HB0173

HOUSE BILL 173

54th legislature - STATE OF NEW MEXICO - first session, 2019

INTRODUCED BY

Antonio Maestas

AN ACT

RELATING TO SOCIAL SERVICES; ENACTING THE CHILD AND FAMILY DATABANK ACT; CREATING A STATEWIDE INTEGRATED DATA SYSTEM; PROVIDING FOR DATA SHARING AMONG STATE AGENCIES TO FACILITATE PROGRAM EVALUATION AND DEVELOP EVIDENCE-BASED POLICY; DEVELOPING A GOVERNANCE INFRASTRUCTURE TO ESTABLISH GUIDELINES FOR ACCESS, USE, STORAGE AND SHARING OF DATA; CREATING THE CHILD AND FAMILY DATABANK COMMISSION; AMENDING SECTIONS OF THE CHILDREN'S MENTAL HEALTH AND DEVELOPMENTAL DISABILITIES ACT AND THE MENTAL HEALTH AND DEVELOPMENTAL DISABILITIES CODE TO PROVIDE FOR DISCLOSURES; MAKING AN APPROPRIATION.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

SECTION 1. [NEW MATERIAL] SHORT TITLE.--Sections 1 through 12 of this act may be cited as the "Child and Family Databank Act".

SECTION 2. [NEW MATERIAL] FINDINGS--PURPOSE.--

A. The legislature finds that administrative data are valuable resources that should be used to improve services for New Mexico residents. Many of the pressing challenges facing New Mexico children and families are the shared responsibility of several agencies. The child and family databank commission will better enable state agencies, social service systems and researchers to:

(1) ethically identify risk factors that would enable prediction and prevention of problems;

(2) analyze measurable benefits on participants;

(3) provide a comprehensive measurement of future cost savings tied to specific programs;

(4) provide information on the full spectrum of services being provided to children and families;

(5) determine the effectiveness of specific programs and whether specific programs are achieving their stated goals;

(6) develop evidence-based policy to improve the lives of families and children in the state;

(7) identify areas for cross-sector collaboration;

(8) maximize the utilization of available resources; and

(9) create high-level knowledge to inform agency policies and practices on the case management of families and children.

B. The purpose of the Child and Family Databank Act is to:

(1) create the child and family databank commission, consisting of representatives of state agencies, issue-area experts and advocacy organizations;

(2) mandate data sharing across agencies;

(3) develop a governance process to link, share and provide access to administrative data for research and evaluation; and

(4) establish the child and family databank.

SECTION 3. [NEW MATERIAL] DEFINITIONS.--As used in the Child and Family Databank Act:

A. "administrative data" or "data" means information that government agencies or other organizations collect for registration, transaction, recordkeeping and other administrative purposes, usually during the delivery of a service;

B. "agency" means any governmental or quasi-governmental entity that collects, transmits or stores data relevant to the work of the commission;

C. "anonymized data" means information that does not identify an individual and for which there is no reasonable basis to believe that the information can be used to identify an individual and that addresses the risk that, through the cumulation of individual pieces of data, an individual could be identified;

D. "commission" means the child and family databank commission;

E. "commissioner" means a person serving on the commission, either as an appointed member, an ex-officio member or an ex-officio designee;

F. "databank" means the child and family databank, an integrated databank system established by the commission;

G. "databank host" means the department of health or another entity qualified to host data in the databank;

H. "individually identifiable information" means data that identify an individual or information with respect to which there is a reasonable basis to believe the information can be used to identify an individual;

I. "institutional review board" means a board, committee or other group that:

(1) is formally designated by an institution to approve the initiation, and to conduct periodic review, of research involving human subjects. The primary purpose of the human subjects review is to ensure the protection of the rights and welfare of the human subjects and not to review a clinical trial for scientific merit;

(2) is a nonpartisan entity; and

(3) has been approved by the national institutes of health;

J. "qualified nonprofit entity" means an entity that:

(1) has a mission singularly dedicated to solving child and family welfare and poverty issues in the state through systemic change;

(2) is a nonpartisan entity;

(3) has expertise in governance structures of:

(a) integrated data systems; and

(b) privacy requirements, including a deep knowledge of state and federal privacy laws;

(4) has expertise in the ethical considerations relating to integrated data;

(5) has demonstrated competency in research and program analysis;

(6) has a proven ability to work across disciplines;

(7) has the ability to establish, incubate and implement projects at scale; and

(8) demonstrates a breadth of knowledge on social systems that will be the subject of the databank; and

K. "researcher" means a person that is employed or contracted by or affiliated with a nonprofit private entity or academic research institution and is not employed or contracted by or otherwise affiliated with a state agency providing direct services to families.

SECTION 4. [NEW MATERIAL] CHILD AND FAMILY DATABANK COMMISSION--CREATION--APPOINTMENT--MEMBERSHIP.--

A. The "child and family databank commission" is created as a nonpartisan commission administratively attached to the office of the governor and consists of thirteen members as follows:

(1) the secretary of human services, ex officio, or the secretary's designee;

(2) the secretary of health, ex officio, or the secretary's designee;

(3) the secretary of public education, ex officio, or the secretary's designee;

(4) the secretary of children, youth and families, ex officio, or the secretary's designee;

(5) one representative of the New Mexico sentencing commission, appointed by the New Mexico sentencing commission from among its membership;

(6) one representative from the administrative office of the courts, appointed by the director of the administrative office of the courts;

(7) five members of the general public, appointed by the New Mexico legislative council, as follows:

(a) an individual with experience in human subjects research and a demonstrated understanding of the ethical considerations in such research who is affiliated with a research university located in the state;

(b) an individual with expertise in the privacy, security and ethical use of individually identifiable information;

(c) an individual with technical expertise and experience in the creation, design and maintenance of large data systems and data security;

(d) an individual with demonstrated experience in the fields of civil liberties and civil rights; and

(e) an individual from a nonpartisan organization that is focused solely on systems level change and advocacy on behalf of children and families;

(8) one member, appointed by the speaker of the house of representatives, who is a representative of nongovernmental organizations or research universities located within the state and who is engaged in the provision of social services in the state; and

(9) one member, appointed by the president pro tempore of the senate, who represents an advocacy organization for underserved communities in the state.

B. The commission shall strive for geographic and cultural diversity in the appointed public member commissioners.

C. No member shall simultaneously serve:

(1) as both a commissioner and as a qualified nonprofit entity; or

(2) as an employee of, or a contractor to, the commission and to a qualified nonprofit entity.

D. Appointed commissioners shall serve for staggered three-year terms to promote continuity of institutional knowledge and maintain the nonpartisan nature of the commission. Designated members shall serve for the duration of the designating official's tenure in office. Of the nine appointed commissioners named in Paragraphs (5) through (9) of Subsection A of this section who are initially appointed to the board, four shall serve for a term of three years, three shall serve for a term of two years and two shall serve for a term of one year. At the first meeting of the commission, the commissioners shall determine by lot who shall serve three-, two- and one-year terms. Following the expiration of the initial terms, appointments shall be for terms of three years.

E. The governor shall call the initial meeting of the commission by September 1, 2019. At the commission's initial meeting, commissioners shall appoint a chair and a vice chair, each of whom shall serve for two-year terms, unless removed sooner by a vote of two-thirds of the commission. After the first meeting of the commission, the commission shall meet at least quarterly at the call of the chair.

F. An appointed commissioner may be removed by a vote of two-thirds of the commission.

G. A vacancy occurring in the commission shall be filled in the same manner as the original appointment. An appointment to fill a vacancy shall be made only for the unexpired portion of the vacated term.

H. Members of the commission appointed in accordance with Paragraphs (7) through (9) of Subsection A of this section may receive per diem and reimbursement for mileage for work related to the commission pursuant to the Per Diem and Mileage Act. Those members shall receive no other compensation, perquisite or allowance for their service on the commission.

SECTION 5. [NEW MATERIAL] POWERS AND DUTIES OF COMMISSION.--

A. The commission shall collaborate with the agencies whose representatives are listed in Paragraphs (1) through (6) of Subsection A of Section 4 of the Child and Family Databank Act, as well as any other agency the commission identifies as providing services to children and families in the state, to adopt and promulgate rules to ensure that all relevant data that these agencies collect are integrated into the databank, in accordance with state and federal privacy laws, for research, analysis and policy development.

B. The commission shall select a databank host and manage the process by which the databank system links, stores, maintains, receives, transmits and securely protects individually identifiable information. It shall adopt and promulgate rules for this process as needed.

C. The commission shall identify both the technologies and processes by which data may be securely received, maintained and transmitted in accordance with all applicable privacy and security laws and standards.

D. The commission shall establish the governance infrastructure to support data sharing among state agencies and access to data by agency staff, researchers and other stakeholders. The commission shall create a governance process to guide how decisions about appropriate data uses are made and how research projects are prioritized and approved, including whether any institutional review board approval is required and what privacy protections are required to secure the data. To the extent that institutional review board review is not required for certain research projects, the commission shall establish an alternative process for ethical review of research proposals.

E. The commission may adopt and promulgate rules as necessary to carry out its duties under the Child and Family Databank Act.

F. To recoup costs associated with the commission staff's process of protecting individually identifiable information, providing access and assisting with research requests, the commission may charge reasonable fees for use of the databank; provided that the commission shall charge an entity that contributes data to the databank a lower fee for use of the databank than the fee the commission charges other entities for use of the databank. At a minimum, the commission may charge fees for performance of the following tasks:

(1) assisting in the development of a research proposal;

(2) conducting a portion of the data processing for the researcher;

(3) anonymizing data;

(4) linking data from different data sets;

(5) cleaning data before providing the data to researchers;

(6) encrypting or securing information for researchers; and

(7) assisting with analysis of data or performing other tasks in accordance with commission rules.

G. The commission shall ensure that data provided by agencies can be used across agency lines and be made available to agency staff, researchers and other private and public partners in accordance with the provisions of the Child and Family Databank Act, federal and state privacy laws and the process for accessing data established by commission rules.

H. The staff of the commission shall perform evaluation and analysis of data in the databank and provide support and assistance to agencies in their evaluation and analysis, including:

(1) identifying and understanding risk and protective factors of vulnerable families;

(2) evaluating existing programs and developing evidence-based programs and policies to address the critical issues related to child well-being in the state;

(3) quantifying outcomes of program participants; and

(4) developing a strategic plan or research agenda to identify and address questions relevant to the programs, policies and rules of the agency.

I. The commission shall form committees to focus on specific issues required by the work of the commission, including a committee on ethics and privacy matters.

J. The commission shall establish and maintain a website for internal and public use.

SECTION 6. [NEW MATERIAL] COMMISSION--EXECUTIVE DIRECTOR--STAFF.--

A. To provide the requisite staff support, services and knowledge to the commission as it carries out the provisions of the Child and Family Databank Act, by October 1, 2019, the commission may contract with a qualified nonprofit entity; provided that the commission shall not contract with an entity pursuant to this subsection that is a researcher that, during the term of the proposed contract, requests access to data in the databank. At a minimum, the commission may contract with the qualified nonprofit entity to:

(1) provide necessary staff support, including executive director services in accordance with Subsection B of this section, and services to develop mechanisms to research and analyze issues and disseminate the research;

(2) evaluate current programs for their effectiveness;

(3) analyze and recommend the adoption of effective policies; or

(4) provide data management, storage, security and oversight services.

B. By October 1, 2019, the commission may hire either an executive director or contract with a qualified nonprofit entity to perform the duties of an executive director. An executive director shall:

(1) have a demonstrated competency in research and program analysis;

(2) demonstrate a breadth of knowledge on the social systems that will be the subject of the databank;

(3) possess the knowledge and expertise to lead the work of the commission;

(4) demonstrate familiarity with integrated data systems;

(5) have an extensive management experience; and

(6) possess an in-depth understanding of research and analysis using administrative data.

C. The executive director, the executive director's designee or a qualified nonprofit entity that performs the duties of an executive director may hire staff as necessary to carry out the duties of the commission, including staff that possess the following skills:

(1) experience and understanding of:

(a) integration and organization of varied data;

(b) communication of complex technical concepts to diverse audiences; and

(2) technical expertise to:

(a) support data integration; and

(b) assist researchers and analysts in obtaining the appropriate data to meet needs;

(3) experience in creating and maintaining large data systems, linked data and data security;

(4) legal expertise related to:

(a) drafting and negotiating data-sharing agreements;

(b) the historical, cultural and ethical implications surrounding data use; and

(5) the ability to conduct qualitative and quantitative research and support; and

(6) the ability to assist in evaluating agency programming and developing evidence-based policy.

D. The executive director or the executive director's designee may hire staff to fill other positions as funding permits and the commission directs.

SECTION 7. [NEW MATERIAL] AGENCY DATA SHARING.--

A. Absent a specific legal prohibition to the contrary, the following agencies shall share their data with the databank in accordance with the provisions of a memorandum of agreement that the commission executes with each of the following agencies, which memorandum of agreement shall address the relevant legal and privacy concerns of each party:

(1) the department of health;

(2) the human services department;

(3) the children, youth and families department;

(4) the public education department;

(5) the corrections department;

(6) the administrative office of the courts; and

(7) the New Mexico sentencing commission.

B. The data shared in accordance with the memoranda of agreement executed pursuant to Subsection A of this section shall include historical administrative data that range in date as far in the past as practicable, including a minimum of five previous years' data.

C. The memoranda of agreement required pursuant to Subsection A of this section shall be executed by June 30, 2020.

D. Agencies shall cooperate with the commission in the drafting and execution of their respective memoranda of agreement executed pursuant to Subsection A of this section. The memorandum of agreement between an agency and the commission shall specify, at a minimum:

(1) the confidentiality of client information;

(2) the conditions or restrictions for the release and use of data so as to comply with state and federal privacy laws; and

(3) security measures to be taken to protect the confidentiality of the data.

E. At a minimum, the department of health shall share the following data with the databank:

(1) demographics relating to individuals to whom the department provides services and to public health measures that the department collects;

(2) vital records and statistics, including birth and death information;

(3) inpatient hospital discharge data, including emergency department usage;

(4) emergency department usage;

(5) emergency medical services data;

(6) environmental health and injury data; and

(7) family, infant, toddler program participation information.

F. At a minimum, the human services department shall share the following data with the databank:

(1) demographics relating to recipients of medical assistance;

(2) medicaid data, including both fee-for-service and managed care organization data and children's health insurance program claims data; and

(3) data from the following programs:

(a) the supplemental nutrition assistance program;

(b) cash assistance programs;

(d) child support enforcement; and

(e) behavioral health services.

G. The public education department shall share with the databank data regarding students and public schools in the state, including the following:

(1) student attendance;

(2) student demographics;

(3) graduation rates;

(4) student achievement, including proficiencies in math, reading and science;

(5) teachers' training and qualifications;

(6) student and teacher disciplinary information;

(7) course offerings;

(8) post-secondary education; and

(9) other information relevant to the well-being of children and families in the state.

H. The children, youth and families department shall share all federally reported data with the databank, as well as any other relevant data, from the following programs and areas:

(1) demographics on families and individuals to whom the department provides services or intervention;

(2) juvenile justice;

(3) behavioral health services;

(4) early childhood services, including pre-kindergarten, home visiting, daycare, family nutrition and head start; and

(5) the protective services division, including:

(a) foster care;

(b) adoptions;

(d) permanency planning; and

(e) youth services.

I. The corrections department shall share state-level corrections data with the databank, including information relating to:

(1) inmate and parolee demographics;

(2) offender intake and sentencing;

(3) probation and parole;

(4) community reentry and integration; and

(5) recidivism rates.

J. The New Mexico sentencing commission and the administrative office of the courts shall share court records and sentencing information with the databank.

K. In addition to the agencies and programs listed in Subsections A through I of this section, other agencies or programs that the commission identifies as having data that are relevant to the well-being of children and families in the state shall share their data with the databank, to the extent legally permissible and upon execution of a memorandum of agreement in accordance with the provisions of Subsections A through D of this section. These data shall include demographic information.

L. Agencies shall provide their data to the databank, or to the department of health in its capacity as host and storage facility for the data pursuant to Section 9 of the Child and Family Databank Act, in the formats and schedules determined by the commission but no less than annually.

M. Agencies shall cooperate with the commission and other agencies in the evaluation of programs and policy development and work toward cross-sector collaboration in the provision of services to children and families statewide.

SECTION 8. [NEW MATERIAL] DATABANK POLICY OFFICER.--

A. The department of health, human services department, public education department and children, youth and families department shall each hire a databank policy officer. A databank policy officer shall have at least the following qualifications:

(1) familiarity with integrated data systems;

(2) extensive understanding of research and analysis using administrative data;

(3) expertise sufficient to support agency staff in the evaluation of programming and in evidence-based policymaking;

(4) the ability to communicate complex technical concepts to different audiences; and

(5) the capacity to understand research methodologies relating to administrative data.

B. A databank policy officer shall be responsible for:

(1) coordinating and liaising with the commission;

(2) assisting with the identification of data sets to include in the databank; and

(3) coordinating with the commission, the department of health or a designee of the commission to transmit and share data, assist agencies in identifying priority programs and policies for analysis and work within the agency and with the commission to identify and implement areas of cross-sector collaboration and improved delivery of services.

SECTION 9. [NEW MATERIAL] DATABANK HOST--DATA STAFF.--

A. The databank host and the commission shall enter into a cooperation agreement to govern the commission's access to and use of the databank. The databank host shall cooperate with the commission in the expeditious negotiation and execution of the agreement and shall provide access to the appropriate data for research requests.

B. The databank host shall hire appropriate staff to handle data cleaning, linkage and security. It shall assist with research requests as the office of the governor or the commission assigns.

C. If the department of health is the databank host, it may use the data in the databank for its own research and evaluation; provided that:

(1) an institutional review board approves each instance of the department's use of the data; or

(2) the department's own internal ethical review panel approves the department's proposed use of the data.

D. At least annually, the databank host shall ensure that the databank is updated with new data from agencies.

SECTION 10. [NEW MATERIAL] PUBLICATIONS.--

A. The commission shall require that any researcher that seeks to use databank data provide the commission with a summary of its findings for publication on the commission's website.

B. Prior to publication, the commission shall provide an agency with at least thirty days to review any publication that makes use of the agency's data and the right to comment on or clarify any inaccuracies in the publication. An agency shall not prevent publication because it disagrees with a researcher's findings or conclusions.

SECTION 11. [NEW MATERIAL] DATA OWNERSHIP.-- Notwithstanding the requirements set forth in the Child and Family Databank Act to share data, each agency shall retain ownership of its original data set.

SECTION 12. [NEW MATERIAL] OTHER LAWS.--If the transmission of data to the commission is specifically prohibited by state or federal law, an agency shall work with the commission to identify any edits, deletions or additional protections that can be made to comply with state and federal laws allowing data to be provided to the commission.

SECTION 13. Section 32A-6A-24 NMSA 1978 (being Laws 2007, Chapter 162, Section 24, as amended) is amended to read:

"32A-6A-24. DISCLOSURE OF INFORMATION.--

A. Except as otherwise provided in the Children's Mental Health and Developmental Disabilities Act, a person shall not, without the authorization of the child, disclose or transmit any confidential information from which a person well-acquainted with the child might recognize the child as the described person or any code, number or other means that could be used to match the child with confidential information regarding the child.

B. When the child is under fourteen years of age, the child's legal custodian is authorized to consent to disclosure on behalf of the child. Information shall also be disclosed to a court-appointed guardian ad litem without consent of the child or the child's legal custodian.

C. A child fourteen years of age or older with capacity to consent to disclosure of confidential information shall have the right to consent to disclosure of mental health and habilitation records. A legal custodian who is authorized to make health care decisions for a child has the same rights as the child to request, receive, examine, copy and consent to the disclosure of medical or other health care information when evidence exists that such a child whose consent to disclosure of confidential information is sought does not have capacity to give or withhold valid consent and does not have a treatment guardian appointed by a court. If the legal custodian is not authorized to make decisions for a child under the Children's Mental Health and Developmental Disabilities Act, the person seeking authorization shall petition the court for the appointment of a treatment guardian to make a decision for such a child.

D. Authorization from the child or legal custodian for a child less than fourteen years of age shall not be required for the disclosure or transmission of confidential information when the disclosure or transmission:

(1) is necessary for treatment of the child and is made in response to a request from a clinician;

(2) is necessary to protect against a clear and substantial risk of imminent serious physical injury or death inflicted by the child on self or another;

(3) is determined by a clinician not to cause substantial harm to the child and a summary of the child's assessment, treatment plan, progress, discharge plan and other information essential to the child's treatment is made to a child's legal custodian or guardian ad litem;

(4) is to the primary caregiver of the child and the information disclosed was necessary for the continuity of the child's treatment in the judgment of the treating clinician who discloses the information;

(5) is to an insurer contractually obligated to pay part or all of the expenses relating to the treatment of the child at the residential facility. The information disclosed shall be limited to data identifying the child, facility and treating or supervising physician and the dates and duration of the residential treatment. It shall not be a defense to an insurer's obligation to pay that the information relating to the residential treatment of the child, apart from information disclosed pursuant to this section, has not been disclosed to the insurer;

(6) is to a protection and advocacy representative pursuant to the federal Developmental Disabilities Assistance and Bill of Rights Act and the federal Protection and Advocacy for Individuals with Mental Illness Act; [or]

(7) is pursuant to a court order issued for good cause shown after notice to the child and the child's legal custodian and opportunity to be heard is given. Before issuing an order requiring disclosure, the court shall find that:

(a) other ways of obtaining the information are not available or would not be effective; and

(b) the need for the disclosure outweighs the potential injury to the child, the clinician-child relationship and treatment services; or

(8) in accordance with other state and federal privacy laws, is to the child and family databank established pursuant to the Child and Family Databank Act.

E. A disclosure ordered by the court shall be limited to the information that is essential to carry out the purpose of the disclosure. Disclosure shall be limited to those persons whose need for the information forms the basis for the order. An order by the court shall include such other measures as are necessary to limit disclosure for the protection of the child, including sealing from public scrutiny the record of a proceeding for which disclosure of a child's record has been ordered.

F. An authorization given for the transmission or disclosure of confidential information shall not be effective unless it:

(1) is in writing and signed; and

(2) contains a statement of the child's right to examine and copy the information to be disclosed, the name or title of the proposed recipient of the information and a description of the use that may be made of the information.

G. The child has a right of access to confidential information about the child and has the right to make copies of information about the child and submit clarifying or correcting statements and other documentation of reasonable length for inclusion with the confidential information. The statements and other documentation shall be kept with the relevant confidential information, shall accompany it in the event of disclosure and shall be governed by the provisions of this section to the extent the statements or other documentation contain confidential information. Nothing in this subsection shall prohibit the denial of access to the records when a physician or other mental health or developmental disabilities professional believes and notes in the child's medical records that the disclosure would not be in the best interests of the child. In all cases, the child has the right to petition the court for an order granting access.

H. Information concerning a child disclosed under this section shall not be released to any other person, agency or governmental entity or placed in files or computerized data banks accessible to any persons not otherwise authorized to obtain information under this section. Notwithstanding the confidentiality provisions of the Delinquency Act and the Abuse and Neglect Act, information disclosed under this section shall not be re-released without the express consent of the child or legal custodian authorized under the Children's Mental Health and Developmental Disabilities Act to give consent and any other consent necessary for redisclosure in conformance with state and federal law, including consent that may be required from the professional or the facility that created the document.

I. Nothing in the Children's Mental Health and Developmental Disabilities Act shall limit the confidentiality rights afforded by federal statute or regulation.

J. The department shall promulgate rules for implementing disclosure of records pursuant to this section and in compliance with state and federal law and the Children's Court Rules."

SECTION 14. Section 43-1-19 NMSA 1978 (being Laws 1977, Chapter 279, Section 18, as amended) is amended to read:

"43-1-19. DISCLOSURE OF INFORMATION.--

A. Except as otherwise provided in the code, no person shall, without the authorization of the client, disclose or transmit any confidential information from which a person well acquainted with the client might recognize the client as the described person, or any code, number or other means that can be used to match the client with confidential information regarding the client.

B. Authorization from the client shall not be required for the disclosure or transmission of confidential information in the following circumstances:

(1) when the request is from a mental health or developmental disability professional or from an employee or trainee working with a person with a mental disability or developmental disability, to the extent that the practice, employment or training on behalf of the client requires access to such information is necessary;

(2) when such disclosure is necessary to protect against a clear and substantial risk of imminent serious physical injury or death inflicted by the client on the client's self or another;

(3) when the disclosure is made pursuant to the provisions of the Assisted Outpatient Treatment Act or the Child and Family Databank Act, using reasonable efforts to limit protected health information to that which is minimally necessary to accomplish the intended purpose of the use, disclosure or request;

(4) when the disclosure of such information is to the primary caregiver of the client and the disclosure is only of information necessary for the continuity of the client's treatment in the judgment of the treating physician or certified psychologist who discloses the information; or

(5) when such disclosure is to an insurer contractually obligated to pay part or all of the expenses relating to the treatment of the client at the residential facility. The information disclosed shall be limited to data identifying the client, facility and treating or supervising physician and the dates and duration of the residential treatment. It shall not be a defense to an insurer's obligation to pay that the information relating to the residential treatment of the client, apart from information disclosed pursuant to this section, has not been disclosed to the insurer.

C. No authorization given for the transmission or disclosure of confidential information shall be effective unless it:

(1) is in writing and signed; and

(2) contains a statement of the client's right to examine and copy the information to be disclosed, the name or title of the proposed recipient of the information and a description of the use that may be made of the information.

D. The client has a right of access to confidential information and has the right to make copies of any information and to submit clarifying or correcting statements and other documentation of reasonable length for inclusion with the confidential information. The statements and other documentation shall be kept with the relevant confidential information, shall accompany it in the event of disclosure and shall be governed by the provisions of this section to the extent they contain confidential information. Nothing in this subsection shall prohibit the denial of access to such records when a physician or other mental health or developmental disabilities professional believes and notes in the client's medical records that such disclosure would not be in the best interests of the client. In any such case, the client has the right to petition the court for an order granting such access.

E. Where there exists evidence that the client whose consent to disclosure of confidential information is sought is incapable of giving or withholding valid consent and the client does not have a guardian or treatment guardian appointed by a court, the person seeking such authorization shall petition the court for the appointment of a treatment guardian to make a substitute decision for the client, except that if the client is less than fourteen years of age, the client's parent or guardian is authorized to consent to disclosure on behalf of the client.

F. Information concerning a client disclosed under this section shall not be released to any other person, agency or governmental entity or placed in files or computerized [data banks] databanks accessible to any persons not otherwise authorized to obtain information under this section.

G. Nothing in the code shall limit the confidentiality rights afforded by federal statute or regulation.

H. A person appointed as a treatment guardian in accordance with the [Mental Health and Developmental Disabilities] code may act as the client's personal representative pursuant to the federal Health Insurance Portability and Accountability Act of 1996, Sections 1171-1179 of the Social Security Act, 42 U.S.C. Section 1320d, as amended, and applicable federal regulations to obtain access to the client's protected health information, including mental health information and relevant physical health information, and may communicate with the client's health care providers in furtherance of such treatment."

SECTION 15. APPROPRIATION.--Three million seven hundred thirty-eight thousand dollars ($3,738,000) is appropriated from the general fund to the office of the governor for expenditure in fiscal years 2020 and 2021 to establish a child and family databank commission and a child and family databank and to implement the provisions of the Child and Family Databank Act. Any unexpended or unencumbered balance remaining at the end of fiscal year 2021 shall revert to the general fund.

- 33 -