BILL NUMBER: SB 974INTRODUCED BILL TEXT INTRODUCED BY Senator Anderson (Coauthor: Senator Torres) FEBRUARY 11, 2014 An act to add Section 100509 to the Government Code, relating to health care coverage, and declaring the urgency thereof, to take effect immediately. LEGISLATIVE COUNSEL'S DIGEST SB 974, as introduced, Anderson. California Health Benefit Exchange: confidentiality of personal information. Existing law, the federal Patient Protection and Affordable Care Act (PPACA), requires each state to establish an American Health Benefit Exchange by January 1, 2014, that makes available qualified health plans to qualified individuals and small employers. PPACA prohibits an Exchange from using or disclosing the personally identifiable information it creates or collects other than to the extent necessary to carry out specified functions. Existing law also requires an Exchange to establish and implement privacy and security standards that are consistent with specified principles and to require the same or more stringent privacy and security standards as a condition of contract or agreement with individuals or entities. A person who knowingly and willfully uses or discloses information in violation of PPACA is subject to a civil penalty of no more than $25,000 per person or entity, per use or disclosure, in additional to any other penalties prescribed by law. Existing state law establishes the California Health Benefit Exchange within state government, specifies the powers and duties of the board governing the Exchange, and requires the board to facilitate the purchase of qualified health plans through the Exchange by qualified individuals and small employers by January 1, 2014. Existing law requires the board to employ necessary staff and authorizes the board to enter into contracts. Under existing law, the board of the Exchange is required to submit fingerprint images to the Department of Justice for all employees, prospective employees, contractors, subcontractors, volunteers, or vendors of the Exchange whose duties include access to specified personal information for the purposes of obtaining state or federal conviction records, as specified. This bill would prohibit the Exchange, or any of its employees, agents, subcontractors, representatives, or partners from disclosing an individual's personal information, as defined, to any other person or entity without explicit permission from the individual. The bill would also require the Exchange to report a disclosure of personal information in violation of these provisions to the individuals affected and to the appropriate policy committees of the Legislature within 5 business days of the date the disclosure is discovered. This bill would declare that it is to take effect immediately as an urgency statute. Vote: 2/3. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 100509 is added to the Government Code, to read: 100509. (a) The Exchange, or any of its employees, agents, subcontractors, representatives, or partners, shall not disclose an individual's personal information to any other person or entity without explicit permission from the individual. (b) If the Exchange discovers that personal information has been disclosed in violation of subdivision (a), the Exchange shall report the incident to the individuals affected and to the appropriate policy committees of the Legislature within five business days of the date the disclosure is discovered. (c) For purposes of this section, "personal information" means any information that an individual has submitted to the Exchange through the Exchange's Internet Web site, call center, or other technology, or in person through the Exchange's employees, agents, subcontractors, representatives, or partners. SEC. 2. This act is an urgency statute necessary for the immediate preservation of the public peace, health, or safety within the meaning of Article IV of the Constitution and shall go into immediate effect. The facts constituting the necessity are: Protecting Californian's privacy rights is of the utmost importance, and in order to protect the privacy rights of individuals applying for health care coverage through the California Health Benefit Exchange at the earliest possible time, it is necessary that this act take effect immediately.