Many individuals are covered by health insurance but are not the policy holders for that coverage (e.g., the policy holder is a spouse or parent of the covered individual).  Routine communications sent by insurers, such as explanation of benefit letters or denial of claims notices, are often sent to the policy holder and may contain personal and sensitive information about a covered individual who is not the policy holder.  California’s Confidential Health Information Act, which became effective on January 1, 2015, is intended to provide greater privacy protection to individuals covered by health insurance where that individual is not the policy holder.

The Confidential Health Information Act, which amends California’s Confidentiality of Medical Information Act, will enable covered individuals to prevent disclosures of certain personal health information to policy holders by requiring health plans to:

• Honor confidential communications requests for communications relating to sensitive services, such as birth control, STD tests, or mental health care or for any disclosures that could endanger the covered individual, provided the covered individual is not the policy holder and makes the request in writing;

• Accommodate requests for confidential communications in the form and format requested by the covered individual, to the extent feasible, and;

• Maintain a confidential communication request until the covered individual submits a revocation of the request or a new confidential communication request.

Cal. Civ. Code § 56.107.

This legislation aims to close certain gaps in existing HIPAA privacy regulations.  Under HIPAA, individuals may submit confidential communication requests to their insurers, but insurers need not honor the request unless the request “clearly states” that disclosing the information involved might “endanger the individual.”  45 C.F.R §§ 164.522(b)(1)(ii),164.502(h).   HIPAA does not define “endanger.”  The California Confidentiality of Medical Information Act now defines “endanger” to mean that the patient “fears that disclosure of his or her medical information could subject the [individual] to harassment or abuse,” Cal. Civ. Code § 56.05, and requires insurers to honor confidential communications requests for certain sensitive information without a showing of endangerment,  Cal. Civ. Code § 56.107.  The law also prohibits insurers from requiring individuals to explain why a particular disclosure might endanger them.  Cal. Civ. Code § 56.107(3).

The sponsors of the California Confidential Health Information Act have indicated that the legislation was intended to improve access to health care and ensure confidentiality concerns do not prohibit individuals from taking advantage of certain benefits introduced by the Affordable Care Act.  For instance, the Affordable Care Act requires insurers to offer dependent coverage for children up to age 26 and make preventive health services available to insured adolescents at no cost.  The new legislation was intended to help ensure that confidentiality issues do not prohibit individuals, particularly young adults, from obtaining available coverage and services.