| 1 | 1 | | CALIFORNIA LEGISLATURE 20172018 REGULAR SESSION Assembly Bill No. 2935Introduced by Assembly Member ChauFebruary 16, 2018 An act to add Division 1.7 (commencing with Section 1181) to the Health and Safety Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 2935, as introduced, Chau. Health information privacy: digital commercial health monitoring.Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent, except as provided. The bill would require an operator of a commercial health monitoring program, upon request, to delete a consumers individually identifiable health monitoring information, and to maintain or delete individually identifiable health monitoring information in a manner that preserves security and confidentiality. The bill would define terms for its purposes and exempt entities and individuals subject to HIPAA or the Confidentiality of Medical Information Act from these requirements.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Division 1.7 (commencing with Section 1181) is added to the Health and Safety Code, to read:DIVISION 1.7. Health Information Privacy CHAPTER 1. Digital Commercial health Monitoring1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity.1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 2 | 2 | | |
|---|
| 3 | 3 | | CALIFORNIA LEGISLATURE 20172018 REGULAR SESSION Assembly Bill No. 2935Introduced by Assembly Member ChauFebruary 16, 2018 An act to add Division 1.7 (commencing with Section 1181) to the Health and Safety Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 2935, as introduced, Chau. Health information privacy: digital commercial health monitoring.Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent, except as provided. The bill would require an operator of a commercial health monitoring program, upon request, to delete a consumers individually identifiable health monitoring information, and to maintain or delete individually identifiable health monitoring information in a manner that preserves security and confidentiality. The bill would define terms for its purposes and exempt entities and individuals subject to HIPAA or the Confidentiality of Medical Information Act from these requirements.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | |
|---|
| 6 | 6 | | |
|---|
| 7 | 7 | | |
|---|
| 8 | 8 | | |
|---|
| 9 | 9 | | CALIFORNIA LEGISLATURE 20172018 REGULAR SESSION |
|---|
| 10 | 10 | | |
|---|
| 11 | 11 | | Assembly Bill No. 2935 |
|---|
| 12 | 12 | | |
|---|
| 13 | 13 | | Introduced by Assembly Member ChauFebruary 16, 2018 |
|---|
| 14 | 14 | | |
|---|
| 15 | 15 | | Introduced by Assembly Member Chau |
|---|
| 16 | 16 | | February 16, 2018 |
|---|
| 17 | 17 | | |
|---|
| 18 | 18 | | An act to add Division 1.7 (commencing with Section 1181) to the Health and Safety Code, relating to privacy. |
|---|
| 19 | 19 | | |
|---|
| 20 | 20 | | LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 21 | 21 | | |
|---|
| 22 | 22 | | ## LEGISLATIVE COUNSEL'S DIGEST |
|---|
| 23 | 23 | | |
|---|
| 24 | 24 | | AB 2935, as introduced, Chau. Health information privacy: digital commercial health monitoring. |
|---|
| 25 | 25 | | |
|---|
| 26 | 26 | | Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent, except as provided. The bill would require an operator of a commercial health monitoring program, upon request, to delete a consumers individually identifiable health monitoring information, and to maintain or delete individually identifiable health monitoring information in a manner that preserves security and confidentiality. The bill would define terms for its purposes and exempt entities and individuals subject to HIPAA or the Confidentiality of Medical Information Act from these requirements. |
|---|
| 27 | 27 | | |
|---|
| 28 | 28 | | Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided. |
|---|
| 29 | 29 | | |
|---|
| 30 | 30 | | This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent, except as provided. The bill would require an operator of a commercial health monitoring program, upon request, to delete a consumers individually identifiable health monitoring information, and to maintain or delete individually identifiable health monitoring information in a manner that preserves security and confidentiality. The bill would define terms for its purposes and exempt entities and individuals subject to HIPAA or the Confidentiality of Medical Information Act from these requirements. |
|---|
| 31 | 31 | | |
|---|
| 32 | 32 | | ## Digest Key |
|---|
| 33 | 33 | | |
|---|
| 34 | 34 | | ## Bill Text |
|---|
| 35 | 35 | | |
|---|
| 36 | 36 | | The people of the State of California do enact as follows:SECTION 1. Division 1.7 (commencing with Section 1181) is added to the Health and Safety Code, to read:DIVISION 1.7. Health Information Privacy CHAPTER 1. Digital Commercial health Monitoring1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity.1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 37 | 37 | | |
|---|
| 38 | 38 | | The people of the State of California do enact as follows: |
|---|
| 39 | 39 | | |
|---|
| 40 | 40 | | ## The people of the State of California do enact as follows: |
|---|
| 41 | 41 | | |
|---|
| 42 | 42 | | SECTION 1. Division 1.7 (commencing with Section 1181) is added to the Health and Safety Code, to read:DIVISION 1.7. Health Information Privacy CHAPTER 1. Digital Commercial health Monitoring1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity.1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 43 | 43 | | |
|---|
| 44 | 44 | | SECTION 1. Division 1.7 (commencing with Section 1181) is added to the Health and Safety Code, to read: |
|---|
| 45 | 45 | | |
|---|
| 46 | 46 | | ### SECTION 1. |
|---|
| 47 | 47 | | |
|---|
| 48 | 48 | | DIVISION 1.7. Health Information Privacy CHAPTER 1. Digital Commercial health Monitoring1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity.1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 49 | 49 | | |
|---|
| 50 | 50 | | DIVISION 1.7. Health Information Privacy CHAPTER 1. Digital Commercial health Monitoring1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity.1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 51 | 51 | | |
|---|
| 52 | 52 | | DIVISION 1.7. Health Information Privacy |
|---|
| 53 | 53 | | |
|---|
| 54 | 54 | | DIVISION 1.7. Health Information Privacy |
|---|
| 55 | 55 | | |
|---|
| 56 | 56 | | CHAPTER 1. Digital Commercial health Monitoring |
|---|
| 57 | 57 | | |
|---|
| 58 | 58 | | CHAPTER 1. Digital Commercial health Monitoring |
|---|
| 59 | 59 | | |
|---|
| 60 | 60 | | CHAPTER 1. Digital Commercial health Monitoring |
|---|
| 61 | 61 | | |
|---|
| 62 | 62 | | 1181. For purposes of this chapter:(a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information.(b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).(c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program.(d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity.(e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following:(1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program.(2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply:(A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program.(B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.(f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program. |
|---|
| 63 | 63 | | |
|---|
| 64 | 64 | | |
|---|
| 65 | 65 | | |
|---|
| 66 | 66 | | 1181. For purposes of this chapter: |
|---|
| 67 | 67 | | |
|---|
| 68 | 68 | | (a) Commercial health monitoring program means a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumers individually identifiable health monitoring information. |
|---|
| 69 | 69 | | |
|---|
| 70 | 70 | | (b) Health care provider has the meaning given that term in the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191). |
|---|
| 71 | 71 | | |
|---|
| 72 | 72 | | (c) Health monitoring information means information, in electronic or physical form, about a consumers mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumers mental or physical condition or though user-input regarding a consumers mental or physical condition into a commercial health monitoring program. |
|---|
| 73 | 73 | | |
|---|
| 74 | 74 | | (d) Individually identifiable means information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumers name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumers identity. |
|---|
| 75 | 75 | | |
|---|
| 76 | 76 | | (e) Service provider means an entity that does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring programs and does either of the following: |
|---|
| 77 | 77 | | |
|---|
| 78 | 78 | | (1) Provides services to the operator, or on behalf of the operator, of the commercial health monitoring program that solely support the functionality or operation of the commercial health monitoring program. |
|---|
| 79 | 79 | | |
|---|
| 80 | 80 | | (2) Controls, is controlled by, or is under common control with the provider of the commercial health monitoring program when both of the following apply: |
|---|
| 81 | 81 | | |
|---|
| 82 | 82 | | (A) The entity maintains third-party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the commercial health monitoring program. |
|---|
| 83 | 83 | | |
|---|
| 84 | 84 | | (B) The operator of the commercial health monitoring program disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business. |
|---|
| 85 | 85 | | |
|---|
| 86 | 86 | | (f) Third party means an entity that is not a service provider, with whom the consumer does not have a direct relationship with respect to the consumers use of the commercial health monitoring program, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program. |
|---|
| 87 | 87 | | |
|---|
| 88 | 88 | | 1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements:(1) The request for consent shall be separate from all other authorizations or agreements.(2) The request for consent shall include the name or nature of the third party and the purpose for the request.(3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable.(B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.(b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal.(c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter.(d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein.(e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law.(f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.(g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:(1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition.(2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information.(h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity. |
|---|
| 89 | 89 | | |
|---|
| 90 | 90 | | |
|---|
| 91 | 91 | | |
|---|
| 92 | 92 | | 1181.10. (a) An operator of a commercial health monitoring program shall not intentionally share, sell, or disclose individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent that fulfills all of the following requirements: |
|---|
| 93 | 93 | | |
|---|
| 94 | 94 | | (1) The request for consent shall be separate from all other authorizations or agreements. |
|---|
| 95 | 95 | | |
|---|
| 96 | 96 | | (2) The request for consent shall include the name or nature of the third party and the purpose for the request. |
|---|
| 97 | 97 | | |
|---|
| 98 | 98 | | (3) (A) A consumers refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumers ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable. |
|---|
| 99 | 99 | | |
|---|
| 100 | 100 | | (B) This paragraph does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent. |
|---|
| 101 | 101 | | |
|---|
| 102 | 102 | | (4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law. |
|---|
| 103 | 103 | | |
|---|
| 104 | 104 | | (b) An operator of a commercial health monitoring program shall make available and provide notice of a process whereby a consumer may withdraw the consent granted in subdivision (a), although the notice does not expressly need to be included in the consent described in subdivision (a). Any withdrawal of consent shall apply prospectively and shall not impact valid disclosures and consent prior to the operative date of withdrawal. |
|---|
| 105 | 105 | | |
|---|
| 106 | 106 | | (c) When health monitoring information is stored in an individually identifiable manner, upon request by the consumer, the operator of the commercial health monitoring program shall delete or provide to the consumer his or her individually identifiable health monitoring information. A commercial health monitoring program may assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information under this chapter. |
|---|
| 107 | 107 | | |
|---|
| 108 | 108 | | (d) An operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the individually identifiable health monitoring information contained therein. |
|---|
| 109 | 109 | | |
|---|
| 110 | 110 | | (e) This chapter is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to another law. |
|---|
| 111 | 111 | | |
|---|
| 112 | 112 | | (f) This chapter shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law. |
|---|
| 113 | 113 | | |
|---|
| 114 | 114 | | (g) Individually identifiable health monitoring information may be disclosed to the following persons without satisfying the consent requirements of this chapter if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable: |
|---|
| 115 | 115 | | |
|---|
| 116 | 116 | | (1) To a health care provider to aid in the diagnosis or treatment of the consumer, when the consumer is unable to consent to the disclosure due to an emergent medical condition. |
|---|
| 117 | 117 | | |
|---|
| 118 | 118 | | (2) To a government official if necessary to prevent an emergency involving danger of death or serious physical injury to a person that requires access to the individually identifiable commercial health information. |
|---|
| 119 | 119 | | |
|---|
| 120 | 120 | | (h) A recipient of individually identifiable health monitoring information that is not a commercial health monitoring program shall not further disclose that health monitoring information. Responsibility for a violation of this paragraph shall not rest with the commercial health monitoring agency but with the disclosing entity. |
|---|
| 121 | 121 | | |
|---|
| 122 | 122 | | 1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts.(b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|
| 123 | 123 | | |
|---|
| 124 | 124 | | |
|---|
| 125 | 125 | | |
|---|
| 126 | 126 | | 1181.20. (a) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) shall not be subject to this chapter with respect to any activity or exemption regulated by those acts. |
|---|
| 127 | 127 | | |
|---|
| 128 | 128 | | (b) The definitions in those acts, in effect on January 1, 2018, shall apply to this section. |
|---|