California Senate Bill SB482 Amended / Bill

 BILL NUMBER: SB 482AMENDED BILL TEXT AMENDED IN SENATE APRIL 14, 2009 INTRODUCED BY Senator Padilla FEBRUARY 26, 2009 An act to  amend Section 2000   add Chapter 3.5 (commencing with Section 1500) to Division 2  of the Business and Professions Code, relating to healing arts. LEGISLATIVE COUNSEL'S DIGEST SB 482, as amended, Padilla.  Healing arts: medical practice.   Biological data analysis services: regulation.   Existing law provides for the licensure and regulation of clinical laboratories and clinical laboratory personnel by the State Department of Public Health and makes a violation of these provisions a misdemeanor. Under existing law, only designated health care personnel are authorized to perform, under specified conditions, clinical laboratory tests or examinations that are classified as waived, moderate complexity, or high complexity under federal law.   This bill would require an entity that provides post-CLIA bioinformatics services, as defined, to contract with a licensed clinical laboratory to process biological specimen collection kits, except as specified. The bill would require an entity that provides post-CLIA bioinformatics services to employ a specified expert for approval of the algorithms used in the interpretation of the biological data of a customer. The bill would further impose on an entity that provides post-CLIA bioinformatics services specified privacy, recordkeeping, disclosure, and audit requirements, and would impose specified duties on the State Department of Public Health in that regard. The bill would also subject those entities to specified provisions of existing law prohibiting unearned rebates, refunds, and discounts, a violation of which constitutes a crime. Because the bill would expand the scope of a crime, the bill would impose a state-mandated local program.   The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.   This bill would provide that no reimbursement is required by this act for a specified reason.   Under existing law, the Medical Practice Act, the Medical Board of California licenses and regulates physicians and surgeons.   This bill would make a nonsubstantive change to one of those provisions.  Vote: majority. Appropriation: no. Fiscal committee:  no   yes  . State-mandated local program:  no   yes  . THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:  SECTION 1.   The Legislature finds and declares all of the following:   (a) In the wake of the successful completion of the Human Genome Project and the development of leading edge biotechnologies, the state recognizes that new benefits to consumers' health have the potential to be realized. The growing area of personalized medicine promises to tailor prevention, diagnosis, and treatment of diseases to an individual's unique biological profile, integrating an individual's personal data with research findings in genomics, pharmacogenetics, and, eventually, proteomics and metabolomics.   (b) Because of the complexity and size of the individual data sets generated using recently developed technologies, specialized expertise is needed to bridge the gap between production of the data in a clinical laboratory and use of the data in the delivery of health care. This expertise, which spans the fields of bioinformatics, statistics, epidemiology, computer science, and information technology, is distinct from the skills involved in traditional clinical laboratory functions and also from the skills involved in the practice of clinical medicine.   (c) Current regulatory structures enforce high technical standards for biological data that are produced by licensed clinical laboratories with appropriate oversight, documentation, and validation. But in order to facilitate the integration of personalized medicine into the health care system, the state should establish standards for the postproduction interpretation of biological data that are separate and distinct from those established for the production of that data.   (d) By defining and regulating the distinct role of postproduction data interpretation, the state intends to promote flexibility and innovation in the development of methods to interpret individuals' biological profiles in the context of personalized medicine. Allowing individuals to access their personal biological data can also offer research and educational opportunities, since an active, personal stake can promote scientific literacy and a new research model that actively engages with consumers. At the same time, ensuring public trust and consumer protection requires the enumeration of consumer rights with regard to personal data, as well as appropriate standards for transparency, quality assurance, and accountability.   (e) In order to achieve the above-stated goals, it is necessary for entities providing postproduction interpretation of biological data to be regulated in a different way than are those entities providing traditional laboratory functions.   (f) Entities providing postproduction interpretation of biological data should be subject to a specific form of oversight that facilitates the scientific and personal benefits derived therefrom, while also ensuring consumer protection.   SEC. 2.   Chapter 3.5 (commencing with Section 1500) is added to Division 2 of the   Business and Professions Code   , to read:   CHAPTER 3.5. BIOLOGICAL DATA ANALYSIS 1500. For purposes of this chapter, the following definitions have the following meanings: (a) "Algorithm" means a set of calculations, computations, rules, or other bioinformatics processes transparently based on peer-reviewed, published scientific literature and publicly available data that is performed upon a customer's biological data set. (b) "Biological data" means data that are produced from the performance of clinical laboratory science, as defined in paragraph (5) of subdivision (a) of Section 1206, within a clinical laboratory, as defined in paragraph (7) of subdivision (a) of Section 1206, including, but not limited to, the results of a clinical laboratory test, as defined in paragraph (4) of subdivision (a) of Section 1206. "Biological data" also include results of derivations of an individual's biological data produced by post-CLIA bioinformatics services that are presented to, and maintained on behalf of, an individual. (c) "CLIA" has the same meaning as set forth in subdivision (a) of Section 1202.5. (d) "Customer" means any person 18 years of age or older who purchases or consents to post-CLIA bioinformatics services for himself or herself or for a dependent or other individual for whom the customer has legal authority to consent. (e) "Entity" includes a natural person. (f) "Individually identifiable information" means information about an individual customer collected from that individual, including any of the following: (1) A first and last name. (2) A home or other physical address, including street name and name of a city or town. (3) An e-mail address. (4) A telephone number. (5) A social security number. (6) Any other identifier that permits the physical or online contacting of a specific individual. (7) Information concerning a user that an Internet Web site or online service collects online from the user and maintains in personally identifiable form in combination with an identifier described in this subdivision. (g) "Post-CLIA bioinformatics services" means the postproduction interpretation, by means of an algorithm, of biological data. 1501. (a) An entity providing post-CLIA bioinformatics services that provides customers with FDA-approved biological specimen collection kits or biological specimen collection kits exempt from FDA approval under Section 864.3250 of Title 21 of the Code of Federal Regulations, but does not receive or handle biological specimens, shall have a contractual relationship with a licensed clinical laboratory for the receipt and processing of a customer's biological specimens. Notwithstanding that requirement, if an entity that provides post-CLIA bioinformatics services does not provide biological specimen collection kits to customers, the entity may still receive biological data obtained elsewhere by that customer. (b) An entity providing post-CLIA bioinformatics services shall disclose to its customers the CLIA certification status of any clinical laboratory with which the entity has a contractual relationship. (c) Notwithstanding subdivisions (a) and (b), an entity providing post-CLIA bioinformatics services shall not be subject to the requirements for clinical laboratories set forth in Chapter 3 (commencing with Section 1200). 1502. (a) When an entity providing post-CLIA bioinformatics services receives a request from a customer to delete the customer's full biological data set, the entity's privacy administrator shall acknowledge that request within five business days of receipt of the request. Within 30 business days following the acknowledgment, the entity shall irreversibly delete all links between the customer's biological data and his or her individually identifiable information. (b) Deleted biological data may not be used by an entity providing post-CLIA bioinformatics services for any reason, except as set forth in subdivision (c). (c) Biological data that has been included in data sets for research purposes prior to the date an entity acknowledges a request by a customer to delete his or her data, pursuant to subdivision (a), may be used to support those research efforts only if any and all links between the customer's biological data and individually identifiable information has been irreversibly deleted, but may not be used for research efforts commenced subsequent thereto. 1503. (a) An entity providing post-CLIA bioinformatics services shall designate an individual with a PhD or Master's degree in bioinformatics, statistical genetics, biostatistics, or statistics with a biological or medical specialization to be responsible for approving algorithms and documentation thereof and to serve as the point of contact for questions pertaining to the algorithm. The designated individual shall approve documentation of the following: (1) The algorithm and any material changes to the algorithm. (2) (A) The transparent description of the validity of biological data sets and how to perform the algorithm on a biological data set, including references to peer-reviewed, published scientific literature and publicly available data used in the algorithm, along with an explanation of why these references were chosen. (B) The transparent description and any updates shall be provided annually to the State Department of Public Health. (b) An entity providing post-CLIA bioinformatics services shall have an external physician advisory board, which shall provide guidance on the interpretation or presentation of analyses to customers. At least one member of the board shall be licensed to practice medicine in California. (c) An entity providing post-CLIA bioinformatics services may not advise a customer regarding medical or clinical treatment or services. 1504. (a) An entity providing post-CLIA bioinformatics services shall maintain and make available to the public the following information and update it on a regular basis: (1) A description of the algorithm used for interpretation of customers' biological data. (2) Descriptions of the criteria for inclusion in the algorithm of data from scientific studies. (3) Scientific references for background data, evidence, assumptions, and claims made in the development of the algorithm or the presentation of interpretations to customers. (b) In addition to the internal proficiency testing required of clinical laboratories with California clinical laboratory licenses or CLIA certification, an entity providing post-CLIA bioinformatics services shall implement a proficiency testing procedure independent of the clinical laboratory, to be utilized at least every six months, to monitor and ensure integrity of sample processing and data flow or management. Outcomes of internal proficiency testing shall be considered proprietary. 1505. (a) An entity providing post-CLIA bioinformatics services shall maintain the privacy of all biological data consistent with its privacy policies and all requirements of state and federal law. (b) An entity providing post-CLIA bioinformatics services shall disclose its privacy policies to potential and existing customers. (c) An entity providing post-CLIA bioinformatics services shall take all reasonable steps necessary to prevent the release of individually identifiable information without explicit consent from a customer. (d) An entity providing post-CLIA bioinformatics services shall present its interpretation of biological data directly to its customers. If the interpretation is presented over the Internet, access to interpretations shall be password-protected and encrypted. 1506. Prior to the performance of post-CLIA bioinformatics services, the customer receiving biological data or an interpretation of that biological data shall be provided with, and consent to, at a minimum, all of the following: (a) A description of the limitations of service. (b) Clear and conspicuous notice of either of the following: (1) As a condition of the provision of post-CLIA bioinformatics services, that the customer's deidentified biological data sets may be used for research purposes, subject to the requirements of Sections 1502, 1505, and 1507. (2) That the customer must consent to use of the customer's deidentified biological data sets for research purposes, subject to the requirements of Sections 1502, 1505, and 1507. (c) A privacy policy. (d) A procedure for allowing the customer to obtain a copy of his or her full biological data set. (e) A procedure for allowing the customer to request deletion of his or her full biological data set. 1507. (a) An entity providing post-CLIA bioinformatics services shall store biological data in a manner that, if breached, is designed to prevent disclosure of individually identifiable information. (b) An entity providing post-CLIA bioinformatics services that utilizes biological data received to perform research functions may not do either of the following: (1) Release an individual customer's biological data set to any third party without explicit consent from the individual customer. (2) Make any attempt to identify an individual customer's biological data set through the use of other known data such as physical characteristics, ancestry, disease state, or specific biological markers. (c) An entity providing post-CLIA bioinformatics services shall undertake annual external audits of data security procedures, which shall be subject to review by the State Department of Public Health at the entity's principal place of business. 1508. An entity that provides post-CLIA bioinformatics services that is subject to or initiates a business transaction that affects the nature or solvency of the entity, such as a merger, acquisition by another company, or sale of all or a portion of its assets, shall notify every customer in advance of that transaction by e-mail and provide prominent notice on its Internet Web site of any such change in ownership or control of the customer's personal information. An acquiring company or merger agreement shall uphold the material terms of the entity's privacy obligations to its customers, including honoring requests for account deletion. 1509. All biological data derived from post-CLIA bioinformatics services shall be considered to contain "genetic characteristics," as defined in Section 1374.7 of the Health and Safety Code and Section 10146 of the Insurance Code, and shall be subject to the prohibitions set forth in those provisions. 1510. An entity providing post-CLIA bioinformatics services, upon a customer's request, shall provide information regarding the availability of genetic counselors or physicians and surgeons or other genetic experts. 1511. An entity providing post-CLIA bioinformatics services shall be subject to Section 650.   SEC. 3.   No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.   SECTION 1.   Section 2000 of the Business and Professions Code is amended to read: 2000. This chapter shall be known and may be cited as the Medical Practice Act. Whenever any reference is made to the Medical Practice Act by the provisions of any statute, it is to be construed as referring to the provisions of this chapter.