil Code that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
- To the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient in a way that would violate the CMIA, in accordance with paragraphs (2) and (3) of subdivision (c) of Section 56.10 of the Civil Code.
- For the purpose of accreditation, in reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges, in accordance with paragraphs (4) and (5) of subdivision (c) of Section 56.10 of the Civil Code.
- For the purpose of bona fide research, in accordance with paragraph (7) of subdivision (c) of Section 56.10 of the Civil Code. Institutional Review Boards must consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
- Statements in support
The American College of OB/GYN’s District IX, one of the sponsors of the bill, writes in support:
Given the federal climate, anyone supporting someone in obtaining an abortion could face arrest and extradition under other states’ current law. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California. Critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
AB 352 addresses this problem head-on by preventing information on sexual health abortion, and other sensitive services in health information exchanges from being automatically shared, especially outside of California. Parties must be appropriately authorized to view medical information related to sensitive services.
SUPPORT
American College of Obstetricians and Gynecologists District IX (sponsor)
Planned Parenthood Affiliates of California (sponsor)
Attorney General Rob Bonta
California Nurse Midwives Association (CNMA)
California Pan - Ethnic Health Network
Electronic Frontier Foundation
Lieutenant Governor Eleni Kounalakis
NARAL Pro-Choice California
Oakland Privacy
Planned Parenthood Affiliates of California
OPPOSITION
None received
RELATED LEGISLATION
Pending Legislation:
AB 254 (Bauer-Kahan, 2023) includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA). This bill is currently pending in the Senate Appropriations Committee.
AB 793 (Bonta, 2023) prohibits a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. That bill is currently pending before the Senate Public Safety Committee.
AB 1194 (Carrillo, 2023) provides stronger privacy protections pursuant to the California Consumer Privacy Act where the consumer information relates to specified reproductive health services. This bill is currently pending in the Senate Appropriations Committee.
Prior Legislation:
SR 9 (Skinner, 2023) urges the President of the U.S. and the U.S. Congress to enact federal legislation that guarantees the right to reproductive freedom, including abortion and contraception.
SB 107 (Wiener, Ch. 810, Stats. 2022) enacted various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California.
AB 1666 (Bauer-Kahan, Ch. 42, Stats. 2022) prohibited the enforcement in this state of out-of-state laws authorizing a civil action against a person or entity that receives or seeks, performs or induces, or aids or abets the performance of an abortion, or who attempts or intends to engage in those actions and declares those out-of-state laws to be contrary to the public policy of this state.
AB 2091 (Mia Bonta, Ch. 628, Stats. 2022), among other things, prohibited compelling a person to identify or provide information that would identify an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action.
AB 2223 (Wicks, Ch. 629, Stats. 2022), among other things, provides that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care.
PRIOR VOTES
Assembly Floor (Ayes 64, Noes 12)
Assembly Appropriations Committee (Ayes 11, Noes 4)
Assembly Privacy and Consumer Protection Committee (Ayes 8, Noes 2)
Assembly Health Committee (Ayes 11, Noes 3)
**************
See Health Information Exchange, UCLA, available at https://www.uclahealth.org/patient-resources/support-information/medical-records/health-information-exchange. ↑
Dobbs v. Jackson Women’s Health (2022) 597 U.S. _ (142 S. Ct. 2228) at p. 5, available at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf. ↑
Id. at 77. ↑
See Whole Woman's Health v. Jackson (2021) 142 S. Ct. 522, at 543 (conc. opn. Roberts, C.J., Breyer, Sotomayor, & Kagan) that states Texas has passed a law that is contrary to Roe and Casey because it has “the effect of denying the exercise of what we have held is a right protected under the Federal Constitution” and was “designed to shield its unconstitutional law from judicial review.” (footnote omitted). ↑
Whole Woman's Health v. Jackson (2021) 142 S. Ct. 522, 530. ↑
See Whole Woman's Health v. Jackson (2021) 141 S. Ct. 2494, at 2498 (dis. opn. Sotomayor, Breyer, & Kagan). ↑
Christine Vestal, Some Abortion Bans Put Patients, Doctors at Risk in Emergencies, Pew Trusts (Sept. 1, 2022), available at https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2022/09/01/some-abortion-bans-put-patients-doctors-at-risk-in-emergencies. ↑
Associated Press, Oklahoma governor signs bill making it felony to perform an abortion, NBC News (Apr. 12, 2022), available at https://www.nbcnews.com/news/us-news/oklahoma-governor-signs-bill-making-felony-perform-abortion-rcna24071. ↑
Associated Press, Idaho governor signs law banning adults from helping minors get abortions, The Guardian (April 6, 2023), available at https://www.theguardian.com/us-news/2023/apr/06/idaho-abortion-trafficking-law-governor. ↑
California Proclamation on Reproductive Freedom (May 31, 2019) available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf. ↑
Kristen Hwang, Newsom signs abortion protections into law, CalMatters (Sept. 27, 2022), available at https://calmatters.org/health/2022/09/california-abortion-bills/. ↑
Human Rights Watch, Press Release, ICYMI: As Lawmakers Escalate Attacks on Transgender Youth Across the Country, Some GOP Leaders Stand Up for Transgender Youth (Mar. 24, 2022), https://www.hrc.org/press-releases/icymi-as-lawmakers-escalate-attacks-on-transgender-youth-across-the-country-some-gop-leaders-stand-up-for-transgender-youth (all links current as of August 29, 2022). ↑
See Al. Code, § 26-26-4. ↑
Ark. Stats. §§ 20-9-1502 & 20-9-1504. ↑
Governor’s singing statement on Sen. Bill 107 (2021-22 Reg. Sess.), available at https://www.gov.ca.gov/wp-content/uploads/2022/09/SB-107-SIGNING.pdf?emrc=1a80c5. ↑
ASSEMBLY THIRD READING
ATR Bill Id:AB 352
Author:(Bauer-Kahan)
As Amended Ver:May 18, 2023
Majority vote
SUMMARY
Requires specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless authorized.
Major Provisions
COMMENTS
The federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals' trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as reproductive health information.
- Federal guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. HHSA writes that access to comprehensive reproductive health care services, including abortion care, is essential to individual health and well-being. The HIPAA Privacy Rule supports such access by giving individuals confidence that their PHI including information relating to abortion and other sexual and reproductive health care, will be kept private.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women's Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe vs. Wade and Planned Parenthood vs. Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHSA Office for Civil Rights issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things: a) addresses how federal law and regulations protect individuals’ PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and, b) addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals’ privacy when using period trackers and other health information apps.
- California abortion coverage. According to the California Health Benefits Review Program, under the Reproductive Privacy Act, California law prohibits the State from denying or interfering with a woman's right to choose or obtain an abortion prior to viability of the fetus, or when medically necessary. The state defines viability as the point in a pregnancy when, in the good faith medical judgment of a physician, there is a reasonable likelihood that a fetus will survive outside the uterus without "extraordinary medical measures." Abortion is considered a basic health care service in California.
In May 2021, Texas Governor Greg Abbott (R) signed legislation (S.B. 8) to ban abortion at six weeks of gestation, so early in pregnancy that many people may not even know that they are pregnant. Among other harms, it could force many people to travel dramatically longer distances to obtain abortion care. S.B. 8 has made national news as it allows anyone who is opposed to abortion, regardless of where they live or whether they have any association with a patient, to sue an abortion provider or anyone who helps a patient obtain an abortion, such as by providing financial help or transportation.
This bill prevents information on sexual health, abortion, and other sensitive services in health information exchanges (HIEs) from being automatically shared, especially outside of California. According to the author, there is precedent for protecting sensitive information, even in health care settings. Federal regulations protect the records of substance abuse treatment from being seen without explicit patient consent. Patients are empowered to give and revoke consent to sharing of their substance abuse treatment data. It allows patients to specify who, specifically, can receive that data through an HIE.
According to the Author
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. The author concludes that this bill prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
Arguments in Support
Planned Parenthood Affiliates of California, sponsor, writes that this bill will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services. NARAL Pro-Choice California writes in support that this bill prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to any inquiry or investigation by an individual, agency, or department from another state or federal law enforcement agency that would identify an individual seeking or obtaining an abortion or abortion-related services that are legal in California. Oakland Privacy writes in support that bans and restrictions on healthcare procedures such as abortions and gender-affirming care are a civil rights issue, a privacy issue, and a safety and security issue. These restrictive laws relegate people to being second-class citizens, restricting bodily autonomy, the freedom of interstate travel, and are an invasion of privacy. The Electronic Frontier Foundation, also in support states, patients must feel safe in the hands of their medical providers and should not have to worry that information from their medical record will expose them to investigation or prosecution. As states diverge on the issue of abortion, it is vitally important that California pass this bill to maintain its status as a sanctuary for those seeking abortions and other reproductive care.
Arguments in Opposition
The Right to Life League writes in opposition that this bill shields abortionists and human and child traffickers by further complicating law enforcements’ requests for information and will frustrate enforcement of foreign laws against abortionists, abusers and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
FISCAL COMMENTS
According to the Assembly Appropriations Committee, amendments remove the work of the advisory committee.
Revised fiscal effect: No state costs.
VOTES
ASM HEALTH: 11-3-1
YES: Wood, Aguiar-Curry, Arambula, Boerner Horvath, Wendy Carrillo, Maienschein, McCarty, Rodriguez, Santiago, Villapudua, Weber
NO: Waldron, Vince Fong, Joe Patterson
ABS, ABST OR NV: Flora
ASM PRIVACY AND CONSUMER PROTECTION: 8-2-1
YES: Gabriel, Bauer-Kahan, Bennett, Irwin, Lowenthal, Papan, Wicks, Wilson
NO: Joe Patterson, Vince Fong
ABS, ABST OR NV: Essayli
ASM APPROPRIATIONS: 11-4-1
YES: Holden, Bryan, Calderon, Wendy Carrillo, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega
NO: Megan Dahle, Dixon, Mathis, Sanchez
ABS, ABST OR NV: Robert Rivas
UPDATED
VERSION: May 18, 2023
CONSULTANT: Kristene Mapile / HEALTH / (916) 319-2097 FN: 0000865
Date of Hearing: May 10, 2023
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Chris Holden, Chair
ABPCA Bill Id:AB 352
Author:(Bauer-Kahan) – As Amended Ver:March 23, 2023
Policy Committee: | Health | Vote: | 11 - 3 |
Privacy and Consumer Protection | 8 - 2 | ||
|
|
Urgency: No State Mandated Local Program: Yes Reimbursable: No
SUMMARY:
This bill limits the sharing of information related to sensitive services in electronic health records without specific authorization from the patient. This bill also requires a specified stakeholder advisory group to include providers of sensitive services and to identify policies and procedures to prevent electronic health information related to sensitive services from automatically being shared with individuals and entities in another state.
For the purposes of this bill, “sensitive services” means all health care services related to mental or behavioral health, sexual and reproductive health, substance use disorder, gender affirming care, and intimate partner violence.
FISCAL EFFECT:
The California Health and Human Services Agency (CalHHS), Center for Data Insights and Innovation (CDII) estimates one-time costs potentially in the hundreds of thousands of dollars (General Fund). CDII notes that although the stakeholder advisory group referenced in the bill has completed its responsibilities and no longer exists, CDII could undertake the required activities as part of its Data Exchange Framework Stakeholder Implementation Advisory Committee.
COMMENTS:
- Purpose. This bill is co-sponsored by The American College of Obstetricians and Gynecologists District IX and Planned Parenthood Affiliates of California. According to the author:
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. AB 352 prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
- Data Exchange Framework and Stakeholder Advisory Group. AB 133 (Committee on Budget), Chapter 143, Statutes of 2021, established a data exchange framework and required CalHHS, by July 1, 2022, in consultation with members of a Stakeholder Advisory Group, to finalize a Data Sharing Agreement defining the parties that will be subject to new data exchange rules and establishing a common set of terms, conditions, and obligations to support secure, real-time access to and exchange of health and social services information, in compliance with applicable federal, state, and local laws, regulations, and policies. Beginning January 2024, health care entities are required to participate in the Stakeholder Advisory Group. This bill adds providers of sensitive services to the Stakeholder Advisory Group and requires the group to identify policies and procedures to ensure safeguards that will prevent electronic health information related to sensitive services from automatically being shared with, or accessed by, individuals and entities in another state.
- Related Legislation.
- AB 254 (Bauer-Kahan) revises the Confidentiality of Medical Information Act to include reproductive health application information, as defined, in the statutory definition of “medical information.” AB 254 is pending in this committee.
- AB 1194 (Wendy Carillo) provides that a business is not obligated to comply with a government agency request for emergency access to a consumer’s personal information if the information is related to accessing, procuring or searching for services regarding contraception, pregnancy care and perinatal care, including, but not limited to, abortion services. AB 1194 is pending in this committee.
- AB 254 (Bauer-Kahan) revises the Confidentiality of Medical Information Act to include reproductive health application information, as defined, in the statutory definition of “medical information.” AB 254 is pending in this committee.
- Prior Legislation. AB 2091 (Bonta), Chapter 628, Statutes of 2022, established requirements to protect the private information of individuals who seek or consider an abortion.
Analysis Prepared by: Allegra Kim / APPR. / (916) 319-2081
Date of Hearing: April 25, 2023
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Jesse Gabriel, Chair
ABPCA Bill Id:AB 352 (
Author:Bauer-Kahan) – As Amended Ver:March 23, 2023
SUBJECT: Health information
SYNOPSIS
This is one of three bills being heard in the Committee today that directly seeks to further California’s goal of protecting the intimate, reproductive privacy rights of California residents and those from other jurisdictions who may have come to California to seek abortion care.
This bill is intended to prevent information on abortion care, gender affirming care, and other sensitive services in health information exchanges from being shared without a patient’s permission, especially outside of California. In addition, it requires that parties be appropriately authorized to view medical information related to sensitive services, prior to gaining access to the information.
With the fall of Roe v. Wade, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The state quickly followed the ban by making the providing of an abortion a felony punishable by a fine of up to $100,000 and up to 10 years in prison. Even more alarming, Republicans in South Carolina proposed a bill last month, the South Carolina Prenatal Equal Protection Act, which would allow women who have abortions to be subject to the state’s homicide laws, which include the death penalty or a minimum of 30 years in prison.
Given the actions of so many states to not only ban abortion and gender affirming care within their borders, but to criminalize and punish people who assist someone in obtaining that care, whether within the state or in traveling to another state, taking additional steps to secure sensitive personal medical information related to a person’s reproductive health, especially abortion services, and gender affirming care that could conceivably be used as evidence to convict someone of a crime is essential.
As the examples above demonstrate, it is becoming increasingly dangerous for people to seek abortion services in many parts of the country. This bill furthers California’s goal, as a reproductive freedom state, of protecting people who are seeking abortion services and gender affirming care by securing the information contained in medical records that could be shared electronically and used as evidence in a criminal case against the patient, the provider, or others assisting the person seeking care.
This bill is co-sponsored by The American College of Obstetricians and Gynecologists District IX and Planned Parenthood Affiliates of California, and is a priority bill of the Legislative Women’s Caucus.
The bill previously passed the Health Committee on an 11-3-1 vote.
SUMMARY: Limits the sharing of information related to sensitive services, as defined, in electronic health records, without specific authorization from the patient. Specifically, this bill:
- Requires a business that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
- Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information.
- Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state.
- Segregate medical information related to sensitive services from the rest of the patient’s record.
- Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply with this bill to be consistent with existing federal law.
- Exempts an existing EHR system that is substantially customized to fit the individual needs of a health care provider or health care service plan from the requirement specified 1) above, except that if a substantially customized EHR system is modified, other than for basic maintenance, then 1) above applies.
- Defines “substantially customized” to mean that significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications.
- Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under existing law. Specifies that this bill does not prohibit compliance with the investigation of activity that is punishable as a crime under California laws.
- Prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an EHR system, or through a health information exchange (HIE), that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under California laws to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
- In accordance with a valid, written authorization that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
- To the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient, as specified.
- In reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
- For the purpose of bona fide research and for the Institutional Review Boards to consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
- Requires disclosure of the content of the health records containing medical information described in 6) above to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act.
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
- Specifies that nothing in this bill prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
- Exempts the sharing of information related to sensitive services, as defined and to the extent not in conflict with federal law, from the Data Exchange Framework until policies and procedures are implemented to ensure appropriate safeguards for health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
- Adds sensitive services providers to the list of representatives in the California Health and Human Services Agency (CHHSA) stakeholder advisory group and adds to the existing list of information and advice to the CHHSA on health information technology issues to ensure appropriate safeguards to prevent electronic health information related to sensitive services, from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
EXISTING LAW:
- Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
- Provides that the state shall not deny or interfere with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
- Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
- Prohibits, under the state Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)
- Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. (Civ. Code § 56.05(i).)
- Defines “sensitive services” to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. (Civ. Code § 56.05(p).)
- Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10(a).)
- Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(a).)
- Deems any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(b).)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care. Accordingly, it is the public policy of the State of California that:
- Every individual has the fundamental right to choose or refuse birth control;
- Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions; and,
- The state shall not deny or interfere with a person’s fundamental right to choose to bear a child or to choose to obtain an abortion, except as specifically permitted. (Health & Saf. Code § 123462.)
- Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466(a).)
- States that a person shall not be compelled in a state, county, city, or other local criminal, administrative, legislative, or other proceeding to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion if the information is being requested based on either another state’s laws that interfere with a person’s rights under subdivision (a) or a foreign penal civil action. (Health & Saf. Code § 123466(b).)
FISCAL EFFECT: As currently in print this bill is keyed fiscal.
COMMENTS:
1) Purpose. States across the country are taking unprecedented steps to penalize and bar access to abortion. With Roe v. Wade now fully overturned, abortion access for 33 million women is either criminalized or limited. (Supreme Court Ruling Jeopardizes Abortion Access for 33 Million Women, Bloomberg (Jun. 24, 2022), available at https://www.bloomberg.com/graphics/2022-supreme-court-roe-v-wade-abortion-access/.) Anyone supporting someone in obtaining an abortion could face arrest and extradition under current laws in other states. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California.
Though California has enacted extensive protections for abortion within the state, there are still major gaps when people come to California for care. Critically, physicians in abortion ban states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
This bill is intended to prevent information on abortion care, gender affirming care, and other sensitive services in health information exchanges from being shared without a patient’s permission, especially outside of California. In addition, it requires that parties be appropriately authorized to view medical information related to sensitive services, prior to gaining access to the information.
2) Author’s statement. According to the author:
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. AB 352 prevents the automatic sharing of sensitive information in medical records so that anyone coming to California for care is protected.
3) Health Information Exchanges (HIEs). HIEs are digital services that operate across health organizations to share health care information. Health information exchanges store and exchange information about health conditions, medications, and allergies. It can also include procedures, notes and lab results. Once an organization is part of an exchange, or a member of a health information network, they have access to the information in the exchange based on the policy of the HIE. Because of federal regulations, information that is not exchanged includes substance abuse treatment, which would require written authorization from a patient.
4) Post-Dobbs access to reproductive healthcare is being restricted across the nation. Roe v. Wade (1973) 410 U.S. 113 was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated of all U.S. Supreme Court decisions, and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022 the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe. (Dobbs v. Jackson Women’s Health (2022) 597 U.S. __ (142 S.Ct. 2228), available at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.)
The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability. (See Miss. Code Ann. § 41-41-191.) The majority opinion in Dobbs upholds the Mississippi law, finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.
The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when, and if, to have children and prevented criminalization of the acts of having an abortion or providing an abortion. Prior to Roe, legal abortion did exist in some states, but the choices available to those seeking to terminate an unwanted pregnancy were limited. Restrictions disproportionately affected those who were younger, lower income, and members of communities of color. In the wake of the Dobbs decision, it is very probable that abortion will be banned or severely restricted in 24 states, with 12 states already having near total abortion bans in effect. (Elizabeth Nash and Isabel Guarnieri, Six Months Post-Roe, 24 US States Have Banned Abortion or Are Likely to Do So: A Roundup. Guttmacher Institute (Jan. 10, 2023), available at https://www.guttmacher.org/2023/01/six-months-post-roe-24-us-states-have-banned-abortion-or-are-likely-do-so-roundup.)
With the announcement of the Dobbs decision, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The ban allows an abortion in the case of rape or incest, if the pregnant person reports the crime to law enforcement. In addition, the ban authorizes doctors to remove a "dead unborn child caused by spontaneous abortion," or miscarriage, or to remove an ectopic pregnancy, a potentially life-threatening emergency that occurs when a fertilized egg implants outside the uterus, often in a fallopian tube and early in pregnancy. A second Oklahoma bill went into effect in August 2022, which made performing an abortion a felony, with a punishment of up to 10 years in prison and a fine of up to $100,000. [Associated Press, Oklahoma governor signs the nation’s strictest abortion ban, NPR, (May 26, 2022), available at https://www.npr.org/2022/05/26/1101428347/oklahoma-governor-signs-the-nations-strictest-abortion-ban.)
Most recently, Florida reduced its 15 week abortion ban to six weeks. In response, White House press secretary Karine Jean-Pierre noted:
This ban would prevent four million Florida women of reproductive age from accessing abortion care after six weeks — before many women even know they're pregnant. This ban would also impact the nearly 15 million women of reproductive age who live in abortion-banning states throughout the South, many of whom have previously relied on travel to Florida as an option to access care.
Along with the ban, the Florida legislation includes a particularly cruel provision requiring victims of incest or rape to provide written documentation of the crime in order to obtain an abortion between six and 15 weeks. (Associated Press, Florida has a new abortion ban after 6 weeks, but it can't go into effect yet, NPR, (April 14, 2023) available at https://www.npr.org/2023/04/14/1169933395/florida-gov-desantis-signs-6-week-abortion-ban-bill.)
Not to be outdone, along with an existing ban on abortions after six weeks, earlier this month, the Governor of Idaho signed a bill into law that makes it illegal for an adult to help a minor get an abortion without parental consent. This law is the first of its kind in the nation, creating the new crime of “abortion trafficking” by barring adults from obtaining abortion pills for a minor or “recruiting, harboring or transporting the pregnant minor” without parental consent. Anyone convicted faces two to five years in prison and can be sued by the minor’s parent. However, parents who rape their child will not be able to sue, but the abortion trafficking criminal penalties will still apply. According to a recent Associated Press article, in order to sidestep violating a constitutional right to travel between states, the law makes illegal only the in-state portion of the trip to an out-of-state abortion provider. (Associated Press, Idaho governor signs law banning adults from helping minors get abortions. The Guardian (April 6, 2023), available at https://www.theguardian.com/us-news/2023/apr/06/idaho-abortion-trafficking-law-governor.)
This bill furthers California’s goal, as a reproductive freedom state by protecting people who are traveling from states where abortions and gender affirming care are illegal to California to seek care by ensuring that they are not convicted of a crime when they return home as a result of the information contained in their medical records. If the need to protect this information from other healthcare providers sounds extreme, Republicans in South Carolina proposed a bill last month, the South Carolina Prenatal Equal Protection Act, which would allow women who have abortions to be subject to the state’s homicide laws, which include the death penalty or a minimum of 30 years in prison. (Shabad, S.C. Republicans propose bill that could subject women who have abortions to the death penalty, NBC News (March 15, 2023), available at https://www.nbcnews.com/politics/politics-news/sc-republicans-propose-bill-subject-women-abortions-death-penalty-rcna75060.)
5) California is a reproductive freedom state. The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal. 2d 954.) This was the first time an individual’s right to abortion was upheld in a court and came before the Roe decision. In 1972, the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1927 gen. elec.) California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.) In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation. (California Proclamation on Reproductive Freedom (May 31, 2019), available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf.)
In September 2021, over 40 organizations came together to form the California Future Abortion Council (CA FAB) to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians, but all who seek care in this state. CA FAB issued its first report in December 2021, which included 45 policy recommendations to protect, strengthen, and expand abortion access in California. (California Future of Abortion Council, Recommendations to Protect, Strengthen, and Expand Abortion Care in California (Dec. 2021), available at https://www.cafabcouncil.org/_files/ugd/ddc900_0beac0c75cb54445a230168863566b55.pdf.)
In response to the Dobbs decision and the CA FAB report, California enacted a comprehensive package of legislation, described below, that protects the rights of patients seeking abortion in the state and those supporting them. Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
Last year, several bills were enacted to further protect reproductive rights in California, among them:
1. AB 1242 (Bauer-Kahan, Chap. 627, Stats. 2022) protects reproductive digital information handled by companies incorporated or headquartered in California and prevents the arrest of individuals or the disclosure by law enforcement of information in an investigation related to any abortion that is legal in California.
2. AB 1666 (Bauer-Kahan, Chap. 42, Stats. 2022) declares that a law of another state that authorizes a person to bring a civil action against a person or entity that receives or seeks, performs or induces, or aids or abets the performance of an abortion, or who attempts or intends to engage in those actions, is contrary to the public policy of this state.
3. AB 2091 (Bonta, Chap. 628, Stats. 2022) prohibits a provider of health care, health care service plan, or contractor from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state's laws that interfere with a person's rights set forth in the Reproductive Privacy Act and prohibits the issuance of a subpoena, from the Superior Court or an attorney licensed in California, based on a civil action authorized by the law of a state other than this state in which the sole purpose is to punish an offense against the public justice of that state.
4. AB 2223 (Wicks, Chap. 629, Stats. 2022) prohibits a person from being criminally or civilly liable for miscarriage, stillbirth, abortion, or perinatal death due to causes that occurred in utero.
6) Related legislation. In the current session, AB 254 (Bauer-Kahan) revises the Confidentiality of Medical Information Act (CMIA) to include reproductive health application information, as defined, in the statutory definition of “medical information.” Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified. That bill is currently pending before this Committee.
In the current session, AB 793 (Bonta) prohibits a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. That bill is currently pending before the Assembly Appropriations Committee.
In the current session, AB 1194 (Wendy Carillo) would, if the consumer’s personal information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, require a business to comply with the obligations imposed by the CPRA. It would also specify that a consumer accessing, procuring, or searching for those services does not constitute a natural person being at risk or danger of death or serious physical injury. That bill is currently pending before this Committee.
AB 1242 (Bauer-Kahan, Chap. 627, Stat. 2022) prohibited law enforcement from cooperating with, or providing information to, out-of-state entities regarding a lawful abortion under California law, and from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion. Prohibited specified corporations from providing information to out-of-state entities regarding an abortion that is lawful under California law, except as provided.
AB 2091 (Bonta, Chap. 628, Stat. 2022) established requirements to protect the private information of individuals who seek or consider an abortion.
ARGUMENTS IN SUPPORT: The American College of Obstetricians and Gynecologists District IX, co-sponsors of the bill, write in support:
Given the federal climate, anyone supporting someone in obtaining an abortion could face arrest and extradition under other states’ current law. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California. Critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
AB 352 addresses this problem head-on by preventing information on sexual health abortion, and other sensitive services in health information exchanges from being automatically shared, especially outside of California. Parties must be appropriately authorized to view medical information related to sensitive services.
Echoing the sentiments of their fellow co-sponsor, Planned Parenthood Affiliates of California, also adds:
In the summer of 2022, the U.S. Supreme Court overturned the long-standing legal protections for abortion under Roe v. Wade with its decision in Dobbs v. Jackson Women’s Health Organization. The decision has opened the door for states to ban and criminalize abortion services – impacting patients and providers across the U.S. Currently, 18 states have enacted a ban on abortion services or have severely restricted access to abortion. These efforts to restrict reproductive and abortion rights are intertwined with policies banning trans rights and gender-affirming care, which have been introduced in hostile states across the country.
[. . .]
To continue to meet the needs of patients in California, we must ensure our laws and systems protect abortion providers and patients. In addition to the stigma that already persists around reproductive health care, there is a new layer of legal risk since states have begun criminalizing health care services. AB 352 will ensure that patients can feel confident accessing abortion in California. . . .
ARGUMENTS IN OPPOSITION: In opposition to the bill, the Right to Life League argues:
On behalf of the Right to Life League, we urge you to reject AB 352, a bill that shields abortionists and human and child traffickers by further complicating law enforcements’ requests for information
[. . .]
Its passage will frustrate enforcement of foreign laws against abortionists, abusers and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
REGISTERED SUPPORT / OPPOSITION:
Support
American College of Obstetricians and Gynecologists District Ix (co-sponsor)
Planned Parenthood Affiliates of California (co-sponsor)
CA Legislative Women's Caucus
California Health+advocates, Subsidiary of The California Primary Care Association
California Nurses Association
Electronic Frontier Foundation
NARAL Pro-choice California
Oakland Privacy
Privacy Rights Clearinghouse
Opposition
Right to Life League
Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200
Date of Hearing: April 25, 2023
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Jesse Gabriel, Chair
ABPCA Bill Id:AB 352 (
Author:Bauer-Kahan) – As Amended Ver:March 23, 2023
SUBJECT: Health information
SYNOPSIS
This is one of three bills being heard in the Committee today that directly seeks to further California’s goal of protecting the intimate, reproductive privacy rights of California residents and those from other jurisdictions who may have come to California to seek abortion care.
This bill is intended to prevent information on abortion care, gender affirming care, and other sensitive services in health information exchanges from being shared without a patient’s permission, especially outside of California. In addition, it requires that parties be appropriately authorized to view medical information related to sensitive services, prior to gaining access to the information.
With the fall of Roe v. Wade, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The state quickly followed the ban by making the providing of an abortion a felony punishable by a fine of up to $100,000 and up to 10 years in prison. Even more alarming, Republicans in South Carolina proposed a bill last month, the South Carolina Prenatal Equal Protection Act, which would allow women who have abortions to be subject to the state’s homicide laws, which include the death penalty or a minimum of 30 years in prison.
Given the actions of so many states to not only ban abortion and gender affirming care within their borders, but to criminalize and punish people who assist someone in obtaining that care, whether within the state or in traveling to another state, taking additional steps to secure sensitive personal medical information related to a person’s reproductive health, especially abortion services, and gender affirming care that could conceivably be used as evidence to convict someone of a crime is essential.
As the examples above demonstrate, it is becoming increasingly dangerous for people to seek abortion services in many parts of the country. This bill furthers California’s goal, as a reproductive freedom state, of protecting people who are seeking abortion services and gender affirming care by securing the information contained in medical records that could be shared electronically and used as evidence in a criminal case against the patient, the provider, or others assisting the person seeking care.
This bill is co-sponsored by The American College of Obstetricians and Gynecologists District IX and Planned Parenthood Affiliates of California, and is a priority bill of the Legislative Women’s Caucus.
The bill previously passed the Health Committee on an 11-3-1 vote.
SUMMARY: Limits the sharing of information related to sensitive services, as defined, in electronic health records, without specific authorization from the patient. Specifically, this bill:
- Requires a business that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
- Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information.
- Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state.
- Segregate medical information related to sensitive services from the rest of the patient’s record.
- Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply to comply with this bill to be consistent with existing federal law.
- Exempts an existing EHR system that is substantially customized to fit the individual needs of a health care provider or health care service plan from the requirement specified 1) above, except that if a substantially customized EHR system is modified, other than for basic maintenance, then 1) above applies.
- Defines “substantially customized” to mean that significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications.
- Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under existing law. Specifies that this bill does not prohibit compliance with the investigation of activity that is punishable as a crime under California laws.
- Prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an EHR system, or through a health information exchange (HIE), that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under California laws to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
- In accordance with a valid, written authorization that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization.
- To the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient, as specified.
- In reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
- For the purpose of bona fide research and for the Institutional Review Boards to consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
- Requires disclosure of the content of the health records containing medical information described in 6) above to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act.
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record.
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
- Specifies that nothing in this bill prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
- Exempts the sharing of information related to sensitive services, as defined and to the extent not in conflict with federal law, from the Data Exchange Framework until policies and procedures are implemented to ensure appropriate safeguards for health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
- Adds sensitive services providers to the list of representatives in the California Health and Human Services Agency (CHHSA) stakeholder advisory group and adds to the existing list of information and advice to the CHHSA on health information technology issues to ensure appropriate safeguards to prevent electronic health information related to sensitive services, from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
EXISTING LAW:
- Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
- Provides that the state shall not deny or interfere with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
- Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
- Prohibits, under the state Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)
- Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. (Civ. Code § 56.05(i).)
- Defines “sensitive services” to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. (Civ. Code § 56.05(p).)
- Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10(a).)
- Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(a).)
- Deems any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(b).)
- Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care. Accordingly, it is the public policy of the State of California that:
- Every individual has the fundamental right to choose or refuse birth control;
- Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions; and,
- The state shall not deny or interfere with a person’s fundamental right to choose to bear a child or to choose to obtain an abortion, except as specifically permitted. (Health & Saf. Code § 123462.)
- Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466(a).)
- States that a person shall not be compelled in a state, county, city, or other local criminal, administrative, legislative, or other proceeding to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion if the information is being requested based on either another state’s laws that interfere with a person’s rights under subdivision (a) or a foreign penal civil action. (Health & Saf. Code § 123466(b).)
FISCAL EFFECT: As currently in print this bill is keyed fiscal.
COMMENTS:
1) Purpose. States across the country are taking unprecedented steps to penalize and bar access to abortion. With Roe v. Wade now fully overturned, abortion access for 33 million women is either criminalized or limited. (Supreme Court Ruling Jeopardizes Abortion Access for 33 Million Women, Bloomberg (Jun. 24, 2022), available at https://www.bloomberg.com/graphics/2022-supreme-court-roe-v-wade-abortion-access/.) Anyone supporting someone in obtaining an abortion could face arrest and extradition under current laws in other states. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California.
Though California has enacted extensive protections for abortion within the state, there are still major gaps when people come to California for care. Critically, physicians in abortion ban states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
This bill is intended to prevent information on abortion care, gender affirming care, and other sensitive services in health information exchanges from being shared without a patient’s permission, especially outside of California. In addition, it requires that parties be appropriately authorized to view medical information related to sensitive services, prior to gaining access to the information.
2) Author’s statement. According to the author:
In a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. AB 352 prevents the automatic sharing of sensitive information in medical records so that anyone coming to California for care is protected.
3) Health Information Exchanges. HIEs are digital services that operate across health organizations to share health care information. Health information exchanges store and exchange information about health conditions, medications, and allergies. It can also include procedures, notes and lab results. Once an organization is part of an exchange, or a member of a health information network, they have access to the information in the exchange based on the policy of the HIE. Because of federal regulations, information that is not exchanged includes substance abuse treatment, which would require written authorization from a patient.
4) Post-Dobbs access to reproductive healthcare is being restricted across the nation. Roe v. Wade (1973) 410 U.S. 113 was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated of all U.S. Supreme Court decisions, and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022 the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe. (Dobbs v. Jackson Women’s Health (2022) 597 U.S. __ (142 S.Ct. 2228), available at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.)
The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability. (See Miss. Code Ann. § 41-41-191.) The majority opinion in Dobbs upholds the Mississippi law, finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.
The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when, and if, to have children and prevented criminalization of the acts of having an abortion or providing an abortion. Prior to Roe, legal abortion did exist in some states, but the choices available to those seeking to terminate an unwanted pregnancy were limited. Restrictions disproportionately affected those who were younger, lower income, and members of communities of color. In the wake of the Dobbs decision, it is very probable that abortion will be banned or severely restricted in 24 states, with 12 states already having near total abortion bans in effect. (Elizabeth Nash and Isabel Guarnieri, Six Months Post-Roe, 24 US States Have Banned Abortion or Are Likely to Do So: A Roundup. Guttmacher Institute (Jan. 10, 2023), available at https://www.guttmacher.org/2023/01/six-months-post-roe-24-us-states-have-banned-abortion-or-are-likely-do-so-roundup.)
With the announcement of the Dobbs decision, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The ban allows an abortion in the case of rape or incest, if the pregnant person reports the crime to law enforcement. In addition, the ban authorizes doctors to remove a "dead unborn child caused by spontaneous abortion," or miscarriage, or to remove an ectopic pregnancy, a potentially life-threatening emergency that occurs when a fertilized egg implants outside the uterus, often in a fallopian tube and early in pregnancy. A second Oklahoma bill went into effect in August 2022, which made performing an abortion a felony, with a punishment of up to 10 years in prison and a fine of up to $100,000. [Associated Press, Oklahoma governor signs the nation’s strictest abortion ban, NPR, (May 26, 2022), available at https://www.npr.org/2022/05/26/1101428347/oklahoma-governor-signs-the-nations-strictest-abortion-ban.)
Most recently, Florida reduced its 15 week abortion ban to six weeks. In response, White House press secretary Karine Jean-Pierre noted:
This ban would prevent four million Florida women of reproductive age from accessing abortion care after six weeks — before many women even know they're pregnant. This ban would also impact the nearly 15 million women of reproductive age who live in abortion-banning states throughout the South, many of whom have previously relied on travel to Florida as an option to access care.
Along with the ban, the Florida legislation includes a particularly cruel provision requiring victims of incest or rape to provide written documentation of the crime in order to obtain an abortion between six and 15 weeks. (Associated Press, Florida has a new abortion ban after 6 weeks, but it can't go into effect yet, NPR, (April 14, 2023) available at https://www.npr.org/2023/04/14/1169933395/florida-gov-desantis-signs-6-week-abortion-ban-bill.)
Not to be outdone, along with an existing ban on abortions after six weeks, earlier this month, the Governor of Idaho signed a bill into law that makes it illegal for an adult to help a minor get an abortion without parental consent. This law is the first of its kind in the nation, creating the new crime of “abortion trafficking” by barring adults from obtaining abortion pills for a minor or “recruiting, harboring or transporting the pregnant minor” without parental consent. Anyone convicted faces two to five years in prison and can be sued by the minor’s parent. However, parents who rape their child will not be able to sue, but the abortion trafficking criminal penalties will still apply. According to a recent Associated Press article, in order to sidestep violating a constitutional right to travel between states, the law makes illegal only the in-state portion of the trip to an out-of-state abortion provider. (Associated Press, Idaho governor signs law banning adults from helping minors get abortions. The Guardian (April 6, 2023), available at https://www.theguardian.com/us-news/2023/apr/06/idaho-abortion-trafficking-law-governor.)
This bill furthers California’s goal, as a reproductive freedom state by protecting people who are traveling from states where abortions and gender affirming care are illegal to California to seek care by ensuring that they are not convicted of a crime when they return home as a result of the information contained in their medical records. If the need to protect this information from other healthcare providers sounds extreme, Republicans in South Carolina proposed a bill last month, the South Carolina Prenatal Equal Protection Act, which would allow women who have abortions to be subject to the state’s homicide laws, which include the death penalty or a minimum of 30 years in prison. (Shabad, S.C. Republicans propose bill that could subject women who have abortions to the death penalty, NBC News (March 15, 2023), available at https://www.nbcnews.com/politics/politics-news/sc-republicans-propose-bill-subject-women-abortions-death-penalty-rcna75060.)
5) California is a reproductive freedom state. The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal. 2d 954.) This was the first time an individual’s right to abortion was upheld in a court and came before the Roe decision. In 1972, the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution. (Prop. 11, Nov. 7, 1927 gen. elec.) California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Health & Saf. Code § 123462.) In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation. (California Proclamation on Reproductive Freedom (May 31, 2019), available at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf.)
In September 2021, over 40 organizations came together to form the California Future Abortion Council (CA FAB) to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians, but all who seek care in this state. CA FAB issued its first report in December 2021, which included 45 policy recommendations to protect, strengthen, and expand abortion access in California. (California Future of Abortion Council, Recommendations to Protect, Strengthen, and Expand Abortion Care in California (Dec. 2021), available at https://www.cafabcouncil.org/_files/ugd/ddc900_0beac0c75cb54445a230168863566b55.pdf.)
In response to the Dobbs decision and the CA FAB report, California enacted a comprehensive package of legislation, described below, that protects the rights of patients seeking abortion in the state and those supporting them. Additionally, the voters overwhelmingly approved Proposition 1 (Nov. 8, 2022 gen. elec.), and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.
Last year, several bills were enacted to further protect reproductive rights in California, among them:
1. AB 1242 (Bauer-Kahan, Chap. 627, Stats. 2022) protects reproductive digital information handled by companies incorporated or headquartered in California and prevents the arrest of individuals or the disclosure by law enforcement of information in an investigation related to any abortion that is legal in California.
2. AB 1666 (Bauer-Kahan, Chap. 42, Stats. 2022) declares that a law of another state that authorizes a person to bring a civil action against a person or entity that receives or seeks, performs or induces, or aids or abets the performance of an abortion, or who attempts or intends to engage in those actions, is contrary to the public policy of this state.
3. AB 2091 (Bonta, Chap. 628, Stats. 2022) prohibits a provider of health care, health care service plan, or contractor from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state's laws that interfere with a person's rights set forth in the Reproductive Privacy Act and prohibits the issuance of a subpoena, from the Superior Court or an attorney licensed in California, based on a civil action authorized by the law of a state other than this state in which the sole purpose is to punish an offense against the public justice of that state.
4. AB 2223 (Wicks, Chap. 629, Stats. 2022) prohibits a person from being criminally or civilly liable for miscarriage, stillbirth, abortion, or perinatal death due to causes that occurred in utero.
6) Related legislation. In the current session, AB 254 (Bauer-Kahan) revises the Confidentiality of Medical Information Act (CMIA) to include reproductive health application information, as defined, in the statutory definition of “medical information.” Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified. That bill is currently pending before this Committee.
In the current session, AB 793 (Bonta) prohibits a government entity from seeking or obtaining information from a reverse-location demand or a reverse-keyword demand, and prohibits any person or government entity from complying with a reverse-location demand or a reverse-keyword demand. That bill is currently pending before the Assembly Appropriations Committee.
In the current session, AB 1194 (Wendy Carillo) would, if the consumer’s personal information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, require a business to comply with the obligations imposed by the CPRA. It would also specify that a consumer accessing, procuring, or searching for those services does not constitute a natural person being at risk or danger of death or serious physical injury. That bill is currently pending before this Committee.
AB 1242 (Bauer-Kahan, Chap. 627, Stat. 2022) prohibited law enforcement from cooperating with, or providing information to, out-of-state entities regarding a lawful abortion under California law, and from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion. Prohibited specified corporations from providing information to out-of-state entities regarding an abortion that is lawful under California law, except as provided.
AB 2091 (Bonta, Chap. 628, Stat. 2022) established requirements to protect the private information of individuals who seek or consider an abortion.
ARGUMENTS IN SUPPORT: The American College of Obstetricians and Gynecologists District IX, co-sponsors of the bill, write in support:
Given the federal climate, anyone supporting someone in obtaining an abortion could face arrest and extradition under other states’ current law. The fear of arrest can create a chilling effect, with providers forced to deny care because of the legal peril they face and patients afraid to seek abortion care in California. Critically, physicians in anti-choice states can easily see all details of abortion care through health information exchanges (HIEs) – even if it is unrelated to the patient’s care. This creates the risk that out-of-state providers will report patients to authorities and endanger patients and providers.
AB 352 addresses this problem head-on by preventing information on sexual health abortion, and other sensitive services in health information exchanges from being automatically shared, especially outside of California. Parties must be appropriately authorized to view medical information related to sensitive services.
Echoing the sentiments of their fellow co-sponsor, Planned Parenthood Affiliates of California, also adds:
In the summer of 2022, the U.S. Supreme Court overturned the long-standing legal protections for abortion under Roe v. Wade with its decision in Dobbs v. Jackson Women’s Health Organization. The decision has opened the door for states to ban and criminalize abortion services – impacting patients and providers across the U.S. Currently, 18 states have enacted a ban on abortion services or have severely restricted access to abortion. These efforts to restrict reproductive and abortion rights are intertwined with policies banning trans rights and gender-affirming care, which have been introduced in hostile states across the country.
[. . .]
To continue to meet the needs of patients in California, we must ensure our laws and systems protect abortion providers and patients. In addition to the stigma that already persists around reproductive health care, there is a new layer of legal risk since states have begun criminalizing health care services. AB 352 will ensure that patients can feel confident accessing abortion in California. . . .
ARGUMENTS IN OPPOSITION: In opposition to the bill, the Right to Life League argues:
On behalf of the Right to Life League, we urge you to reject AB 352, a bill that shields abortionists and human and child traffickers by further complicating law enforcements’ requests for information
[. . .]
Its passage will frustrate enforcement of foreign laws against abortionists, abusers and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
REGISTERED SUPPORT / OPPOSITION:
Support
American College of Obstetricians and Gynecologists District Ix (co-sponsor)
Planned Parenthood Affiliates of California (co-sponsor)
CA Legislative Women's Caucus
California Health+advocates, Subsidiary of The California Primary Care Association
California Nurses Association
Electronic Frontier Foundation
NARAL Pro-choice California
Oakland Privacy
Privacy Rights Clearinghouse
Opposition
Right to Life League
Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200
Date of Hearing: April 11, 2023
ASSEMBLY COMMITTEE ON HEALTH
Jim Wood, Chair
ABPCA Bill Id:AB 352
Author:(Bauer-Kahan) – As Amended Ver:March 23, 2023
SUBJECT: Health information.
SUMMARY: Requires specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to sensitive services, as specified. Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or from providing medical information to, an individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual or that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless authorized. Requires the Data Exchange Framework advisory group, to identify policies and procedures to ensure appropriate safeguards to prevent electronic health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state. Exempts health information related to sensitive services from that real time health information sharing requirement, to the extent not in conflict with federal law, until policies and procedures are implemented. Specifically, this bill:
- Deems a business, organized for the purpose of maintaining medical information, as specified, to be a health care provider, that electronically stores or maintains medical information on the provision of sensitive services, including, but not limited to, on an electronic health record (EHR) system or electronic medical record system, as specified, to develop capabilities, policies, and procedures, on or before July 1, 2024, to enable all of the following:
- Limit user access privileges to information systems that contain medical information related to sensitive services only to those persons who are authorized to access specified medical information;
- Prevent the disclosure, access, transfer, transmission, or processing of medical information related to sensitive services to persons and entities outside of this state;
- Segregate medical information related to sensitive services from the rest of the patient’s record; and,
- Provide the ability to automatically disable access to segregated medical information related to sensitive services by individuals and entities in another state.
- Requires any fees charged to health care providers, health care service plans, pharmaceutical companies, contractors, employers, or patients to comply with existing federal law.
- Exempts an existing EHR system that is substantially customized to fit the individual needs of a health care provider or health care service plan from the requirement specified 1) above, except if the substantially customized EHR system is modified, other than for basic maintenance, then 1) above applies. Defines substantially customized to mean significant changes were made to existing off-the-shelf technology, or that a system was entirely custom built by a vendor according to a client’s specifications.
- Prohibits a health care provider, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under existing law. Specifies that this bill does not prohibit compliance with the investigation of activity that is punishable as a crime under California laws.
- Prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from knowingly disclosing, transmitting, transferring, sharing, or granting access to medical information in an EHR system or through a health information exchange (HIE) that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under California laws to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is authorized under any of the following conditions:
- In accordance with a valid, written authorization that clearly states that medical information on abortion or abortion-related services may be disclosed, and only to the extent and for the purposes expressly stated in the authorization;
- To the extent necessary to allow responsibility for payment to be determined and payment to be made or to the extent that it is not further disclosed by the recipient, as specified.
- In reviewing the competence or qualifications of health care professionals, or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges; and,
- For the purpose of bona fide research and for the Institutional Review Boards to consider the potential harm to the patient and the patient’s privacy when the research uses data that contains information related to abortion or abortion-related services and the research is performed out of state.
- Requires disclosure of the content of the health records containing medical information described in 5) above to any of the following:
- A patient, or their personal representative, consistent with the Patient Access to Health Records Act;
- In response to an order of a California or federal court, but only to the extent clearly stated in the order and consistent with the Penal Code, if applicable, and only if all information about the patient’s identity and records are protected from public scrutiny through mechanisms, including, but not limited to, a sealed proceeding or court record; and,
- When expressly required by federal law that preempts California law, but only to the extent expressly required.
- Specifies that nothing in this bill prohibits a health care provider, health care service plan, pharmaceutical company, contractor, or employer from cooperating or complying with the investigation of activity that is punishable as a crime under the laws of California, and that took place in California.
- Exempts the sharing of information related to sensitive services, as defined and to the extent not in conflict with federal law, to the Data Exchange Framework until policies and procedures are implemented to ensure appropriate safeguards for health information related to the provision of sensitive services from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
- Adds sensitive services providers to the list of representatives in the California Health and Human Services Agency (CHHSA) stakeholder advisory group and adds to the existing list of information and advice to the CHHSA on health information technology issues to ensure appropriate safeguards to prevent electronic health information related to sensitive services, from automatically being disclosed, transmitted, or transferred to, shared with, or accessed by, individuals and entities in another state.
EXISTING LAW:
- Establishes the Reproductive Privacy Act, which prohibits the state from denying or interfering with a woman’s right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the woman. [Health and Safety Code (HSC) §123460, et seq.]
- Defines, for purposes of the Confidentiality of Medical Information Act (CMIA), medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Defines individually identifiable information to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. [Civil Code (CIV) §56, et seq.]
- Requires every health care provider, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information to do so in a manner that preserves the confidentiality of the information. Requires any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information to be subject to the remedies and penalties, as specified. Requires an EHR system or electronic medical record system to do the following:
- Protect and preserve the integrity of electronic medical information; and,
- Automatically record and preserve any change or deletion of any electronically stored medical information. [CIV § 56.101]
- Prohibits a health care provider, health care service plan, contractor, or employer from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act or a foreign penal civil action, as defined. Prohibits a health care provider, health care service plan, contractor, or employer from releasing medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited: enforcement of another state’s law that would interfere with a person’s rights under the Reproductive Privacy Act, as specified. [CIV §56.108]
- Defines sensitive services to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence, and includes services as described, and obtained by a patient at or above the minimum age specified for consenting to the service, as specified. [CIV §56.05]
- Requires the CHHSA, on or before July 1, 2022, to establish the California Health and Human Services Data Exchange Framework that is to include a single data-sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require HIE among health care entities and government agencies in California. [HSC §130290]
- Requires a health plan or insurer to accommodate requests for communication in the form and format requested by the individual, if it is readily producible in the requested form and format, or at alternative locations, if the subscriber or enrollee clearly states either that the communication discloses medical information or provider name and address relating to receipt of sensitive services or that disclosure of all or part of the medical information or provider name and address could endanger the subscriber or enrollee. Authorizes a health plan or insurer to require the subscriber or enrollee or insured to make a request for a confidential communication in writing or by electronic transmission. [CIV §56.107 and Insurance Code §791.29]
FISCAL EFFECT: Unknown. This bill has not yet been analyzed by a fiscal committee.
COMMENTS:
- PURPOSE OF THIS BILL. According to the author, in a medical setting, people should never fear that their information will be used against them. Patients who live in states with abortion bans are traveling to access needed care, but those patients risk their safety when they return to their home state. The author concludes that this bill prevents the automatic sharing of sensitive medical information so that anyone coming to California for care is protected.
- BACKGROUND. The federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule provides consumers with important privacy rights and protections with respect to their health information, including important controls over how their health information is used and disclosed by health plans and health care providers. Ensuring strong privacy protections is critical to maintaining individuals’ trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as reproductive health information.
- Federal guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA Privacy Rule protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. HHSA writes that access to comprehensive reproductive health care services, including abortion care, is essential to individual health and well-being. The HIPAA Privacy Rule supports such access by giving individuals confidence that their PHI including information relating to abortion and other sexual and reproductive health care, will be kept private.
In response to the Supreme Court ruling in Dobbs vs. Jackson Women’s Health Organization (the Supreme Court Case that held that the Constitution does not confer a right to abortion; Roe vs. Wade and Planned Parenthood vs. Casey are overruled; and the authority to regulate abortion is returned to the people and their elected representatives), HHSA took action to protect access to sexual and reproductive health care, including abortion, pregnancy complications, and other related care. The HHSA Office for Civil Rights issued guidance to help protect patients seeking reproductive health care, as well as their providers. In general, the guidance does two things: i) addresses how federal law and regulations protect individuals’ PHI relating to abortion and other sexual and reproductive health care, making it clear that providers are not required to disclose private medical information to third parties; and, ii) addresses the extent to which private medical information is protected on personal cell phones and tablets, and provides tips for protecting individuals’ privacy when using period trackers and other health information apps.
- California abortion coverage. According to the California Health Benefits Review Program, under the Reproductive Privacy Act, California law prohibits the State from denying or interfering with a woman’s right to choose or obtain an abortion prior to viability of the fetus, or when medically necessary. The state defines viability as the point in a pregnancy when, in the good faith medical judgment of a physician, there is a reasonable likelihood that a fetus will survive outside the uterus without “extraordinary medical measures.” Abortion is considered a basic health care service in California.
In May 2021, Texas Governor Greg Abbott (R) signed legislation (S.B. 8) to ban abortion at six weeks of gestation, so early in pregnancy that many people may not even know that they are pregnant. Among other harms, it could force many people to travel dramatically longer distances to obtain abortion care. S.B. 8 has made national news as it allows anyone who is opposed to abortion, regardless of where they live or whether they have any association with a patient, to sue an abortion provider or anyone who helps a patient obtain an abortion, such as by providing financial help or transportation.
This bill prevents information on sexual health, abortion, and other sensitive services in HIEs from being automatically shared, especially outside of California. According to the author, there is precedent for protecting sensitive information, even in health care settings. Federal regulations protect the records of substance abuse treatment from being seen without explicit patient consent. Patients are empowered to give and revoke consent to sharing of their substance abuse treatment data. It allows patients to specify who, specifically, can receive that data through an HIE.
- CHHSA Budget Language. AB 133 (Committee on Budget), Chapter 143, Statutes of 2021, established a Data Exchange Framework and required by July 1, 2022, in consultation with members of the Stakeholder Advisory Group, CHHSA to finalize a Data Sharing Agreement defining the parties that will be subject to these new data exchange rules and setting forth a common set of terms, conditions, and obligations to support secure, real-time access to and exchange of health and social services information, in compliance with applicable federal, state, and local laws, regulations, and policies. Beginning January 2024, health care entities are required to participate.
- SUPPORT. Planned Parenthood Affiliates of California, sponsor, writes that this bill will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services.will prevent information related to sexual health care, abortion, and other sensitive services from being automatically shared, especially outside of California, via health information exchange to providers in other states and will require authorization to view medical information related to sensitive services. NARAL Pro-Choice California writes in support that this bill prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with or providing medical information to any inquiry or investigation by an individual, agency, or department from another state or federal law enforcement agency that would identify an individual seeking or obtaining an abortion or abortion-related services that are legal in California. Oakland Privacy writes in support that bans and restrictions on healthcare procedures such as abortions and gender-affirming care are a civil rights issue, a privacy issue, and a safety and security issue. These restrictive laws relegate people to being second-class citizens, restricting bodily autonomy, the freedom of interstate travel, and are an invasion of privacy. The Electronic Frontier Foundation, also in support states, patients must feel safe in the hands of their medical providers and should not have to worry that information from their medical record will expose them to investigation or prosecution. As states diverge on the issue of abortion, it is vitally important that California pass this bill to maintain its status as a sanctuary for those seeking abortions and other reproductive care.
- OPPOSITION. The Right to Life League writes in opposition that this bill shields abortionists and human and child traffickers by further complicating law enforcements’ requests for information and will frustrate enforcement of foreign laws against abortionists, abusers and human traffickers who may flee to California to escape prosecution in other states, thereby denying justice to their victims.
- RELATED LEGISLATION.
- AB 1331 (Wood) establishes the Data Exchange Framework governing board and requires the board to approve any modifications to that data sharing agreement and its policies and procedures. AB 1331 is pending in Assembly Health Committee.
- AB 254 (Bauer-Kahan) revises CMIA to include reproductive or sexual health application information into the definition of medical information. Deems a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual’s information, or for the individual’s diagnosis, treatment, or management of a medical condition, to be a provider of health care, as specified. AB 254 is pending in Assembly Privacy and Consumer Protection Committee.
- AB 1432 (Carrillo) subjects a policy or certificate of group health insurance that is marketed, issued, or delivered to a California resident to any provisions of the Insurance Code requiring coverage of abortion, abortion-related services, and gender-affirming care, regardless of the situs of the contract or master group policyholder. AB 1432 is pending in Assembly Health Committee.
- PREVIOUS LEGISLATION.
- AB 2091 (Mia Bonta), Chapter 628, Statutes of 2022, prohibits compelling a person to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action, as defined. Prohibits a health care provider, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action. Prohibits issuance of a subpoena if the submitted foreign subpoena relates to a foreign penal civil action and the submitted foreign subpoena would require disclosure of information related to sensitive services, as defined.
- SB 245 (Lena Gonzalez), Chapter 11, Statutes of 2022, prohibits a health plan or an individual or group policy or certificate of health insurance or student blanket disability insurance that is issued, amended, renewed, or delivered on or after January 1, 2023, from imposing a deductible, coinsurance, copayment, or any other cost-sharing requirement on coverage for all abortion and abortion-related services, as specified.
- AB 133 (Committee on Budget), Chapter 143, Statutes of 2021, requires CHHSA, and in consultation with stakeholders and local partners through an established Stakeholder Advisory Group, to establish a Data Exchange Framework by July 1, 2022. Requires Covered California, upon appropriation by the Legislature and beginning on or after January 1, 2022, to make payments to qualified health plan issuers that equal the cost of providing abortion services for which federal funding is prohibited to individuals enrolled in a qualified health plan through the Exchange in the individual market. Prohibits the payments from being less than $1 per enrollee per month.
- SB 1053 (Mitchell), Chapter 576, Statutes of 2014, requires, effective January 1, 2016, health plans and insurers to cover a variety of U.S. food and Drug Administration approved contraceptive drugs, devices, and products for women, as well as related counseling and follow-up services and voluntary sterilization procedures. Prohibits cost-sharing, restrictions, or delays in the provision of covered services, but allows cost-sharing and utilization management procedures if a therapeutic equivalent drug or device is offered under the plan or policy with no cost sharing.
- SB 1301 (Sheila Kuehl), Chapter 385, Statutes of 2002, enacts the Reproductive Privacy Act which provides that every individual possesses a fundamental right of privacy with respect to reproductive decisions, including the fundamental right to choose or refuse birth control, and the fundamental right to choose to bear a child or obtain an abortion.
- DOUBLE REFERRAL. This bill has been double-referred; upon passage of this Committee, it will be referred to the Assembly Privacy and Consumer Protection Committee.
- POLICY COMMENTS.
- This bill currently exempts an existing EHR system, as specified, from the requirement that the system limit use access privileges or segregate medical information. As this bill moves forward, the author may wish to address how many systems may be exempted from the requirements of this bill and the impact on the sharing of sensitive services information.
- This bill requires specified businesses to segregate and limit access privileges to information systems that contain sensitive services health information. The sensitive services definition in this bill refers to existing law that not only include abortion services, but also all health care services related to mental or behavioral health, other sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. It is unclear whether the provisions of this bill will have an impact to patient care, for example, as a barrier to a health care provider’s access to a patient’s medical history when developing a treatment plan. The author should consider whether the sensitive services information specified in this bill is too broad.
- This bill prohibits the sharing of sensitive services health information until CHHSA implements policies and procedures to ensure appropriate safeguards. CHHSA’s Data Exchange Framework: Single Data Sharing Agreement contains provisions that require each participant to comply with all applicable law (for example, HIPAA and CMIA) relating to the agreement and the use of health and social services information. It is unclear whether changes to Data Exchange Framework policies and procedures are necessary if participants are subject to the provisions of this bill under CMIA.
REGISTERED SUPPORT / OPPOSITION:
Support
American College of OB/GYN’s District IX (cosponsor)
Planned Parenthood Affiliates of California (cosponsor)
California Nurses Association
Electronic Frontier Foundation
Naral Pro-Choice California
Oakland Privacy
Opposition
Right to Life League
Analysis Prepared by: Kristene Mapile / HEALTH / (916) 319-2097
Discussed in Hearing
50SEC
Assembly Floor
3MIN
Senate Floor
8MIN
Senate Standing Committee on Health
6MIN
Senate Standing Committee on Judiciary
1MIN
Assembly Floor
8MIN
Assembly Standing Committee on Privacy and Consumer Protection
15MIN
Assembly Standing Committee on Health
Bill Author
Bill Co-Author(s):
