California’s Confidential Health Information Act (SB 138)

California’s Confidential Health Information Act (SB 138):

Implementation Readiness Among Health Insurers and Health Plans

Authors: Jan Malvin, PhD, Sara Daniel, MPH, Claire D. Brindis, DrPH

The Patient Protection and Affordable Care Act (ACA) expanded the opportunity for many individuals to maintain health insurance as dependents on a policy registered in someone else’s name. The policyholder may be a spouse, domestic partner, or a parent in the case of a young adult. In California, this provision reduced the uninsured rate for young adults ages 19 to 26 from 28.9% in 2009 to 26.0% in 2012. For private insurance dependents, increased access to health care coverage following the ACA may also test the limits of medical privacy protection. The primary policyholder is the main contact for all communications related to private insurance benefits. These communications often include personal health information that identifies the dependent, the provider seen, and the services delivered. To address privacy concerns of individuals insured as dependents, effective January 1, 2015, California’s SB 138 legislation goes beyond federal HIPAA privacy protections by requiring insurers and health plans to comply with confidential communications requests when the dependent receives “sensitive services” and when the patient receives any type of service that, if disclosed, could threaten the patient with harassment or abuse. This brief summarizes an exploratory study of insurers and health plans designed to assess their readiness to implement the requirements of SB 138.Telephone interviews were conducted with privacy officers at selected organizations before SB 138 was in effect to close data privacy loopholes. In addition, a website content analysis examined information provided to covered individuals when they go online to learn about their health plan’s or insurer’s privacy practices.

Funded by a grant from The California Wellness Foundation.

This study was conducted by the Philip R. Lee Institute for Health Policy Studies
at the University of California San Francisco.

The report can be found at:


More information: