BILL ANALYSIS
SENATE JUDICIARY COMMITTEE
Adam B. Schiff, Chairman
1999-2000 Regular Session
SB 1596 S
Senator Ortiz B
As Amended March 23, 2000
Hearing Date: April 25, 2000 1
Health and Safety Code 5
DLM 9
6
SUBJECT
Health Reporting: Confidential Information
DESCRIPTION
This bill would prevent the release of information
contained in the California Cancer Registry, the birth
defects registry, and data collected in morbidity and
mortality studies. Specifically, the major provisions of
this bill declare that:
All data procured by the Department of Health Services in
connection with morbidity and mortality studies, the
California birth defects and California cancer
registries, shall be confidential and shall be used
solely for statistical, scientific, and medical research
purposes relating to the cause or condition of health.
Before confidential data are disclosed, the requesting
entity shall demonstrate to the department that the
entity has established procedures and the ability to
maintain the confidentiality of the information.
Any disclosure authorized by this section shall include
only the information necessary for the stated purpose of
the requested disclosure, and shall be made only upon
agreement that the information will be kept confidential
and will not be further disclosed without written
authorization of the department.
No part of the confidential data shall be available for
(more)
SB 1596 (Ortiz)
Page 2
subpoena nor shall it be disclosed, discoverable, or
compelled to be produced in any civil, criminal,
administrative, or other proceeding, nor shall these data
be deemed admissible as evidence in any civil, criminal,
administrative, or other tribunal or court for any
reason.
The bill would provide that any person who intentionally
discloses confidential data to any unauthorized third party
shall be subject to a civil penalty in an amount of five
hundred dollars ($500) and may be denied further access to
confidential data maintained by the department.
BACKGROUND
This bill comes in response to the recent spat of tobacco
related lawsuits. According to the Department of Health
Services, (DHS) the Department has received three subpoenas
for personal, medical information on lung cancer patients.
The Department has challenged the subpoenas in court and
the courts have reached conflicting decisions; one state
court rejected the subpoena, however, two federal courts
interpreting state law court ordered the data to be turned
over.
To date, Georgia, Louisiana, and Massachusetts have adopted
specific statutes prohibiting the subpoena of data
collected for health studies.
CHANGES TO EXISTING LAW
1. Existing law , Health and Safety Code Section (H&S)
100330, directs the department to conduct special
investigations of the sources of morbidity and mortality,
and provides that all records of interviews, written
reports, and statements procured by the department or by
any other person, agency, or organization acting jointly
with the department, in connection with special morbidity
and mortality studies shall be confidential insofar as
the identity of the individual patient is concerned and
shall be used solely for the purpose of the study.
Existing law directs the Department of Health
Services to conduct
epidemiological studies of the incidence of cancer and to
SB 1596 (Ortiz)
Page 3
identify cancer causes and remedies, and requires that
all information reported pursuant to this section shall
be confidential as provided in Section 100330, with
specified exceptions.
Existing law , Health and Safety Code Section 103825 et
seq. directs the department to maintain a system for the
collection of data concerning birth defects. Section
103850 contains confidentiality provisions specific to
the birth defects monitoring data which provides that:
All information collected and analyzed pursuant to
this chapter shall be confidential insofar as the
identity of the individual patient is concerned and
shall be used solely for the purposes provided in this
chapter.
Access to the information shall be limited to
authorized program staff, and persons with a valid
scientific interest, who meet qualifications as
determined by the director, who are engaged in
demographic, epidemiological or other similar studies
related to health, and who agree, in writing, to
maintain confidentiality.
This bill would create a scheme for confidential
information for information contained in the Morbidity
and Cancer Registries under H&S Section 100330. The
scheme for the Birth Defects Registry is only slightly
different in recognition of variances in data collection
methodology. The new confidential information provisions
include the following:
All data consisting of all records of interviews,
questionnaires, written reports, statements, notes,
and memoranda procured by the department or by any
other person, agency, or organization acting jointly
with the department, including public or private
colleges and universities, in connection with
morbidity and mortality studies and research
investigations to determine any cause or condition of
health shall be confidential and shall be used solely
for statistical, scientific, and medical research
purposes relating to the cause or condition of health,
except as otherwise provided in this section.
SB 1596 (Ortiz)
Page 4
Before confidential data are disclosed to any other
person, agency, or organization acting jointly with
the department, the requesting entity shall
demonstrate to the department that the entity has
established procedures and the ability to maintain the
confidentiality of the information.
Any disclosure authorized by this section shall
include only the information necessary for the stated
purpose of the requested disclosure, and shall be made
only upon agreement that the information will be kept
confidential and will not be further disclosed without
written authorization of the department.
Before confidential data are disclosed to any other
person, agency, or organization acting jointly with
the department, the requesting entity shall
demonstrate to the department that the entity has
established procedures and the ability to maintain the
confidentiality of the information.
All confidential data may be used by the department
when necessary for the purpose of controlling
nuisances dangerous to the public health including,
but not limited to, communicable, contagious, and
infectious diseases.
Confidential data may be disclosed to other local,
state, or federal public health or environmental
agencies, or to collaborating medical researchers,
when the confidential information is necessary to
carry out the duties of the agency or researcher in
the investigation, control, or surveillance of
disease, as determined by the department.
Any disclosure authorized by this section shall
include only the information necessary for the stated
purpose of the requested disclosure, and shall be made
only upon agreement that the information will be kept
confidential and will not be further disclosed without
written authorization of the department.
No part of the confidential data shall be available
for subpoena nor shall it be disclosed, discoverable,
SB 1596 (Ortiz)
Page 5
or compelled to be produced in any civil, criminal,
administrative, or other proceeding, nor shall these
data be deemed admissible as evidence in any civil,
criminal, administrative, or other tribunal or court
for any reason.
2. Existing law provides for a civil penalty of $500 on
any person who intentionally discloses confidential
information to any unauthorized third party relating to
the birth defects registry.
This bill would provide that any person who intentionally
discloses confidential data to any third party relating
to morbidity and mortality studies and the birth defect
and cancer registries, shall be subject to a civil
penalty in an amount of five hundred dollars ($500) and
may be denied further access to confidential data
maintained by the department.
This bill would further provide that nothing in this
section shall be construed to limit or expand the right
of an injured subject to recover damages under any other
applicable law.
COMMENT
1. Stated need for legislation and support
According to the bill's sponsor, the Department of Health
Services,
"(E)xisting statutes were written prior to the
cross-tabulating power of current computer software.
With improved ability of computer data linkage with
demographic information, redaction of patient's names and
addresses is insufficient to protect individual
confidentiality?Successful operation of the California
Cancer Registry and other health data collection efforts
depends upon uninterrupted and absolute confidentiality
of patient's medical records and research data. Important
health research, much of which is based upon the data
collected and maintained by the Department, will be
threatened if health care providers and hospitals cannot
be assured that confidentiality will be maintained."
Dr. Hoda Anton-Culver, Director of the Cancer
Surveillance Programs of Orange, San Diego and Imperial
SB 1596 (Ortiz)
Page 6
Counties, writes in support, " (P)rotecting a patient's
medical and personal information from subpoena in legal
procedures is essential to patient's trust and voluntary
participation in medical research studies. Without the
protection of confidential medical and personal
information collected in cancer research studies, the
voluntary participation of patients in significant
studies and the causes of cancer in California and
nationwide would be placed in great jeopardy."
2. Concern: will this impede legitimate flow of
information?
The Consumer Attorneys of California (CAOC) have
expressed concern that this bill could result in relevant
causation information becoming inaccessible to litigants
in court proceedings. They ask, how is one to challenge
the validity of a study, when the raw data is not
available for a competing analysis? CAOC has agreed to
work with the author's office to resolve this issue.
3. Should the bill adopt existing medical record
confidentiality definitions?
The Confidentiality of Medical Information Act (CMIA)
contained in the Civil Code provides a definition of
medical information, and personal identifying
information. "Medical information" means any individually
identifiable information, in electronic or physical form,
in possession of or derived from a provider of health
care or health care service plan regarding a patient's
medical history, mental or physical condition, or
treatment. "Individually identifiable" means that the
medical information includes or contains any element of
personal identifying information sufficient to allow
identification of the individual, such as the patient's
name, address, electronic mail address, telephone number,
or social security number, or other information that,
alone or in combination with other publicly available
information, reveals the individual's identity.
The definition of "individually identifiable" medical
information came as the result of work done last year on
medical privacy by The Medical Privacy Task Force. This
group contained representatives from the Governor's
SB 1596 (Ortiz)
Page 7
Office, both houses of the Legislature, industry, and
state agencies. The Task Force work product was reflected
in SB 19 (Figueroa) of last year. That bill, amongst its
many medical privacy provisions, created the above
definition of "individually identifiable." In creating
this definition, the Task Force anticipated the issue
raised in this bill; how to prevent reconstruction of
information from multiple sources, which could thwart
patient privacy measures. That is why there is reference
to information which may be used in combination with
other data to reconstruct files, and therefore reveal the
patients' identity.
Perhaps the author might wish to reference this existing
definition, and with this change, allow the information
to be used in civil discovery. Any information, which
would be released if the bill were so amended, would
remain confidential. This amendment would have the
result of protecting the names of the individual patients
from being ascertained, which is the intended purpose of
the bill. Another benefit of adopting the existing CMIA
definition is that it would allow the release of data in
redacted form, which would allow for legitimate
investigation and scientific challenges brought against
causation studies. In addition, the amendment would seem
consistent with the existing policy regarding access to
personal patient information contained in morbidity
studies, discussed in Comment 4, below.
SHOULD THE BILL BE AMENDED TO USE THE CMIA DEFINITION OF
INDIVIDUALLY IDENTIFIABLE INFORMATION, AND TO ALLOW THE
RELEASE OF CONFIDENTIAL DATA PURSUANT TO A DISCOVERY
REQUEST?
4. SB 1596 conflicts with Evidence Code, which allows
discovery of redacted patient information contained in
morbidity studies
The Evidence Code contains an exemption from discovery of
the identity of any patient, unless the patient consents
to such disclosure. Section 1156 of the Evidence Code
provides that the written records of interviews, reports,
statements, or memoranda of in-hospital medical or
medical-dental staff committees relating to morbidity
studies are subject to civil discovery proceedings, but,
SB 1596 (Ortiz)
Page 8
the identity of individual patients may not be revealed
unless with the patient's consent.
This section does not affect the admissibility in
evidence of the original medical or dental records of any
patient and does not exclude evidence, which is relevant
evidence in a criminal action.
While there was no legislative history which this analyst
could find on point, it would seem from the construction
that the drafters of Section 1156 intended to protect the
identity of individual patients when their names were
part of in-hospital morbidity studies. It would also
seem that the drafters intended to allow the use of the
patient's information when the patient's name is known,
and the records are relevant to a civil matter.
SB 1596 would be an expansion of the privacy protections
contained in existing law relative to morbidity studies.
This is because it would prohibit the release of any
data, whether redacted or not, pursuant to subpoena.
5. Further background
The sponsor provided the Committee with this history of
recent litigation battles over privacy of data contained
in the Cancer Registry. "Recently, DHS and its
contractors, were subpoenaed in three different court
cases for raw data that contain personally identifying
information. The subpoenaing parties claimed they need
the raw data in order to verify the accuracy of research
studies cited against them in court. Even though current
California law provides that personally identifying data
in the cancer registry, birth defects registry, and
morbidity and mortality studies is confidential and to be
used solely for research purposes, two of the three
courts ordered disclosure of the raw data, subject to
redaction of information that the court deemed personally
identifying and a protective order.
"In Broin v. Philip Morris, in July 1997, Judge David
Garcia in the Superior Court of California in and for the
County of San Francisco granted DHS's motion to quash the
subpoena because 'Health and Safety Code Section 100330
SB 1596 (Ortiz)
Page 9
and federal laws forbid the disclosure of the sought
after raw data. Further disclosure is contrary to state
law. The computer data tape which Philip Morris seeks
consists of data particular to individual cases, and
redaction is inadequate to maintain the required
confidentiality.'
"However, in Wolpin v. Philip Morris, in September 1998,
a magistrate judge granted the subpoenaing party's motion
to compel production, subject to certain conditions. In
February 1999, Judge Richard Paez in the United States
District Court in the Central District of California
denied DHS' contractor's motion for review and
reconsideration of the magistrate judge's order. The
court held that 'general statutory prohibitions against
disclosure of information do not bar judicial discovery
absent an express prohibition against such disclosure'
and 'in the absence of express prohibitions against
production in a legal proceeding, confidentiality
provisions, at least in federal statutes, should be
narrowly construed.' The court noted that 'the
California legislature has elsewhere adopted specific
safeguards protecting confidential medical information
from discovery. For example, information concerning
persons with AIDS is not discoverable in any
administrative, civil, or criminal proceeding (HSC
120975, 121025). Sections 100330 and 103885 have no such
explicit prohibitions.'
"In Murphy v. Philip Morris, in March 2000, Judge Jeffery
Johnson in the United States District Court in the
Central District of California granted the subpoenaing
party's motion to compel production, subject to a
protective order. The court agreed with Judge Paez's
analysis in Wolpin. The court found that 'the data
itself (where the names and addresses of the participant
and family members have been redacted) in at least
several instances can be used by a reasonably capable
researcher to identify the subject that the data
reflects,' but that while the raw data 'could be used to
identify many of the study participants, the data itself
without further inquiry does not automatically identify
any participant; in other words, the court finds it
unlikely that anyone without personal knowledge of a
particular study participant could read the raw data and,
SB 1596 (Ortiz)
Page 10
without using the information therein to research other
databases, know the identify of the participant.'
6. Author's amendments will conform SB 1596 Penalties to
the CMIA
SB 1596 would provide for a civil penalty of five
hundred dollars ($500) for each violation and the person
may be denied further access to confidential data
maintained by the department. This penalty is in
addition to any other damages an injured person may
recover under any applicable law.
This language would seem to preclude the application
of the damages and civil penalty scheme contained in
existing law, under the CMIA. The author's office has
agreed to amend the bill to reflect the existing remedies
provisions contained in Civil Code Section 56.36. The
exact language of the amendment has yet to be worked out.
Support: California School Employees Association;
California Firefighters Association; American Cancer
Society
Opposition: None Known
HISTORY
Source: Department of Health Services
Related Pending Legislation: None Known
Prior Legislation: None Known
Prior Vote: Senate Health & Human Services Committee (7-0)
**************