AMENDED IN ASSEMBLY SEPTEMBER 2, 2025

AMENDED IN ASSEMBLY JUNE 26, 2025

AMENDED IN SENATE APRIL 24, 2025

AMENDED IN SENATE APRIL 10, 2025

AMENDED IN SENATE MARCH 27, 2025

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION

92

CHAPTER 766

Statutes of 2025

[ Approved by Governor October 13, 2025. Filed with Secretary of State October 13, 2025. ]

Introduced by Senator Laird

(Coauthors: Senators Cabaldon, Cervantes, Padilla, Pérez, and Wiener)

February 19, 2025

An act to amend Sections 120962, 121022, and 121026 of the Health and Safety Code, and to amend Section 19548.2 of the Revenue and Taxation Code, relating to public health.

Vote: majority   Appropriation: no   Fiscal committee: yes   Local program: no

LEGISLATIVE COUNSEL’S DIGEST

Existing law requires all health care providers and laboratories to report cases of human immunodeficiency virus (HIV) infection to the local health officer and requires the local health officer to report unduplicated HIV cases to the State Department of Public Health. Existing law requires public health records related to HIV or acquired immunodeficiency syndrome (AIDS), containing personally identifying information, that were developed or acquired by a state or local public health agency, or an agent of that agency, to be confidential and not disclosed, except as otherwise provided by law for public health purposes or pursuant to a written authorization by the person who is the subject of the record or by their guardian or conservator. Existing law authorizes certain state or local public health officials to disclose those records to other local, state, or federal public health agencies or to medical researchers when the confidential information is necessary to carry out specified duties of the agency or researcher, including in the investigation, control, or surveillance of disease.

This bill would additionally authorize a health care provider of a patient with an HIV infection that has already been reported to a local health officer as described above to disclose identifying information about the patient to a local health jurisdiction or the department if the disclosure is necessary to complete or supplement an HIV case report or for the local health jurisdiction or the department to carry out its duties in the investigation, control, or surveillance of disease, or the coordination of, linkage to, or reengagement in care for a person, as specified. The bill would make conforming changes to related provisions.

The people of the State of California do enact as follows:

SECTION 1.

Section 120962 of the Health and Safety Code is amended to read:

120962.

(a) (1) For the purpose of verifying financial eligibility pursuant to Section 120960 and the federal Ryan White HIV/AIDS Treatment Extension Act of 2009 (42 U.S.C. Sec. 201 et seq.), the department shall verify the accuracy of the modified adjusted gross income reported on an AIDS Drug Assistance Program application submitted by an applicant or recipient with data, if available, from the Franchise Tax Board.

(2) Notwithstanding any other law, the department shall disclose the name and individual taxpayer identification number (ITIN) or social security number of an applicant for, or recipient of, services under this chapter to the Franchise Tax Board for the purpose of verifying the modified adjusted gross income of, any tax-exempt interest received by, any tax-exempt social security benefits received by, and any foreign earned income of an applicant or recipient pursuant to subdivision (b) of Section 120960.

(b) (1) The Franchise Tax Board, upon receipt of this information, shall inform the department of all of the following:

(A) The amount of the federal adjusted gross income received by the taxpayer household as reported by the taxpayer to the Franchise Tax Board.

(B) The amount of the California adjusted gross income received by the taxpayer household as reported by the taxpayer to the Franchise Tax Board or as adjusted by the Franchise Tax Board.

(C) The amount of any tax-exempt interest received by the taxpayer household, as reported to the Franchise Tax Board.

(D) The amount of any tax-exempt social security benefits received by the taxpayer household, as reported to the Franchise Tax Board.

(E) The amount of any foreign earned income of the taxpayer household, as reported to the Franchise Tax Board.

(F) The family size of the taxpayer household, as reported to the Franchise Tax Board.

(2) The Franchise Tax Board shall provide the information to the department for the most recent taxable year that the Franchise Tax Board has information available, and shall include the first and last name, date of birth, and the ITIN or social security number of the taxpayer.

(c) (1) Information provided by the department pursuant to this section shall constitute confidential public health records as defined in Section 121035, and shall remain subject to the confidentiality protections and restrictions on further disclosure by the recipient under subdivisions (d) and (e) of Section 121025.

(2) To the extent possible, verification of financial eligibility shall be done in a way to eliminate or minimize, by use of computer programs or other electronic means, Franchise Tax Board staff and contractors’ access to confidential public health records.

(3) Prior to accessing confidential HIV-related public health records, Franchise Tax Board staff and contractors shall be required to annually sign a confidentiality agreement developed by the department that includes information related to the penalties under Section 121025 for a breach of confidentiality and the procedures for reporting a breach of confidentiality under subdivision (j) of Section 121022. Those agreements shall be reviewed annually by the department.

(4) The Franchise Tax Board shall return or destroy all information received from the department after completing the exchange of information.

(d) For purposes of this section, “foreign earned income” also includes any deduction taken for the housing expenses of an individual while living abroad pursuant to Section 911 of Title 26 of the Internal Revenue Code.

(e) For purposes of this section, “household” means the applicant or recipient, and, in addition, the applicant’s or recipient’s spouse or registered domestic partner, and all other individuals for whom the applicant or recipient, or the applicant’s or recipient’s spouse or registered domestic partner, is allowed a federal income tax deduction for the taxable year.

(f) For purposes of this section, “family size” has the meaning given to that term in Section 36B(d)(1) of Title 26 of the Internal Revenue Code, and includes same or opposite sex married couples, registered domestic partners, and any dependent, as defined by Section 152 of Title 26 of the Internal Revenue Code, of either spouse or registered domestic partner.

SEC. 2.

Section 121022 of the Health and Safety Code is amended to read:

121022.

(a) To ensure knowledge of current trends in the HIV epidemic and to ensure that California remains competitive for federal HIV and AIDS funding, health care providers and laboratories shall report all cases of HIV infection to the local health officer using patient names on a form developed by the department. Both the local health officer and the department shall be authorized to access reports of HIV infection that are electronically submitted by laboratories pursuant to subdivision (g) of Section 120130. Local health officers shall report unduplicated HIV cases by name to the department on a form developed by the department.

(b) (1) Health care providers and local health officers shall submit cases of HIV infection pursuant to subdivision (a) by courier service, United States Postal Service express mail or registered mail, other traceable mail, person-to-person transfer, facsimile, or electronically by a secure and confidential electronic reporting system established by the department.

(2) This subdivision shall be implemented using the existing resources of the department.

(c) Notwithstanding Section 56.10 of the Civil Code, a health care provider of a patient diagnosed with an HIV infection that has already been reported pursuant to subdivision (a) may disclose identifying information about the patient to a local health jurisdiction or the department if the disclosure is necessary to complete or supplement the HIV case report described in subdivision (a), as determined by the health care provider, the local health jurisdiction, or the department.

(d) Notwithstanding Section 56.10 of the Civil Code, a health care provider may disclose identifying information about a patient with a diagnosed HIV infection to a local health jurisdiction or the department if the disclosure is necessary for the local health jurisdiction or the department to carry out its duties in the investigation, control, or surveillance of disease, or the coordination of, linkage to, or reengagement in care for a person, as determined by the health care provider, the local health jurisdiction, or the department.

(e) The department and local health officers shall ensure continued reasonable access to anonymous HIV testing through alternative testing sites, as established by Section 120890, and in consultation with HIV planning groups and affected stakeholders, including representatives of persons living with HIV and health officers.

(f) The department shall promulgate emergency regulations to conform the relevant provisions of Article 3.5 (commencing with Section 2641.5) of Subchapter 1 of Chapter 4 of Division 1 of Title 17 of the California Code of Regulations, consistent with this chapter, by April 17, 2007. Notwithstanding the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code), if the department revises the form used for reporting pursuant to subdivision (a) after consideration of the reporting guidelines published by the federal Centers for Disease Control and Prevention, the revised form shall be implemented without being adopted as a regulation, and shall be filed with the Secretary of State and printed in Title 17 of the California Code of Regulations.

(g) Pursuant to Section 121025, reported cases of HIV infection shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding.

(h) State and local health department employees and contractors shall be required to sign, on an annual basis, confidentiality agreements developed by the department that include information related to the penalties for a breach of confidentiality and the procedures for reporting a breach of confidentiality, prior to accessing confidential HIV-related public health records.

(i) A person shall not disclose identifying information reported pursuant to subdivision (a) to the federal government, including, but not limited to, any agency, employee, agent, contractor, or anyone else acting on behalf of the federal government, except as permitted under subdivision (b) of Section 121025.

(j) (1) Any potential or actual breach of confidentiality of HIV-related public health records shall be investigated by the local health officer, in coordination with the department, when appropriate. The local health officer shall immediately report any evidence of an actual breach of confidentiality of HIV-related public health records at a city or county level to the department and the appropriate law enforcement agency.

(2) The department shall investigate any potential or actual breach of confidentiality of HIV-related public health records at the state level, and shall report any evidence of such a breach of confidentiality to an appropriate law enforcement agency.

(k) Any willful, negligent, or malicious disclosure of cases of HIV infection reported pursuant to subdivision (a) shall be subject to the penalties prescribed in Section 121025.

(l) This section does not limit any other remedies and protections available under state or federal law.

SEC. 3.

Section 121026 of the Health and Safety Code is amended to read:

121026.

(a) Notwithstanding subdivision (f) of Section 120980, Section 121010, subdivision (i) of Section 121022, subdivision (f) of Section 121025, Section 121115, and Section 121280, the State Department of Public Health and qualified entities may share with each other health records involving the diagnosis, care, and treatment of human immunodeficiency virus (HIV) or acquired immunodeficiency syndrome (AIDS) related to a beneficiary enrolled in federal Ryan White Act funded programs who may be eligible for services under the federal Patient Protection and Affordable Care Act (Public Law 111-148), as amended by the federal Health Care and Education Reconciliation Act of 2010 (Public Law 111-152). The qualified entities, who shall be covered entities under the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to the act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), may share records only for the purpose of enrolling the beneficiary in Medi-Cal, the bridge programs, Medicaid expansion programs, and any insurance plan certified by the California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code, or any other programs authorized under the federal Patient Protection and Affordable Care Act (Public Law 111-148), and for the purpose of continuing their access to those programs and plans without disruption.

(b) The information provided by the State Department of Public Health pursuant to this section shall be limited to only the information necessary for the purposes of this section and shall not include HIV or AIDS surveillance data. This information shall not be further disclosed by a qualified entity, except to any or all of the following as necessary for the purposes of this section:

(1) The person who is the subject of the record or to their guardian or conservator.

(2) The provider of health care for the person with HIV or AIDS to whom the information pertains.

(3) The Office of AIDS within the State Department of Public Health.

(c) For purposes of this section, the following definitions shall apply:

(1) “Contractor” means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care.

(2) “Provider of health care” means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code.

(3) “Qualified entity” means any of the following:

(A) The State Department of Health Care Services.

(B) The California Health Benefit Exchange established pursuant to Title 22 (commencing with Section 100500) of the Government Code.

(C) Medi-Cal managed care plans.

(D) Health plans participating in the Bridge Program.

(E) Health plans offered through the Exchange.

(F) County health departments delivering HIV or AIDS health care services.

(d) Notwithstanding any other law, information shared pursuant to this section shall not be disclosed, discoverable, or compelled to be produced in any civil, criminal, administrative, or other proceeding.

(e) This section shall be implemented only to the extent permitted by federal law. All employees and contractors of a qualified entity who have access to confidential HIV-related medical records pursuant to this section shall be subject to, and all information shared pursuant to this section shall be protected in accordance with, the federal Health Insurance Portability and Accountability Act (Public Law 104-191) and the final regulations issued pursuant to that act by the United States Department of Health and Human Services (45 C.F.R. Parts 160 and 164), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Part 2 of Division 1 of the Insurance Code).

SEC. 4.

Section 19548.2 of the Revenue and Taxation Code is amended to read:

19548.2.

(a) Notwithstanding any other law and in accordance with Section 120962 of the Health and Safety Code, the State Department of Public Health shall disclose the name and individual taxpayer identification number (ITIN) or social security number of an applicant for, or recipient of services pursuant to Chapter 6 (commencing with Section 120950) of Part 4 of Division 105 of the Health and Safety Code to the Franchise Tax Board for the purpose of verifying the modified adjusted gross income of, any tax-exempt interest received by, any tax-exempt social security benefits received by, and any foreign earned income of an applicant or recipient.

(b) (1) The Franchise Tax Board, upon receipt of this information, shall inform the State Department of Public Health of all of the following:

(A) The amounts of the federal adjusted gross income received by the taxpayer household as reported by the taxpayer to the Franchise Tax Board.

(B) The amounts of the California adjusted gross income received by the taxpayer household as reported by the taxpayer to the Franchise Tax Board or as adjusted by the Franchise Tax Board.

(C) The amount of any tax-exempt interest received by the taxpayer household, as reported to the Franchise Tax Board.

(D) The amount of any tax-exempt social security benefits received by the taxpayer household, as reported to the Franchise Tax Board.

(E) The amount of any foreign earned income of the taxpayer household, as reported to the Franchise Tax Board.

(F) The family size of the taxpayer household, as reported to the Franchise Tax Board.

(2) The Franchise Tax Board shall provide the information to the State Department of Public Health for the most recent taxable year that the Franchise Tax Board has information available, and shall include the first and last name, date of birth, and the ITIN or social security number of the taxpayer.

(c) (1) Information provided by the State Department of Public Health pursuant to this section shall constitute confidential public health records as defined in Section 121035 of the Health and Safety Code, and shall remain subject to the confidentiality protections and restrictions on further disclosure by the recipient under subdivisions (d) and (e) of Section 121025 of the Health and Safety Code.

(2) Prior to accessing confidential HIV-related public health records, Franchise Tax Board staff and contractors shall be required to annually sign a confidentiality agreement developed by the State Department of Public Health that includes information related to the penalties under Section 121025 of the Health and Safety Code for a breach of confidentiality and the procedures for reporting a breach of confidentiality under subdivision (j) of Section 121022 of the Health and Safety Code. Those agreements shall be reviewed annually by the State Department of Public Health.

(3) The Franchise Tax Board shall return or destroy all information received from the State Department of Public Health after completing the exchange of information.

(d) For purposes of this section, “foreign earned income” also includes any deduction taken for the housing expenses of an individual while living abroad pursuant to Section 911 of Title 26 of the Internal Revenue Code.

(e) For purposes of this section, “household” means the applicant or recipient, and, in addition, the applicant’s or recipient’s spouse or registered domestic partner, and all other individuals for whom the applicant or recipient, or the applicant’s or recipient’s spouse or registered domestic partner, is allowed a federal income tax deduction for the taxable year.

(f) For purposes of this section, “family size” has the meaning given to that term in Section 36B(d)(1) of Title 26 of the Internal Revenue Code, and includes same or opposite sex married couples, registered domestic partners, and any dependent, as defined by Section 152 of Title 26 of the Internal Revenue Code, of either spouse or registered domestic partner.