Notwithstanding any other law, and to the extent permitted by federal law, a health care service plan shall take the following steps to protect the confidentiality of a subscriber’s or enrollee’s medical information:

(a) (1) A health care service plan shall not require a protected individual to obtain the policyholder, primary subscriber, or other enrollee’s authorization to receive sensitive services or to submit a claim for sensitive services if the protected individual has the right to consent to care.

(2) A health care service plan shall recognize the right of a protected individual to exclusively exercise rights granted under this section regarding medical information related to sensitive services that the protected individual has received.

(3) A health care service plan shall direct all communications regarding a protected individual’s receipt of sensitive services directly to the protected individual receiving care as follows:

(A) If the protected individual has designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health care service plan shall send or make all communications related to the protected individual’s receipt of sensitive services to the alternative mailing address, email address, or telephone number designated.

(B) If the protected individual has not designated an alternative mailing address, email address, or telephone number pursuant to subdivision (b), the health care service plan shall send or make all communications related to the protected individual’s receipt of sensitive services in the name of the protected individual at the address or telephone number on file.

(C) Communications subject to this paragraph shall include the following written, verbal, or electronic communications related to the receipt of sensitive services:

(i) Bills and attempts to collect payment.

(ii) A notice of adverse benefits determinations.

(iii) An explanation of benefits notice.

(iv) A health care service plan’s request for additional information regarding a claim.

(v) A notice of a contested claim.

(vi) The name and address of a provider, description of services provided, and other information related to a visit.

(vii) Any written, oral, or electronic communication from a health care service plan that contains protected health information.

(4) A health care service plan shall not disclose medical information related to sensitive health care services provided to a protected individual to the policyholder, primary subscriber, or any plan enrollees other than the protected individual receiving care, absent an express written authorization of the protected individual receiving care.

(b) (1) A health care service plan shall permit subscribers and enrollees to request, and shall accommodate requests for, confidential communication in the form and format requested by the individual, if it is readily producible in the requested form and format, or at alternative locations.

(2) A health care service plan may require the subscriber or enrollee to make a request for a confidential communication described in paragraph (1), in writing or by electronic transmission.

(3) The confidential communication request shall be valid until the subscriber or enrollee submits a revocation of the request or a new confidential communication request is submitted.

(4) The confidential communication request shall apply to all communications that disclose medical information or provider name and address related to receipt of medical services by the individual requesting the confidential communication.

(5) For the purposes of this section, a confidential communications request shall be implemented by the health care service plan within 7 calendar days of receipt of an electronic transmission or telephonic request or within 14 calendar days of receipt by first-class mail. The health care service plan shall acknowledge receipt of the confidential communications request and advise the subscriber or enrollee of the status of implementation of the request if a subscriber or enrollee contacts the health care service plan.

(c) (1) A health care service plan shall notify subscribers and enrollees that they may request a confidential communication pursuant to subdivision (b) and how to make the request.

(2) The information required to be provided pursuant to this subdivision shall be provided to subscribers and enrollees with individual or group coverage upon initial enrollment and annually thereafter upon renewal. The information shall also be provided in the following manner:

(A) In a conspicuously visible location in the evidence of coverage.

(B) On the health care service plan’s internet website, accessible through a hyperlink on the internet website’s home page and in a manner that allows subscribers, enrollees, prospective subscribers, prospective enrollees, and members of the public to easily locate the information.

(d) Notwithstanding subdivision (b), the provider of health care may make arrangements with the subscriber or enrollee for the payment of benefit cost sharing and communicate that arrangement with the health care service plan.

(e) A health care service plan shall not condition enrollment or coverage on the waiver of rights provided in this section.

(f) This section shall become operative on July 1, 2022.

(Repealed (in Sec. 2) and added by Stats. 2021, Ch. 190, Sec. 3. (AB 1184) Effective January 1, 2022. Operative July 1, 2022, by its own provisions.)