BILL NUMBER: AB 2112INTRODUCED BILL TEXT INTRODUCED BY Assembly Member Monning FEBRUARY 18, 2010 An act to add Part 2.7 (commencing with Section 60) to Division 1 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGEST AB 2112, as introduced, Monning. Prescription Record Privacy Act. The Confidentiality of Medical Information Act prohibits a provider of health care, a health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, unless a specified exception applies. This bill would enact the Prescription Record Privacy Act, prohibiting a person from knowingly disclosing or using regulated records that include prescription information containing individual identifying information for marketing a prescribed product, as provided. The act would not prohibit conduct involving the collection, use, transfer, or sale of regulated records for marketing purposes if the data is aggregated, does not contain individually identifying information, and the data cannot reasonably be used to obtain individually identifying information. This bill would also require that any person who knowingly fails to comply with these provisions be subject to an administrative penalty of at least $10,000. This bill would authorize the Secretary of California Health and Human Services to adopt regulations to implement these provisions. This bill would also require the office of the Attorney General to enforce payment of penalties for violations of these provisions, as provided. Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Part 2.7 (commencing with Section 60) is added to Division 1 of the Civil Code, to read: PART 2.7. Prescription Record Privacy Act 60. This part may be cited as the Prescription Record Privacy Act. 60.5. It is the intent of the legislature to safeguard the confidentiality of prescribing information, protect the integrity of the doctor-patient relationship, maintain the integrity and public trust of the medical profession, combat vexatious and harassing sales practices, restrain undue influence exerted by pharmaceutical industry marketing representatives over prescribing decisions, and further the state's interest in improving the quality and lowering the cost of health care. The legislature intends to regulate the monitoring of prescribing practices only for commercial marketing purposes by companies selling prescribed products. The intent is not to regulate monitoring for other uses, such as quality control, research unrelated to marketing, or use by governments or other entities not in the business of selling health care products. 61. For purposes of this part: (a) "Bona fide clinical trial" means any research project that prospectively assigns human subjects to intervention and comparison groups to study the cause and effect relationship between a medical intervention and a health outcome, has received approval from an appropriate institutional review board, and has been registered at http://ClinicalTrials.gov prior to commencement. (b) "Individual identifying information" means information that directly or indirectly identifies a prescriber or a patient in this state, indicates where the information is derived from, or relates to a prescription for any prescribed product. (c) "Marketing" means any activity by a company making or selling prescribed products, or by that company's agent, intended to influence prescribing or purchasing choices of its products, including, but not limited to: (1) Advertising, publicizing, promoting or sharing information about a product. (2) Identifying individuals to receive a message promoting use of a particular product, including, but not limited to, an advertisement, brochure, or contact by a sales representative. (3) Planning the substance of a sales representative visit or communication or the substance of an advertisement or other promotional message or document. (4) Evaluating or compensating sales representatives. (5) Identifying individuals to receive any form of gift, product sample, consultancy, or any other item, service, compensation or employment of value. (6) Advertising or promoting prescribed products directly to patients. (d) "Person" means a business, individual, corporation, union, association, firm, partnership, committee, or other organization or group of persons. (e) "Pharmacy" means any individual or entity licensed under state law to dispense prescribed products. (f) "Prescribed product" includes a biological product as defined in Section 262 of Title 42 of the United States Code and a device or a drug as defined in Section 321 of Title 21 of the United States Code. (g) "Regulated record" means information or documentation from a prescription written by a prescriber doing business in this state or a prescription dispensed in this state. 62. (a) No person shall knowingly disclose or use regulated records that include prescription information containing individual identifying information for marketing a prescribed product. (b) A regulated record containing individual identifying information may be transferred to another entity, including to another branch or subsidiary of the same firm, only if it carries satisfactory assurance that the recipient will safeguard the records from being disclosed or used for a marketing purpose prohibited under this section. (c) Regulated records containing individual identifying information may be disclosed, sold, transferred, exchanged, or used for nonmarketing purposes. (d) This section does not prohibit conduct involving the collection, use, transfer, or sale of regulated records for marketing purposes if: (1) The data is aggregated. (2) The data does not contain individually identifying information. (3) There is no reasonable basis to believe that the data can be used to obtain individually identifying information. (e) This section shall not prevent any person from disclosing regulated records to the identified individual as long as the information does not include protected information pertaining to any other person. 63. The Secretary of California Health and Human Services may adopt regulations as necessary to implement this part. 64. Any person who knowingly fails to comply with the requirements of this part or regulations adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its regulations, shall be subject to an administrative penalty of at least ten thousand dollars ($10,000) per violation and not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section. Minimum statutory penalties shall be set at ten thousand dollars ($10,000) per violation, notwithstanding Section 125.9 of the Business and Professions Code. 64.5. In addition to any other remedy provided by law, a violation of this chapter shall be an unfair or deceptive act in trade or commerce and an unfair method of competition and may be enforced as an unfair business practice pursuant to Chapter 5 of Part 2 of Division 7 of the Business and Professions Code. 65. (a) The intent of this section is to ensure the confidentiality of data held by a state agency or its agent, which could be used to directly or indirectly identify a patient or a health care professional licensed to prescribe drugs, biological products, or medical devices. (b) For the purposes of this section: (1) "Individual identifying information" shall have the same meaning as in Section 61. (2) "Prescribed product" includes a biological product as defined in Section 262 of Title 42 of the United States Code and a device or a drug as defined in Section 321 of Title 21 of the United States Code. (3) "State health care program" means a program for which the state purchases prescribed products, including, but not limited to, a state pharmaceutical assistance program, or a program for state employees and their dependants, individuals under the supervision of corrections, or state retirees and their dependants with the exception of the state medical assistance program (Medi-Cal). (c) Records held by an agency administering a state health care program that include prescription information containing individual identifying information shall only be disclosed for the purposes allowed in Section 62. (d) Any person who knowingly fails to comply with the requirements of this chapter or rules adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its rules shall be subject to an administrative penalty of not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section. 65.5. (a) The intent of this section is to ensure compliance with federal Medicaid law and regulations prohibiting the disclosure and use of Medicaid data, except to administer the Medicaid program, and to ensure that data held by the state agency or its agents that could directly or indirectly identify patients or health care professionals licensed to prescribe products be kept confidential. (b) The State Department of Health Care Services, which administers the state medical assistance program (Medi-Cal) under subchapter C of Chapter 4 of Title 42 of the Code of Federal Regulations (Medicaid) or a Medicaid waiver approved by the Centers for Medicare and Medicaid Services, shall disclose records that include prescription information only as provided for under Section 431 of Title 42 of the Code of Federal Regulations and the Privacy Act of 1974. The department shall ensure that any agent or contractors with the department are informed of the limitations on redisclosure or use of the data provided for under applicable federal regulations and shall have policies and procedures for insuring compliance with this statute and federal regulations. (c) Any person who knowingly fails to comply with the requirements of this part or rules adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its rules shall be subject to an administrative penalty of not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section. 66. If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected. 67. Nothing in this act shall be interpreted to regulate conduct that takes place entirely outside of the state. 67.5. Nothing in this act shall be interpreted to regulate the content, time, place or manner of any discussion between a prescriber and their patient, or a prescriber and any person representing a prescription drug manufacturer.