SB 1119

This bill prohibits an unregulated pregnancy center from disclosing nonpublic personal health information about an individual unless an authorization is obtained from the individual whose nonpublic personal health information is sought to be disclosed. Under the bill, an “unregulated pregnancy center” is a pregnancy services center that does not directly provide abortions or emergency contraception to clients or provide referrals to clients for abortions or emergency contraception. The bill provides that a “pregnancy services center” is a facility, including a mobile facility, the primary purpose of which is to provide services to individuals who are or may be pregnant and that offers obstetric ultrasounds, obstetric sonograms, pregnancy testing or diagnosis, or prenatal care to pregnant individuals or has the appearance of a medical facility.

Under the bill, a valid authorization to disclose nonpublic personal health information must be in written or electronic form and must contain the identity and signature of the individual who is the subject of the nonpublic personal health information. The authorization must also contain a general description of the types of nonpublic personal health information to be disclosed, a general description of the parties to whom the center discloses the information, the purpose of the disclosure and how the information will be used, as well as notice of the length of time for which the authorization is valid, notice that the individual may revoke the authorization at any time, and the procedure for making a revocation. The bill also provides that before an unregulated pregnancy center may obtain an authorization, it must, as part of its explanation of the authorization form, provide a verbal disclosure to the individual that it is not a covered entity for purposes of the federal privacy regulations promulgated under the federal Health Insurance Portability and Accountability Act (HIPAA).

The bill provides that an authorization under the bill must specify a length of time for which the authorization may remain valid, which may not exceed 24 months. The bill also provides that an individual may generally revoke authorization provided under the bill at any time, subject to the rights of an unregulated pregnancy center that acted in reliance on the authorization prior to notice of the revocation. Under the bill, an unregulated pregnancy center must retain an authorization and any revocation of the authorization for six years. The bill prohibits an unregulated pregnancy center from unfairly discriminating against an individual because that individual has not granted authorization for the disclosure of nonpublic personal health information under the bill. The bill also requires that an unregulated pregnancy center that maintains, stores, or manages computerized nonpublic personal health information must provide notice of any breach of the security of the system to any individual whose personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person. Under the bill, any person who violates the requirements of the bill engages in an unfair and deceptive trade practice as provided under current law.