Amended IN Assembly March 24, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 894Introduced by Assembly Member CarrilloFebruary 19, 2025 An act relating to health and care facilities. An act to add Section 1275.9 to the Health and Safety Code, relating to health facilities.LEGISLATIVE COUNSEL'S DIGESTAB 894, as amended, Carrillo. Health facilities: immigration and patient privacy. General acute care hospitals: patient directories.Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals. Existing law makes a violation of these provisions a crime.Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), authorizes a covered health care provider to use specified protected health information to maintain a directory of patients in its facility, and to disclose that information to persons who ask for the patient by name. Existing federal law requires a covered health care provider to inform an individual of the use and disclosure of information in the directory and to provide the patient with the opportunity to restrict or prohibit that use or disclosure.Existing law, the Confidentiality of Medical Information Act, prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, but does not prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing a patients name, address, age, and sex, and a general description of the reason for treatment, among other information, unless there is a specific written request by the patient to the contrary.This bill would require a general acute care hospital to inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory by using a separate document or having hospital personnel verbally inform the patient, as specified. Because a violation of the bills requirements would be a crime, this bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals, acute psychiatric hospitals, and skilled nursing facilities, and clinics. Existing law makes a violation of these provisions a crime.The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would state the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NOYES Bill TextThe people of the State of California do enact as follows:SECTION 1. Section 1275.9 is added to the Health and Safety Code, to read:1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.SEC. 2. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.SECTION 1.It is the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.
Amended IN Assembly March 24, 2025 CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 894Introduced by Assembly Member CarrilloFebruary 19, 2025 An act relating to health and care facilities. An act to add Section 1275.9 to the Health and Safety Code, relating to health facilities.LEGISLATIVE COUNSEL'S DIGESTAB 894, as amended, Carrillo. Health facilities: immigration and patient privacy. General acute care hospitals: patient directories.Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals. Existing law makes a violation of these provisions a crime.Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), authorizes a covered health care provider to use specified protected health information to maintain a directory of patients in its facility, and to disclose that information to persons who ask for the patient by name. Existing federal law requires a covered health care provider to inform an individual of the use and disclosure of information in the directory and to provide the patient with the opportunity to restrict or prohibit that use or disclosure.Existing law, the Confidentiality of Medical Information Act, prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, but does not prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing a patients name, address, age, and sex, and a general description of the reason for treatment, among other information, unless there is a specific written request by the patient to the contrary.This bill would require a general acute care hospital to inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory by using a separate document or having hospital personnel verbally inform the patient, as specified. Because a violation of the bills requirements would be a crime, this bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals, acute psychiatric hospitals, and skilled nursing facilities, and clinics. Existing law makes a violation of these provisions a crime.The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would state the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NOYES Local Program: NOYES
Amended IN Assembly March 24, 2025
Amended IN Assembly March 24, 2025
CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION
Assembly Bill
No. 894
Introduced by Assembly Member CarrilloFebruary 19, 2025
Introduced by Assembly Member Carrillo
February 19, 2025
An act relating to health and care facilities. An act to add Section 1275.9 to the Health and Safety Code, relating to health facilities.
LEGISLATIVE COUNSEL'S DIGEST
## LEGISLATIVE COUNSEL'S DIGEST
AB 894, as amended, Carrillo. Health facilities: immigration and patient privacy. General acute care hospitals: patient directories.
Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals. Existing law makes a violation of these provisions a crime.Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), authorizes a covered health care provider to use specified protected health information to maintain a directory of patients in its facility, and to disclose that information to persons who ask for the patient by name. Existing federal law requires a covered health care provider to inform an individual of the use and disclosure of information in the directory and to provide the patient with the opportunity to restrict or prohibit that use or disclosure.Existing law, the Confidentiality of Medical Information Act, prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, but does not prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing a patients name, address, age, and sex, and a general description of the reason for treatment, among other information, unless there is a specific written request by the patient to the contrary.This bill would require a general acute care hospital to inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory by using a separate document or having hospital personnel verbally inform the patient, as specified. Because a violation of the bills requirements would be a crime, this bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals, acute psychiatric hospitals, and skilled nursing facilities, and clinics. Existing law makes a violation of these provisions a crime.The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would state the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.
Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals. Existing law makes a violation of these provisions a crime.
Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), authorizes a covered health care provider to use specified protected health information to maintain a directory of patients in its facility, and to disclose that information to persons who ask for the patient by name. Existing federal law requires a covered health care provider to inform an individual of the use and disclosure of information in the directory and to provide the patient with the opportunity to restrict or prohibit that use or disclosure.
Existing law, the Confidentiality of Medical Information Act, prohibits a health care provider, a contractor, or a health care service plan from disclosing medical information, as defined, but does not prevent a general acute care hospital, upon an inquiry concerning a specific patient, from releasing a patients name, address, age, and sex, and a general description of the reason for treatment, among other information, unless there is a specific written request by the patient to the contrary.
This bill would require a general acute care hospital to inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory by using a separate document or having hospital personnel verbally inform the patient, as specified. Because a violation of the bills requirements would be a crime, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law requires the State Department of Public Health to license and regulate health facilities, including general acute care hospitals, acute psychiatric hospitals, and skilled nursing facilities, and clinics. Existing law makes a violation of these provisions a crime.
The Confidentiality of Medical Information Act (CMIA) prohibits a provider of health care, a health care service plan, a contractor, or a corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.
This bill would state the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.
## Digest Key
## Bill Text
The people of the State of California do enact as follows:SECTION 1. Section 1275.9 is added to the Health and Safety Code, to read:1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.SEC. 2. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.SECTION 1.It is the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.
The people of the State of California do enact as follows:
## The people of the State of California do enact as follows:
SECTION 1. Section 1275.9 is added to the Health and Safety Code, to read:1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.
SECTION 1. Section 1275.9 is added to the Health and Safety Code, to read:
### SECTION 1.
1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.
1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.
1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.(2) Having hospital personnel verbally inform the patient.(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.
1275.9. (a) A general acute care hospital shall inform a patient, at the time of admitting, or at the earliest time possible in cases of patient incapacity or an emergency treatment circumstance, that the patient may restrict or prohibit the use or disclosure of protected health information in the hospitals patient directory, as provided in Section 164.510 of Title 45 of the Code of Federal Regulations, in either of the following manners:
(1) Using a separate document that only includes information regarding the hospitals directory and the included protected health information. The separate document shall include check boxes for the patient to mark whether they authorize or restrict or prohibit use or disclosure of the protected health information in the hospitals patient directory.
(2) Having hospital personnel verbally inform the patient.
(b) The information required pursuant to subdivision (a) shall be made available or provided in the top five languages, other than English, in the hospitals service area.
SEC. 2. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 2. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SEC. 2. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
### SEC. 2.
It is the intent of the Legislature to enact legislation to protect the privacy of undocumented Californians in hospitals.