| Old | New | Differences | |
|---|---|---|---|
| 1 | - | ||
| 1 | + | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 2280Introduced by Assembly Member ChauFebruary 14, 2020 An act to amend Sections 56.05 and 56.06 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 2280, as introduced, Chau. Information privacy: digital health feedback systems. Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition. The bill would provide that a business that offers personal health record software or hardware to a consumer, in order to make information available to an individual or provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. Because the bill would expand the definition of a crime, it would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill TextThe people of the State of California do enact as follows:SECTION 1. Section 56.05 of the Civil Code is amended to read:56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.SEC. 2. Section 56.06 of the Civil Code is amended to read:56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution. | |
| 2 | 2 | ||
| 3 | - | ||
| 3 | + | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION Assembly Bill No. 2280Introduced by Assembly Member ChauFebruary 14, 2020 An act to amend Sections 56.05 and 56.06 of the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGESTAB 2280, as introduced, Chau. Information privacy: digital health feedback systems. Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition. The bill would provide that a business that offers personal health record software or hardware to a consumer, in order to make information available to an individual or provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. Because the bill would expand the definition of a crime, it would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES | |
| 4 | 4 | ||
| 5 | - | Amended IN Senate July 14, 2020 | |
| 6 | 5 | ||
| 7 | - | Amended IN Senate July 14, 2020 | |
| 6 | + | ||
| 7 | + | ||
| 8 | 8 | ||
| 9 | 9 | CALIFORNIA LEGISLATURE 20192020 REGULAR SESSION | |
| 10 | 10 | ||
| 11 | 11 | Assembly Bill | |
| 12 | 12 | ||
| 13 | 13 | No. 2280 | |
| 14 | 14 | ||
| 15 | 15 | Introduced by Assembly Member ChauFebruary 14, 2020 | |
| 16 | 16 | ||
| 17 | 17 | Introduced by Assembly Member Chau | |
| 18 | 18 | February 14, 2020 | |
| 19 | 19 | ||
| 20 | 20 | An act to amend Sections 56.05 and 56.06 of the Civil Code, relating to privacy. | |
| 21 | 21 | ||
| 22 | 22 | LEGISLATIVE COUNSEL'S DIGEST | |
| 23 | 23 | ||
| 24 | 24 | ## LEGISLATIVE COUNSEL'S DIGEST | |
| 25 | 25 | ||
| 26 | - | AB 2280, as | |
| 26 | + | AB 2280, as introduced, Chau. Information privacy: digital health feedback systems. | |
| 27 | 27 | ||
| 28 | - | Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved | |
| 28 | + | Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition. The bill would provide that a business that offers personal health record software or hardware to a consumer, in order to make information available to an individual or provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. Because the bill would expand the definition of a crime, it would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason. | |
| 29 | 29 | ||
| 30 | 30 | Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor. | |
| 31 | 31 | ||
| 32 | - | This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved | |
| 32 | + | This bill would define personal health record information for purposes of the act to mean individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition. The bill would provide that a business that offers personal health record software or hardware to a consumer, in order to make information available to an individual or provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. Because the bill would expand the definition of a crime, it would impose a state-mandated local program. | |
| 33 | 33 | ||
| 34 | 34 | The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. | |
| 35 | 35 | ||
| 36 | 36 | This bill would provide that no reimbursement is required by this act for a specified reason. | |
| 37 | 37 | ||
| 38 | 38 | ## Digest Key | |
| 39 | 39 | ||
| 40 | 40 | ## Bill Text | |
| 41 | 41 | ||
| 42 | - | The people of the State of California do enact as follows:SECTION 1. Section 56.05 of the Civil Code is amended to read:56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, | |
| 42 | + | The people of the State of California do enact as follows:SECTION 1. Section 56.05 of the Civil Code is amended to read:56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.SEC. 2. Section 56.06 of the Civil Code is amended to read:56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution. | |
| 43 | 43 | ||
| 44 | 44 | The people of the State of California do enact as follows: | |
| 45 | 45 | ||
| 46 | 46 | ## The people of the State of California do enact as follows: | |
| 47 | 47 | ||
| 48 | - | SECTION 1. Section 56.05 of the Civil Code is amended to read:56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, | |
| 48 | + | SECTION 1. Section 56.05 of the Civil Code is amended to read:56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 49 | 49 | ||
| 50 | 50 | SECTION 1. Section 56.05 of the Civil Code is amended to read: | |
| 51 | 51 | ||
| 52 | 52 | ### SECTION 1. | |
| 53 | 53 | ||
| 54 | - | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, | |
| 54 | + | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 55 | 55 | ||
| 56 | - | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, | |
| 56 | + | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 57 | 57 | ||
| 58 | - | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, | |
| 58 | + | 56.05. For purposes of this part:(a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information.(b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20.(c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee.(d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse.(f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code.(g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code).(h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code.(i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.Marketing does not include any of the following:(1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication.(2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals.(3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply:(A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration.(B) The individual is provided the opportunity to opt out of receiving future remunerated communications.(C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request.(j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity.(k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains.(l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information.(m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record.(l)(n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care.(m)(o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code.(n)(p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section.(o)(q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 59 | 59 | ||
| 60 | 60 | ||
| 61 | 61 | ||
| 62 | 62 | 56.05. For purposes of this part: | |
| 63 | 63 | ||
| 64 | 64 | (a) Authorization means permission granted in accordance with Section 56.11 or 56.21 for the disclosure of medical information. | |
| 65 | 65 | ||
| 66 | 66 | (b) Authorized recipient means any person who is authorized to receive medical information pursuant to Section 56.10 or 56.20. | |
| 67 | 67 | ||
| 68 | - | (c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee. | |
| 68 | + | (c) Confidential communications request means a request by a subscriber or enrollee that health care service plan communications containing medical information be communicated to him or her the subscriber or enrollee at a specific mail or email address or specific telephone number, as designated by the subscriber or enrollee. | |
| 69 | 69 | ||
| 70 | 70 | (d) Contractor means any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care. Contractor does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code or pharmaceutical benefits managers licensed pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). | |
| 71 | 71 | ||
| 72 | - | (e) Endanger means that the subscriber or enrollee fears that disclosure of their medical information could subject the subscriber or enrollee to harassment or abuse. | |
| 72 | + | (e) Endanger means that the subscriber or enrollee fears that disclosure of his or her their medical information could subject the subscriber or enrollee to harassment or abuse. | |
| 73 | 73 | ||
| 74 | 74 | (f) Enrollee has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 75 | 75 | ||
| 76 | 76 | (g) Health care service plan means any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975 (Chapter 2.2 (commencing with Section 1340) of Division 2 of the Health and Safety Code). | |
| 77 | 77 | ||
| 78 | 78 | (h) Licensed health care professional means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or Division 2.5 (commencing with Section 1797) of the Health and Safety Code. | |
| 79 | 79 | ||
| 80 | 80 | (i) Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. | |
| 81 | 81 | ||
| 82 | 82 | Marketing does not include any of the following: | |
| 83 | 83 | ||
| 84 | 84 | (1) Communications made orally or in writing for which the communicator does not receive direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication. | |
| 85 | 85 | ||
| 86 | 86 | (2) Communications made to current enrollees solely for the purpose of describing a providers participation in an existing health care provider network or health plan network of a Knox-Keene licensed health plan to which the enrollees already subscribe; communications made to current enrollees solely for the purpose of describing if, and the extent to which, a product or service, or payment for a product or service, is provided by a provider, contractor, or plan or included in a plan of benefits of a Knox-Keene licensed health plan to which the enrollees already subscribe; or communications made to plan enrollees describing the availability of more cost-effective pharmaceuticals. | |
| 87 | 87 | ||
| 88 | 88 | (3) Communications that are tailored to the circumstances of a particular individual to educate or advise the individual about treatment options, and otherwise maintain the individuals adherence to a prescribed course of medical treatment, as provided in Section 1399.901 of the Health and Safety Code, for a chronic and seriously debilitating or life-threatening condition as defined in subdivisions (d) and (e) of Section 1367.21 of the Health and Safety Code, if the health care provider, contractor, or health plan receives direct or indirect remuneration, including, but not limited to, gifts, fees, payments, subsidies, or other economic benefits, from a third party for making the communication, if all of the following apply: | |
| 89 | 89 | ||
| 90 | 90 | (A) The individual receiving the communication is notified in the communication in typeface no smaller than 14-point type of the fact that the provider, contractor, or health plan has been remunerated and the source of the remuneration. | |
| 91 | 91 | ||
| 92 | 92 | (B) The individual is provided the opportunity to opt out of receiving future remunerated communications. | |
| 93 | 93 | ||
| 94 | 94 | (C) The communication contains instructions in typeface no smaller than 14-point type describing how the individual can opt out of receiving further communications by calling a toll-free number of the health care provider, contractor, or health plan making the remunerated communications. No further communication may be made to an individual who has opted out after 30 calendar days from the date the individual makes the opt out request. | |
| 95 | 95 | ||
| 96 | - | (j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history | |
| 96 | + | (j) Medical information means any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patients medical history, mental or physical condition, or treatment. Individually identifiable means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patients name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individuals identity. | |
| 97 | 97 | ||
| 98 | 98 | (k) Patient means any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. | |
| 99 | 99 | ||
| 100 | - | (l) Personal health record means an FDA-approved | |
| 100 | + | (l) Personal health record means an FDA-approved commercial internet website, online service, or product that is used by an individual at the direction of a provider of health care with the primary purpose of collecting the individuals individually identifiable personal health record information. | |
| 101 | 101 | ||
| 102 | 102 | (m) Personal health record information means individually identifiable information, in electronic or physical form, about an individuals mental or physical condition that is collected by a personal health record through a direct measurement of an individuals mental or physical condition or through user input regarding an individuals mental or physical condition into a personal health record. | |
| 103 | 103 | ||
| 104 | + | (l) | |
| 105 | + | ||
| 106 | + | ||
| 107 | + | ||
| 104 | 108 | (n) Pharmaceutical company means any company or business, or an agent or representative thereof, that manufactures, sells, or distributes pharmaceuticals, medications, or prescription drugs. Pharmaceutical company does not include a pharmaceutical benefits manager, as included in subdivision (c), or a provider of health care. | |
| 109 | + | ||
| 110 | + | (m) | |
| 111 | + | ||
| 112 | + | ||
| 105 | 113 | ||
| 106 | 114 | (o) Provider of health care means any person licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code; any person licensed pursuant to the Osteopathic Initiative Act or the Chiropractic Initiative Act; any person certified pursuant to Division 2.5 (commencing with Section 1797) of the Health and Safety Code; any clinic, health dispensary, or health facility licensed pursuant to Division 2 (commencing with Section 1200) of the Health and Safety Code. Provider of health care does not include insurance institutions as defined in subdivision (k) of Section 791.02 of the Insurance Code. | |
| 107 | 115 | ||
| 116 | + | (n) | |
| 117 | + | ||
| 118 | + | ||
| 119 | + | ||
| 108 | 120 | (p) Sensitive services means all health care services described in Sections 6924, 6925, 6926, 6927, 6928, and 6929 of the Family Code, and Sections 121020 and 124260 of the Health and Safety Code, obtained by a patient at or above the minimum age specified for consenting to the service specified in the section. | |
| 121 | + | ||
| 122 | + | (o) | |
| 123 | + | ||
| 124 | + | ||
| 109 | 125 | ||
| 110 | 126 | (q) Subscriber has the same meaning as that term is defined in Section 1345 of the Health and Safety Code. | |
| 111 | 127 | ||
| 112 | - | SEC. 2. Section 56.06 of the Civil Code is amended to read:56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 128 | + | SEC. 2. Section 56.06 of the Civil Code is amended to read:56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 113 | 129 | ||
| 114 | 130 | SEC. 2. Section 56.06 of the Civil Code is amended to read: | |
| 115 | 131 | ||
| 116 | 132 | ### SEC. 2. | |
| 117 | 133 | ||
| 118 | - | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 134 | + | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 119 | 135 | ||
| 120 | - | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 136 | + | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 121 | 137 | ||
| 122 | - | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 138 | + | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part.(c)(d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.(d)(e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.(e)(f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 123 | 139 | ||
| 124 | 140 | ||
| 125 | 141 | ||
| 126 | - | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part. | |
| 142 | + | 56.06. (a) Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part. | |
| 127 | 143 | ||
| 128 | - | (b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part. | |
| 144 | + | (b) Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part. | |
| 129 | 145 | ||
| 130 | 146 | (c) Any business that offers personal health record software or hardware to a consumer, including a mobile application or other related device that is designed to maintain personal health record information, as defined in subdivision (m) of Section 56.05, in order to make information available to an individual or to a provider of health care at the request of the individual or provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. | |
| 131 | 147 | ||
| 148 | + | (c) | |
| 149 | + | ||
| 150 | + | ||
| 151 | + | ||
| 132 | 152 | (d) Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part. | |
| 133 | 153 | ||
| 154 | + | (d) | |
| 155 | + | ||
| 156 | + | ||
| 157 | + | ||
| 134 | 158 | (e) Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. | |
| 159 | + | ||
| 160 | + | (e) | |
| 161 | + | ||
| 162 | + | ||
| 135 | 163 | ||
| 136 | 164 | (f) Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part. | |
| 137 | 165 | ||
| 138 | 166 | SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution. | |
| 139 | 167 | ||
| 140 | 168 | SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution. | |
| 141 | 169 | ||
| 142 | 170 | SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution. | |
| 143 | 171 | ||
| 144 | 172 | ### SEC. 3. |