Confidentiality of Medical Information Act.

The Confidentiality of Medical Information Act prohibits specified entities from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, unless a specified exception applies. The act, with specified exceptions, prohibits an employer from using, disclosing, or knowingly permitting its employees or agents to use or disclose medical information that the employer possesses pertaining to its employees without the prescribed permission of the patient. Existing law makes a violation of these provisions a crime. The Insurance Information and Privacy Protection Act generally regulates how insurers collect, use, and disclose information gathered in connection with insurance transactions. The Confidentiality of Medical Information Act and the Insurance Information and Privacy Protection Act specify the manner in which a health care service plan or health insurer is required to maintain confidentiality of medical information regarding the treatment of an insured, subscriber, or enrollee, including requiring a health care service plan or health insurer to accommodate requests by insureds, subscribers, and enrollees to receive requests for confidential communication of medical information in situations involving sensitive services or situations in which disclosure would endanger the individual. This bill would revise and recast these provisions. The bill would prohibit a health care service plan or health insurer from requiring a protected individual, as defined, to obtain the policyholder, primary subscriber, or other enrollee's authorization to receive health care services or to submit a claim if the protected individual has the right to consent to care. The bill would require the health care service plan or health insurer to direct all communications regarding a protected individual's receipt of sensitive health care services directly to the protected individual, and would prohibit the disclosure of that information to the policyholder, primary subscriber, or any plan enrollees without the authorization of the protected individual, as provided. The bill would also require the health care service plan or health insurer to accommodate requests by insureds, subscribers, and enrollees to receive requests for confidential communication of medical information regardless of whether there is a situation involving sensitive services or a situation in which disclosure would endanger the individual. Because a violation of these provisions by a health care service plan would be a crime, and because this bill would expand the scope of a crime, the bill would create a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.