Health data: HIV test results.

Senator Cabaldon’s measure would expand the confidentiality framework for HIV test results within Medi-Cal by authorizing the disclosure of identifiable HIV test results to the Medi-Cal managed care plan to which a beneficiary is assigned (where applicable) and to external quality review organizations, for the purposes of administering quality-improvement programs, including value-based payment programs and healthy behavior incentive programs designed to improve HIV care for Medi-Cal beneficiaries, without requiring the subject’s written authorization. In addition, the bill permits the disclosure of non-identifying HIV test results to departmental staff for the same purposes, while preserving the existing restrictions on disclosures to other health care service plans without authorization and maintaining penalties for improper disclosure under current law.

Key mechanisms include a new pathway in which identifiable HIV test results may be disclosed to Medi-Cal managed care plans and external quality review organizations contracted to conduct external quality reviews, to administer quality-improvement activities; non-identifying results may be disclosed to the State Department of Health Care Services staff for the same purposes; outside the Medi-Cal context, identifying results may not be disclosed to other health care service plans without the subject’s written authorization. The bill also provides that disclosures to the Medi-Cal managed care plan and EQRO may be made notwithstanding certain existing provisions, and that disclosures of non-identifying results to DHCS staff are permitted for the described purposes. Further, all disclosures remain subject to general limits on further disclosure unless permitted by law, including to federal agencies or other states. The measure does not specify new funding for these changes, and it retains penalties under existing law for improper disclosure.

Broader implications and policy context center on creating a narrowly scoped data-sharing pathway within Medi-Cal to support quality-improvement programs, including value-based payment and healthy-behavior incentives, while preserving confidentiality protections outside the Medi-Cal framework. The proposal requires fiscal committee review but does not request new appropriations, and it relies on the existing statutory framework governing HIV test results and disclosure. Stakeholders such as health care providers, Medi-Cal managed care plans, and external quality review organizations would operate under new data-sharing permissions, with governance and security obligations aligned to the defined purposes and the overarching privacy requirements. The enactment continues to treat non-identifying data as describable to DHCS staff for program evaluation, subject to the same safeguards.