California Assembly Bill AB2112 Amended / Bill

 BILL NUMBER: AB 2112AMENDED BILL TEXT AMENDED IN ASSEMBLY APRIL 7, 2010 AMENDED IN ASSEMBLY MARCH 24, 2010 INTRODUCED BY Assembly Member Monning FEBRUARY 18, 2010 An act to add Part 2.7 (commencing with Section 60) to Division 1 of the Civil Code, and to amend Section 130202 of the Health and Safety Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGEST AB 2112, as amended, Monning. Prescription Record Privacy Act. The Confidentiality of Medical Information Act prohibits a provider of health care, a health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, unless a specified exception applies. This bill would enact the Prescription Record Privacy Act, prohibiting a person  or entity, including a pharmacist,  from  knowingly disclosing or using regulated records that include prescription information containing individual identifying information for marketing a prescribed product, as provided, except when information may be transferred to another entity, as provided, and in accordance with other state and federal laws. The act would not prohibit conduct involving the collection, use, transfer, or sale of regulated records for marketing purposes if the data is aggregated, does not contain individual identifying information, and cannot reasonably be used to obtain individual identifying information   selling or releasing to a 3rd party any physician prescribing data for marketing purposes, as defined, except when the data is necessary for any local, state, or federal governmental or oversight activity, as provided, or is necessary for the processing of a health care claim. The bill also would permit the release of physician prescribing data to a licensed health care professional, service plan, contractor, or facility, as provided, a health insurer or disability insurer, or an authorized operator of a program related to the treatment of chronic and seri   ously debilitating or life-threatening conditions. The bill would also permit the release of data for clinical trials or established research projects, as provided  . This bill would also require that any person that knowingly fails to comply with these provisions be subject to an administrative penalty of at least $10,000 and not more than $50,000 per violation. This bill would authorize the Secretary of California Health and Human Services to adopt regulations to implement these provisions. This bill would require the office of the Attorney General to enforce payment of penalties for violations of these provisions, as provided. This bill would also authorize the Office of Health Information Integrity, upon receipt of a complaint of a violation of these provisions, to conduct an administrative hearing, in accordance with the administrative adjudication provisions set forth in the Administrative Procedure Act, and to assess an administrative fine against a person or entity found to have committed a violation of these provisions. Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Part 2.7 (commencing with Section 60) is added to Division 1 of the Civil Code, to read: PART 2.7. Prescription Record Privacy Act 60. This part may be cited as the Prescription Record Privacy Act. 60.5. It is the intent of the Legislature to  further the state's interest in improving the quality and lowering the cost of health care, restrain undue influence exerted by pharmaceutical industry marketing representatives over prescribing decisions, combat vexatious and harassing sales practices,  safeguard the confidentiality of  prescribing information   physician prescribing data  , protect the integrity of the doctor-patient relationship,  and  maintain the integrity and public trust of the medical profession  , combat vexatious and harassing sales practices, restrain undue influence exerted by pharmaceutical industry marketing representatives over prescribing decisions, and further the state's interest in improving the quality and lowering the cost of health care  . The Legislature intends to regulate  the monitoring of prescribing practices   physician prescribing data  only for commercial marketing purposes by companies selling prescribed products. The intent is not to regulate  monitoring for  other uses, such as quality control, research unrelated to marketing, or use by governments or other entities not in the business of selling health care products. 61. For purposes of this part:  (a) "Bona fide clinical trial" means any research project that prospectively assigns human subjects to intervention and comparison groups to study the cause and effect relationship between a medical intervention and a health outcome, has received approval from an appropriate institutional review board, and has been registered at http://ClinicalTrials.gov prior to commencement.   (b) "Individual identifying information" means information that directly or indirectly identifies a prescriber or a patient in this state, indicates where the information is derived from, or relates to a prescription for any prescribed product.   (a) "Licensee" means a person described in Section 4036 or 4037 of the Business and Professions Code.   (c)   (b)  "Marketing" means any activity by a company making or selling prescribed products, or by that company's agent, intended to influence prescribing or purchasing choices of its products, including, but not limited to: (1) Advertising, publicizing, promoting, or sharing information about a product. (2) Identifying individuals to receive a message promoting use of a particular product, including, but not limited to, an advertisement, brochure, or contact by a sales representative. (3) Planning the substance of a sales representative visit or communication or the substance of an advertisement or other promotional message or document. (4) Evaluating or compensating sales representatives. (5) Identifying individuals to receive any form of gift, product sample, consultancy, or any other item, service, compensation, or employment of value. (6) Advertising or promoting prescribed products directly to patients.  (d) "Person" means a business, individual, corporation, union, association, firm, partnership, committee, or other organization or group of persons.   (e) "Pharmacy" means any individual or entity licensed under state law to dispense prescribed products.   (c) "Physician" means a person described in Section 2041 of the Business and Professions Code.   (d) "Physician prescribing data" means information that sets forth a prescription written on or after the operative date of this part by a physician in combination with any data that individually identifies the physician, including a unique number identifier assigned for tracking purposes, telephone number, e-mail address, medical identification number, business or home address, or any other information that can reasonably be used to identify the physician or track the prescribing habits of the physician.   (f)   (e)  "Prescribed product" includes a biological product as defined in Section 262 of Title 42 of the United States Code and a device or a drug as defined in Section 321 of Title 21 of the United States Code.  (g) "Regulated record" means information or documentation from a prescription written by a prescriber doing business in this state or a prescription dispensed in this state.   62. (a) No person shall knowingly disclose or use regulated records that include prescription information containing individual identifying information for marketing a prescribed product.   (b) A regulated record containing individual identifying information may be transferred to another entity, including to another branch or subsidiary of the same firm, only if it carries satisfactory assurance that the recipient will safeguard the records from being disclosed or used for a marketing purpose prohibited under this section and only if the transfer is in accordance with other state and federal laws.   (c) Regulated records containing individual identifying information may be disclosed, sold, transferred, exchanged, or used for nonmarketing purposes only in accordance with other state and federal laws.   (d) This section does not prohibit conduct involving the collection, use, transfer, or sale of regulated records for marketing purposes if:   (1) The data is aggregated.   (2) The data does not contain individual identifying information.   (3) There is no reasonable basis to believe that the data can be used to obtain individual identifying information.   (e) This section shall not prevent any person from disclosing regulated records to the identified individual as long as the information does not include protected information pertaining to any other person.   (f) "Release to a third party" or "release" does not include communication or use of physician prescribing data among covered entities that participate in an organized health care arrangement, as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.   62. A person or entity, including a licensee, shall not sell or release to a third party, or exchange for remuneration, any physician prescribing data for marketing purposes.   63. Nothing in this part may be construed to limit or restrict the release of physician prescribing data that is necessary for any local, state, or federal governmental oversight or regulatory activity, including, but not limited to, the release of physician prescribing data to a local, state, or federal law enforcement or public health authority in furtherance of its regulatory activity.   64. Nothing in this part may be construed to limit or restrict the release of physician prescribing data that is necessary for the processing of a health care claim.   65. Nothing in this part is intended to limit or restrict the otherwise lawful activities of a licensee.   66. Nothing in this part is intended to prohibit or limit an individual patient of a physician from releasing any identifiable information relating to a prescription that the patient received, or that the physician wrote, that is not otherwise restricted or prohibited by law.   67. Nothing in this part may be construed to limit or restrict the release of physician prescribing data to any of the following: (a) A licensed health care professional, if the release is directly related to providing health care to a patient. (b) A health insurer or disability insurer, health care service plan, pharmacy benefit manager, employee-sponsored health benefit plan, or their contractors, if the data is directly related to administrating or monitoring the use of a health care benefit. (c) An authorized operator of a program related to the treatment of chronic and seriously debilitating or life-threatening conditions, as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code. (d) An employee benefit plan or any other person or private entity responsible for paying for health care services rendered to the patient, if the physician prescribing data is reasonably necessary to complete or verify a health care transaction related to the prescription information sought to be disclosed. (e) Any health care service plan, contractor, or other health care professional or facility exclusively for purposes of diagnosis or treatment of a patient. (f) Use by a health care service plan or health insurer or disability insurer as permitted or required by Sections 1367.01 or 1370 of the Health and Safety Code or Sections 10123.135 or subdivision (d) of Section 10133 of the Insurance Code.   68. Nothing in this part may be construed to prohibit the release of aggregate prescription data to any individual or entity, provided that data does not include identifiable physician prescribing data as described in this part.   69. (a) Nothing in this part may be construed to prohibit the release of physician prescribing data if it is solely intended to be used for clinical trials or established research projects conducted in accordance with protocols, guidelines, or standards recognized by the federal Health and Human Services Agency, the federal Food and Drug Administration, the National Institutes of Health, the National Cancer Institute, or the Centers for Disease Control and Prevention. (b) Any entity receiving physician prescribing data pursuant to this section may not use the data for any other purpose.   70. Nothing in this part may be construed to limit or restrict the release of physician prescribing data for the purposes of providing the physician with information regarding action by the state or by the federal Food and Drug Administration limiting or disallowing the sale or use of a specific drug, or to provide the physician with information regarding adverse events related to a specific drug or medical device.   71. Nothing in this part shall prohibit the otherwise lawful use or release of physician prescribing data for litigation purposes.   63.   72.  The Secretary of California Health and Human Services may adopt regulations as necessary to implement this part.  64.   73.  Any person that knowingly fails to comply with the requirements of this part or regulations adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its regulations, shall be subject to an administrative penalty of at least ten thousand dollars ($10,000) per violation and not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section. Minimum statutory penalties shall be set at ten thousand dollars ($10,000) per violation, notwithstanding Section 125.9 of the Business and Professions Code.  64.5.   74.  In addition to any other remedy provided by law, a violation of this chapter shall be an unfair or deceptive act in trade or commerce and an unfair method of competition and may be enforced as an unfair business practice pursuant to Chapter 5 of Part 2 of Division 7 of the Business and Professions Code.  65. (a) The intent of this section is to ensure the confidentiality of data held by a state agency or its agent, which could be used to directly or indirectly identify a patient or a health care professional licensed to prescribe drugs, biological products, or medical devices. (b) For the purposes of this section: (1) "Individual identifying information" shall have the same meaning as in Section 61. (2) "Prescribed product" includes a biological product as defined in Section 262 of Title 42 of the United States Code and a device or a drug as defined in Section 321 of Title 21 of the United States Code. (3) "State health care program" means a program for which the state purchases prescribed products, including, but not limited to, a state pharmaceutical assistance program, or a program for state employees and their dependents, individuals under the supervision of corrections, or state retirees and their dependents with the exception of the state medical assistance program (Medi-Cal). (c) Records held by an agency administering a state health care program that include prescription information containing individual identifying information shall only be disclosed for the purposes allowed in Section 62. (d) Any person who knowingly fails to comply with the requirements of this chapter or rules adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its rules shall be subject to an administrative penalty of at least ten thousand dollars ($10,000) per violation and not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section.   65.5. (a) The intent of this part is to ensure compliance with federal Medicaid law and regulations prohibiting the disclosure and use of Medicaid data, except to administer the Medicaid program, and to ensure that data held by the state agency or its agents that could directly or indirectly identify patients or health care professionals licensed to prescribe products be kept confidential. (b) The State Department of Health Care Services, which administers the state medical assistance program (Medi-Cal) under subchapter C of Chapter 4 of Title 42 of the Code of Federal Regulations (Medicaid) or a Medicaid waiver approved by the Centers for Medicare and Medicaid Services, shall disclose records that include prescription information only as provided for under Section 431 of Title 42 of the Code of Federal Regulations and the federal Privacy Act of 1974. The department shall ensure that any agent or contractors with the department are informed of the limitations on redisclosure or use of the data provided for under applicable federal regulations and shall have policies and procedures for ensuring compliance with this statute and federal regulations. (c) Any person that knowingly fails to comply with the requirements of this part or rules adopted pursuant to this part by using or disclosing regulated records in a manner not authorized by this part or its rules shall be subject to an administrative penalty of at least ten thousand dollars ($10,000) per violation and not more than fifty thousand dollars ($50,000) per violation, as assessed by the California Health and Human Services Agency. Each disclosure of a regulated record shall constitute a violation. The office of the Attorney General shall take necessary action to enforce payment of penalties assessed under this section.   66.   75.  If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.  67.   76.  Nothing in this act shall be interpreted to regulate conduct that takes place entirely outside of the state.  67.5.   77.  Nothing in this act shall be interpreted to regulate the content, time, place, or manner of any discussion between a prescriber and his or her patient, or a prescriber and any person representing a prescription drug manufacturer. SEC. 2. Section 130202 of the Health and Safety Code is amended to read: 130202. (a) (1) Upon receipt of a referral from the State Department of Public Health, the office may assess an administrative fine against any person or any provider of health care, whether licensed or unlicensed, for any violation of this division in an amount as provided in Section 56.36 of the Civil Code. Proceedings against any person or entity for a violation of this section shall be held in accordance with the administrative adjudication provisions of Chapter 4.5 (commencing with Section 11400) and Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code. (2) Paragraph (1) shall not apply to a clinic, health facility, agency, or hospice licensed pursuant to Section 1204, 1250, 1725, or 1745 if Senate Bill 541 of the 2007-08 Regular Session is enacted and becomes effective on or before January 1, 2009. (3) Nothing in paragraph (1) shall be construed as authorizing the office to assess the administrative penalties described in Section 1280.15 of the Health and Safety Code. (b) Upon receipt of a complaint under Part 2.7 (commencing with Section 60) of Division 1 of the Civil Code, the office may assess an administrative fine against any person or any provider of health care, whether licensed or unlicensed, for any violation of that part. Proceedings against any person or entity for a violation of Part 2.7 (commencing with Section 60) of Division 1 of the Civil Code shall be held in accordance with the administrative adjudication provisions of Chapter 4.5 (commencing with Section 11400) and Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code. (c) The office shall adopt, amend, or repeal, in accordance with the provisions of Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code, such rules and regulations as may be reasonable and proper to carry out the purposes and intent of this division, and to enable the authority to exercise the powers and perform the duties conferred upon it by this division not inconsistent with any other provision of law. (d) Paragraph (3) of subdivision (a) shall only become operative if Senate Bill 541 of the 2007-08 Regular Session is enacted and becomes effective on or before January 1, 2009.