AB 1387 authorizes counties to create behavioral health multidisciplinary personnel teams whose purpose is to speed identification, assessment, and linkage of justice‑involved people diagnosed with mental illness to housing and supportive services while jailed and after release. The statute defines who can sit on those teams, allows members to exchange otherwise confidential information when reasonably necessary for care coordination, and lets counties designate outside provider staff as case‑specific team members.
The bill matters because it builds an explicit legal pathway for cross‑agency data sharing tied to criminal justice settings, while layering in procedural safeguards: county protocols, security controls, confidentiality agreements, and express compliance with state and federal privacy laws. For county administrators, providers, and compliance officers this creates new operational duties — and new legal tensions — around consent, admissibility, IT security, and record retention.
At a Glance
What It Does
Permits counties to establish multidisciplinary behavioral health teams and authorizes team members to disclose and exchange information otherwise protected by state or federal confidentiality laws when a member reasonably believes it is needed to identify mental illness and provide services. It requires county protocols, secure processes for electronic exchange, identity verification, confidentiality statements, and security controls aligned with state and federal privacy statutes.
Who It Affects
County behavioral health departments, jail medical and custody staff, probation and law enforcement partners, community providers (behavioral health, substance use, homeless, veterans services), and attorneys who represent justice‑involved people — any agency or person named among the statutory provider agencies who participates in coordination.
Why It Matters
The statute creates an explicit legal mechanism to bridge care inside jails and at reentry, tightening linkages that often break during custody transitions. It also forces counties and providers to upgrade policies, training, and IT security to meet detailed protocol and confidentiality requirements, raising implementation and compliance priorities for administrators and counsel.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 1387 gives counties a tool: a behavioral health multidisciplinary personnel team made up of clinicians, medical staff, social workers, case managers, and other trained personnel, and allows those teams to coordinate services for people with mental illness who are or were incarcerated in county jails. The legislature framed the teams to do two things at once — speed up identification and assessment of mental illness in custody, and smooth the path to housing and supportive services before and after release.
To make coordination practical, the bill permits team members to exchange confidential information that would otherwise be restricted under state or federal privacy laws — but only when a member reasonably believes the data are needed for identification or treatment and only among team members or specially designated persons. The statute also creates a confidentiality fence around team discussions: conversations during team meetings are confidential and cannot be the subject of testimony in criminal, civil, or juvenile proceedings.Counties must translate the statutory permission into policy.
AB 1387 requires each county to adopt written protocols specifying what data elements will be shared, which agencies participate, how information will be used, retention schedules, and security and training requirements. The protocols must be distributed to participating agencies and posted on the county website within 30 days of adoption.
For electronic exchanges the law requires adequate identity verification and mandates that agencies implement reasonable administrative, technical, and physical safeguards aligned with federal and state standards.The bill also keeps existing privacy law in place: all transmissions must comply with HIPAA, HITECH, the Confidentiality of Medical Information Act, the Information Practices Act, and related regulations. Anyone who receives records as a team member is bound by the same confidentiality obligations and penalties as the original holder of the information.
Finally, the statute expressly allows a county team to designate an outside provider agency’s staff member as a team participant for a particular case so that needed parties can receive and share records for coordination.
The Five Things You Need to Know
The bill authorizes counties to form behavioral health multidisciplinary personnel teams composed of clinicians, medical staff, social services workers, case managers, and other trained personnel to coordinate care for justice‑involved people with mental illness.
Team members may disclose and exchange information that would otherwise be confidential if a member reasonably believes the disclosure is required to identify mental illness or provide services.
Discussions at team meetings are confidential and testimony about those discussions is inadmissible in criminal, civil, or juvenile court proceedings.
Each county must adopt and publish protocols that list the data elements to be shared, participating agencies, use limitations, retention schedules, security training requirements, confidentiality statements, and required security controls.
All transmissions and handling of records must comply with CMIA, HIPAA, HITECH, the Information Practices Act, and other applicable state and federal privacy and security laws; recipients face the same confidentiality obligations and penalties as the disclosing agency.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Purpose — expedited identification and linkage
This paragraph establishes the statutory purpose: counties may create multidisciplinary teams to expedite identification, assessment, and linkage of justice‑involved people with mental illness to supportive services during incarceration and after release. Practically, this gives counties a discrete authority to coordinate across custody, health, and social services systems to reduce care gaps at release.
Definitions — who counts as a team and a provider agency
The bill defines a behavioral health multidisciplinary personnel team as two or more trained persons qualified to deliver behavioral health services and lists possible members (behavioral health, medical personnel, social workers, case managers). It also defines 'justice‑involved person' and enumerates provider agencies (social services, health, behavioral health, substance abuse, probation, law enforcement, legal counsel, veterans, homeless services, tribal programs). Those definitions are the gatekeepers for who can receive shared information and who falls under the statute’s requirements.
Information sharing rules, confidentiality, and electronic exchange
This subdivision allows disclosure and exchange among team members of information that might otherwise be confidential, but only when a member reasonably believes the exchange is required for identification or service provision. It makes team meeting discussions themselves confidential and bars testimony about them in court. The section also authorizes electronic exchange if identity verification is adequate, limits disclosures to team members or designated qualified persons, and obliges teams to maintain secure, standardized sharing processes that guard against unauthorized access.
Case‑specific designation of external providers
Counties may designate staff from a provider agency (as defined earlier) to serve as a member of the team for a particular case. This mechanism lets counties bring outside clinicians, tribal program staff, or veterans services personnel into the team’s information loop on a case‑by‑case basis while subjecting them to the statute’s confidentiality constraints.
County protocols: content, distribution, and posting
This provision directs counties to develop protocols that govern what information can be shared, who participates, how shared information will be used, retention schedules, and security and training requirements. Protocols must require confidentiality statements for all who access the information and mandate security controls that meet state and federal standards. Counties must distribute the protocol to participating agencies and post it on the county website within 30 days of adoption, creating a public record and a minimum transparency standard.
Privacy law compliance and penalties
The statute cross‑references and requires compliance with CMIA, HIPAA, HITECH, the Information Practices Act, and related regulations. It makes clear the section does not supplant existing privacy laws and states that information provided to team members is private and protected from discovery; existing civil and criminal penalties apply for inappropriate disclosure. Operationally, counties and agencies will need to align practice with multiple overlapping legal regimes and enforce the confidentiality obligations across participating entities.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Justice‑involved adults with mental illness — faster identification and coordinated linkage to treatment, housing, and social supports during custody and at reentry may reduce service gaps at release.
- County behavioral health and jail health administrators — a statutory mechanism to formalize cross‑agency coordination and reduce handoff failures between custody and community care.
- Community providers (homeless services, veterans programs, substance use treatment) — clearer pathways to receive referrals and case information necessary to begin services promptly at release.
- Case managers and care coordinators — legal authority to access relevant records across agencies for care planning, improving the likelihood of continuity.
- Probation and reentry programs — better clinical information at release can inform supervision plans and targeted supports that may lower recidivism risk.
Who Bears the Cost
- Counties and participating agencies — required to develop, distribute, and post protocols, implement security controls, identity verification systems, and provide ongoing training and confidentiality monitoring.
- IT and privacy teams at provider agencies — must design or adapt systems for secure electronic exchange, ensure compliance with multiple privacy statutes, and manage access controls and retention schedules.
- Smaller community providers and tribal programs — may face disproportionate administrative and technical burdens to meet the statute’s security, training, and confidentiality statement requirements.
- Legal and compliance officers — increased workload to interpret intersections with attorney‑client privilege, respond to subpoenas, and defend against potential disclosure claims or penalties.
- Justice‑involved individuals — potential privacy risk if protocols or safeguards fail; increased data sharing may expose sensitive information to a broader set of agency actors.
Key Issues
The Core Tension
The central tension is between two legitimate objectives: rapid, cross‑agency information sharing to secure continuity of care for justice‑involved people with mental illness, and strict privacy and legal protections for highly sensitive health and legal information. Enabling timely service linkage requires broad access; protecting individual rights requires narrow, auditable sharing — and the bill asks counties to find the operational middle ground without prescribing precise standards or funding.
The bill balances coordination against confidentiality by permitting disclosures only when a team member 'reasonably believes' the information is required for identification or services, but it does not define that reasonableness standard. That creates implementation ambiguity: counties must translate a subjective standard into operational criteria to prevent overbroad disclosures and to defend decisions in audits or litigation.
The statute’s inadmissibility rule for team meeting discussions is broad, but it does not resolve how that protection interacts with discovery obligations in civil litigation or with subpoenas compelled by other statutes.
Operationally, the statute attaches significant technical and administrative demands to local actors. Complying with CMIA, HIPAA, HITECH, and the Information Practices Act simultaneously requires mapping overlapping scopes of protected data, reconciling consent and authorization rules, and implementing identity verification and retention policies.
Counties and small providers will need funding and technical assistance to meet these requirements; absent that, the law risks creating unequal implementation where better‑resourced counties run effective teams while others cannot.
The statute also raises a delicate tension around attorney involvement: it lists legal counsel as a provider agency eligible to receive shared information, but that raises potential conflicts with privilege and the defendant’s control over communications. Finally, the authorization to designate outside providers as case‑specific team members shifts lines of accountability; counties must clearly define when designation is appropriate, who controls the shared records, and how to audit access to prevent mission creep.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.