The Legislature finds and declares the following:

(a) The federal Health Insurance Portability and Accountability Act (Public Law 104-191), known as HIPAA, was enacted on August 21, 1996.

(b) HIPAA extends health coverage benefits to workers after they terminate or change employment by allowing the worker to participate in existing group coverage plans, thereby avoiding the additional expense associated with obtaining individual coverage as well as the potential loss of coverage because of a preexisting health condition.

(c) Administrative simplification is a key feature of HIPAA, requiring standard national identifiers for providers, employers, and health plans and the development of uniform standards for the coding and transmission of claims and health care information. Administration simplification is intended to promote the use of information technology, thereby reducing costs and increasing efficiency in the health care industry.

(d) HIPAA also contains standards for safeguarding the privacy and security of health information. Therefore, the development of policies for safeguarding the privacy and security of health records is a fundamental and indispensable part of HIPAA implementation that must accompany or precede the expansion or standardization of technology for recording or transmitting health information.

(e) The federal Department of Health and Human Services has published, and continues to publish, rules pertaining to the implementation of HIPAA. Following a 60-day congressional concurrence period, health providers and insurers have 24 months in which to implement these rules.

(f) These federal rules directly apply to state and county departments that provide health coverage, health care, mental health services, and alcohol and drug treatment programs. Other state and county departments are subject to these rules to the extent they use or exchange information with the departments to which the federal rules directly apply.

(g) In view of the substantial changes that HIPAA will require in the practices of both private and public health entities and their business associates, the ability of California government to continue the delivery of vital health services will depend upon the implementation of, and compliance with, HIPAA in a manner that is coordinated among state departments as well as our partners in county government and the private health sector.

(h) The implementation of HIPAA shall be accomplished as required by federal law and regulations and shall be a priority for state departments.

(Amended by Stats. 2016, Ch. 30, Sec. 9. (SB 833) Effective June 27, 2016.)