Covered California: data sharing.

Existing federal law, the Patient Protection and Affordable Care Act (PPACA) , requires each state to establish an American Health Benefit Exchange to facilitate the purchase of qualified health benefit plans by qualified individuals and qualified small employers. Existing state law creates the California Health Benefit Exchange (Exchange) , also known as Covered California, to facilitate the enrollment of qualified individuals and qualified small employers in qualified health plans as required under PPACA. Existing law requires the Exchange, beginning no later than September 1, 2023, and at least monthly thereafter, to request from the Employment Development Department (EDD) specified information of each new applicant for unemployment compensation, state disability, and paid family leave. Existing law requires the EDD to provide that information in a manner prescribed by the Exchange. Existing law requires the Exchange to market and publicize the availability of health care coverage through the Exchange, and engage in outreach activities, to the individuals whose contact information is received by the Exchange from the EDD, as specified. Existing law prohibits the Exchange from disclosing the personal information obtained from the EDD without the consent of the applicant. This bill would prohibit the disclosure of information by the Exchange to a certified insurance agent, a certified employment counselor, or any other entity without the consent of the applicant, except as provided. The bill would authorize the Exchange to disclose information obtained from the EDD to outreach and marketing vendors under contract to the Exchange. The bill would require outreach and marketing conducted pursuant to these provisions to include, in a conspicuous and easy to access manner, the ability for individuals to decline all future outreach and marketing. The bill would require the Exchange to only request from the EDD, use, or disclose the minimum amount of information necessary to accomplish the purposes for which it was obtained. The bill would require a person or entity that receives information from the Exchange pursuant to these provisions to take all necessary measures to safeguard the confidentiality of any information obtained from the Exchange and would prohibit a person or entity from using or disclosing that information for any purpose other than to market and publicize the availability of health care coverage through the Exchange to individuals, as directed by the Exchange. The bill would require a person or entity to only request from the Exchange, use, or disclose the minimum amount of information necessary to accomplish the purposes for which it was received. The bill would require information received by the Exchange from the EDD to be destroyed in a manner that maintains confidentiality. The bill would require the Exchange to ensure that information disclosed to outreach and marketing vendors or any other entity pursuant to these provisions (1) complies with applicable privacy and information security-related requirements arising under both federal and state law and (2) be destroyed in a manner that maintains confidentiality. The bill also would make conforming changes to a related provision.