UC says Blue Shield sought ‘expansive’ patient data as part of its COVID-19 work for California

SACRAMENTO —  Blue Shield of California initially sought an “expansive” amount of medical data from the University of California Health system in exchange for vaccine doses under the state’s revamped allocation plan that awards extensive powers to the insurance giant, a move that has prompted objections from UC and alarm from patient privacy advocates.

UC Health spokeswoman Heather Harper said representatives for the UC system contacted Blue Shield and the contract was revised to “limit access just to vaccination records and only by federal and state agencies and their contractors.” The university health system declined to elaborate on what kind of patient data Blue Shield requested.

“We brought concerns to the attention of the Third Party Administrator about a seemingly expansive scope of access to patient data,” Harper said of discussions with Blue Shield about the original contract. She said that “we were able to resolve the issue.”

UC ultimately signed the contract Thursday.

The concerns over patient privacy offer a glimpse into questions being raised by healthcare and local government officials about the scope of Blue Shield’s role as an independent overseer of California’s network of COVID-19 vaccine providers, slowing down implementation of the program that Gov. Gavin Newsom unveiled several weeks ago. Counties contacted by The Times said they were still reviewing the contract and declined to comment. Other vaccine providers raised issues with the original contract but declined to speak publicly, citing concerns that doing so could affect future vaccine allotments.

A template of the revised contract was made public Friday by the California Department of Public Health. A spokesman for Blue Shield denied the company sought access to patient data, saying the contract provision was standard records retention language intended to ensure there is proper access to records in the event of an audit.

Blue Shield President Paul Markovich said “it would be completely inappropriate” for the insurance provider to use data obtained from administering the vaccine program for its own business purposes.

“It’s simply not going to happen and is contractually forbidden,” Markovich said Friday.

The Times obtained a copy of an earlier contract sent to some vaccine providers, but it is unclear whether the provisions are the same as those in the initial contract sent to the UC Health system. The contract reviewed by The Times stated that a vaccine provider would have to provide Blue Shield access to “accurate medical, vaccination, financial and other records and reports” for at least three years after the contract ended. The revised contract made public by the state Friday specified that the data Blue Shield would have access to for three years are “vaccine-related, financial, and other records and reports.”

The state has final approval of the contract drafted by Blue Shield, according to California’s agreement with the insurance company. Markovich said more than 30 vaccine providers have signed contracts so far.

“This language is not now, and never has been, a request for three years of data,” said Don Campbell, vice president of corporate communications at Blue Shield. “It is a request not to destroy records for three years about the provider’s performance of its vaccine network contract.”

Healthcare privacy advocates say there is a reason for heightened scrutiny of how much data is shared with Blue Shield through the state’s new vaccine network.

“The state should be intervening, not perpetuating the exploitation of Californians looking for information, services and vaccines during a global pandemic,” said Samantha Corbin, a privacy and technology advocate.

Data play a critical role in the healthcare industry, allowing health plans to identify high-cost consumers, target geographic areas to expand and grow their market, meet regulatory and quality requirements, and tailor marketing to specific demographics.

“Data is the bedrock of healthcare and it not only supports patient care, but it also supports the business of delivering care,” said Jennifer Kent, who was appointed director of the state Department of Health Care Services during the administration of former Gov. Jerry Brown in 2015 before resigning in 2019. “Whoever controls the data controls it all.”

Blue Shield began to take over administration of the state’s vaccine program Feb. 15 and is tasked with deciding who should administer doses in California and how many vaccines each provider should receive from the limited supply available.

But some local government officials have complained that the process of vaccine distribution has only grown more complex.

Blue Shield was scheduled to begin its work Feb. 22 in 10 counties primarily located in or near the Central Valley, along with Riverside. State officials say changes were delayed a week and will begin Monday.

“Nothing has changed yet,” said Fresno County Supervisor Ernest “Buddy” Mendes.

Newsom said Friday that the state’s contract with Blue Shield will allow all 58 counties in California to operate on a single platform that will provide “transparency, more accountability.” Blue Shield will rely on analytics to determine where doses are most needed, while monitoring and incentivizing providers who are efficiently administering vaccine, he said.

“Next week, that process begins at a whole new scale,” Newsom said Friday.

In its contract with the state, Blue Shield set a goal of administering 3 million shots a week by March 1. Yolanda Richardson, secretary of the Government Operations Agency, said California is on target to meet that goal in anticipation that supplies coming into the state will increase.

“Through April, we expect the network to grow even more with the ability to deliver 4 million doses per week,” Richardson said Friday.

In January, Newsom was under immense pressure to improve the state’s vaccine rollout, which was hampered by fewer than expected doses, complex rules dictating who qualified for appointments and data errors. The state was initially ranked among the worst in the country at administering vaccine doses it received but has improved that ranking in recent weeks.

County health officers have said that improvement was largely the result of state data issues being corrected, prompting some to question the need for a new system under Blue Shield.

Dr. Maggie Park, San Joaquin County public health officer, said during a board of supervisors meeting Tuesday that timelines and information continue to change under the Blue Shield contract, making it difficult to plan. Park said county health officers across the state have been frustrated with the timing of the state’s vaccine distribution changes, which she said have come though officials “feel we were really ramping up our capacity.”

Tom Patti, chairman of the San Joaquin County Board of Supervisors, requested Tuesday that the county’s counsel explore options for opting out of the “tremendous bureaucratic system” under Blue Shield and to see if other counties would join the effort.

Before the state inked the deal with Blue Shield, Ventura County officials had asked the state for the option to be excluded from the agreement, arguing that insufficient supply, not poor oversight, was hurting distribution.

A separate vaccine contract with Kaiser Permanente, which Newsom announced at the same time as the agreement with Blue Shield, was signed Tuesday. Kaiser Permanente, which provides services for more than 9 million Californians, will run a separate vaccination program for its members, run two mass vaccination sites and create clinics in vulnerable and disproportionately affected communities, according to the contract.

The state’s decision to contract with Blue Shield has prompted questions about how the Oakland company, which is a Newsom donor and holds considerable sway in state politics, landed the contract and what it stands to gain. Blue Shield has pledged to run the distribution programs at or near cost and “will not profit,” according to a letter of intent, and its contract with the state stipulates that the company cannot bill for more than $15 million during the contract term for out-of-pocket costs.

Blue Shield is expected to take full responsibility for vaccine management in the state by March 31. The terms of the contract run until Dec. 31.

“What I first said to counties and what I say to all of you is give us a chance to make this work,” Markovich said. “I think there has been a lot of speculation about all the things that could potentially go wrong and it’s our job to get this to work and work for everybody.”

Times staff writer John Myers contributed to this report.