Amended in Assembly April 28, 2016

Amended in Assembly April 11, 2016

Amended in Assembly March 28, 2016

California Legislature—2015–16 Regular Session

Assembly Bill No. 2688

Introduced by Assembly Member Gordon

February 19, 2016

An act to add Chapter 22.4 (commencing with Section 22596) to Division 8 of the Business and Professions Code, relating to privacy.

LEGISLATIVE COUNSEL’S DIGEST

AB 2688, as amended, Gordon. Privacy: commercial health monitoring programs.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law.

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, begin delete disclosing, using for marketing, end delete or begin delete otherwise using end delete begin insert disclosing end insert health begin insert monitoring end insert information in possession of or derived from a commercial health monitoring program to a 3rd party, as defined, without first obtaining explicit authorization, as provided, and would begin delete extend this prohibition to end delete begin insert specify that an authorization is not required where monitoring end insert a 3rd party begin delete that end delete solely provides a service to the begin delete program. end delete begin insert program and does not further use or disclose health monitoring information. end insert The bill would also require an employer that receives health begin insert monitoring end insert information in possession of or derived from a commercial health monitoring program to establish procedures to ensure the confidentiality begin delete of, and protection from unauthorized use and disclosure of, end delete begin insert and security of end insert that information, as provided. The bill would further prohibit an employer from discriminating against an employee based on an employee’s health begin insert monitoring end insert information or if that employee does not authorize the use of his or her health begin insert monitoring end insert information. The bill would exempt a covered entity, provider of health care, business begin delete entity, end delete begin insert associate, end insert health care service plan, contractor, employer, or any other person subject to begin delete and compliant with end delete the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) begin delete and end delete begin insert or end insert the Confidentiality of Medical Information Act from these requirements.

Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Chapter 22.4 (commencing with Section 22596)
is added to Division 8 of the Business and Professions Code, to
read:

 

Chapter  22.4. Digital Commercial Health Monitoring
Programs

 

22596.  

For purposes of this chapter:

(a) “Commercial health monitoring program” means a
commercial Internet Web site or online service used by consumers
that collects health begin insert monitoring end insert information regarding begin delete an
individual’s end delete begin insert the consumer’s end insert mental or physical condition from
sources including, but not limited to, manual entry, sensors, or
both.

(b) “Health begin insert monitoring end insert information” begin delete mean end delete begin insert means end insert any
individually identifiable information, in electronic or physical
form, in possession of, or derived from, a commercial health
monitoring program regarding a consumer’s mental or physical
condition.

(c) “Individually identifiable” means that the health begin insert monitoring end insert
information includes or contains an element of personal identifying
information sufficient to allow identification of the begin delete individual, end delete
begin insert consumer, end insert including, but not limited to, the begin delete individual’s end delete begin insert consumer’s end insert
name, address, electronic mail address, telephone number, social
security number, or unique electronic identifier, or other
information that, alone or in combination with other publicly
available information, reveals the begin delete individual’s end delete begin insert consumer’s end insert identity.

(d) “Third party” begin delete means end delete begin insert includes, but is not limited to, end insert an
advertising network, consumer data reseller, data analytics
provider, begin delete provider of health care, end delete health care service plan,
pharmaceutical company, government entity, operating system or
platform, social network, or other commercial Internet Web site
or online service.

begin insert

(e) “Consumer” includes employees of employers subject to
the provisions of Section 22596.2.

end insert begin insert

(f) “Business associate” means a person or entity who provides,
other than in the capacity of a member of the workforce of an
operator of a commercial health monitoring program, legal,
actuarial, accounting, consulting, data aggregation (as defined
in the federal Health Insurance Portability and Accountability Act
of 1996 (HIPAA) (Public Law 104-191)), management,
administrative, accreditation, or financial services to or for a
consumer health monitoring program where the provision of the
service involves the disclosure of health monitoring information
from a commercial health monitoring program or from another
business associate of a commercial health monitoring program.

end insert

22596.1.  

(a) An operator of a commercial health monitoring
program shall not intentionally share, sell, begin delete disclose, use for
marketing, end delete or begin delete otherwise use end delete begin insert disclose end insert health begin insert monitoring end insert information
to or with a third party without first obtaining begin insert from the consumer end insert
explicit begin insert opt-in end insert authorization begin delete from the individual. The end delete begin insert which fulfills
the following requirements: end insert

begin insert (1) end insert begin insert   end insert begin insert The request for authorization shall be clear, conspicuous,
and separate from all other authorizations or agreements. end insert

begin insert (2) end insert begin insert   end insert begin insert The end insert request for authorization shall include the begin insert name and end insert
nature of the third party and the reason for the request.

begin insert

(3) Each request for authorization shall be limited to a single
third-party entity.

end insert begin insert

(4) A consumer’s refusal to authorize third-party disclosure of
health monitoring information shall not limit the consumer’s ability
to use the commercial health monitoring program even if features
and services provided by the specific third party are inoperable.

end insert begin insert

(5) A waiver of any legal right, penalty, remedy, forum, or
enforcement procedure imposed as a condition of use is
unconscionable and unenforceable. Any person who seeks to
enforce such a waiver shall have the burden of proving that the
waiver was knowing and voluntary and was not made as a
condition of use.

end insert begin insert

(6) Each request for authorization shall state that a consumer
has the right to revoke the authorization at any time without cost
or penalty by a readily accessible method.

end insert

(b)  begin delete (1) end delete begin delete   end delete begin delete An end delete begin insert Notwithstanding subdivision (a), an end insert authorization
is not required where the third party solely provides services to
the operator of the commercial health monitoring begin delete program. end delete

begin insert program and does not further use or disclose health monitoring
information. end insert

begin delete

(2) A third party that solely provides services to the operator of
the commercial health monitoring program shall not further
disclose health information, subject to the authorization
requirements of subdivision (a).

end delete

(c) An operator of a commercial health monitoring program
that creates, maintains, preserves, stores, abandons, destroys, or
disposes of health begin insert monitoring end insert information shall do so in a manner
that preserves the begin insert security and end insert confidentiality of the health
begin insert monitoring end insert information contained therein.

(d) This chapter is not intended to limit the required disclosure
of health begin insert monitoring end insert information pursuant to another provision of
law.

(e) Nothing in this chapter shall be construed to limit or
otherwise begin delete affect end delete begin insert reduce end insert existing privacy protections provided for
in state or federal law.

begin insert

(f) Health monitoring information may be disclosed to a provider
of health care or other health care professional or facility to aid
the diagnosis or treatment of the consumer, where the consumer
is unable to authorize the disclosure due to an emergent medical
condition.

end insert

22596.2.  

(a) An employer that receives health begin insert monitoring end insert
information shall establish appropriate procedures to ensure the
begin insert security and end insert confidentiality begin delete and protection from unauthorized use
and disclosure end delete of information. These procedures may include, but
are not limited to, instruction regarding confidentiality of
employees and agents handling files containing health begin insert monitoring end insert
information and security systems restricting access to files
containing health begin insert monitoring end insert information.

(b) An employer shall not discriminate against an employee in
any terms or conditions of employment due to that employee’s
refusal to provide an authorization pursuant to Section 22596.1.

(c) An employer shall not discriminate against an employee in
any terms or conditions of employment due to the findings of that
employee’s health begin insert monitoring end insert information.

(d) An employer shall not use, disclose, or knowingly permit
its employees or agents to use or disclose health begin insert monitoring end insert
information which the employer possesses pertaining to its
employees without first obtaining authorization to do so.

(e) An employer that has attempted in good faith to comply with
this section shall not be liable for any unauthorized use begin insert or
disclosure end insert of the health begin insert monitoring end insert information by the person or
entity to which the employer disclosed the health begin insert monitoring end insert
information.

(f) A recipient of health begin insert monitoring end insert information pursuant to an
authorization as provided by this chapter shall not further disclose
that health begin insert monitoring end insert information unless in accordance with a
new authorization.

22596.3.  

(a) A covered entity, provider of health care, business
begin delete entity, end delete begin insert associate, end insert health care service plan, contractor, employer,
or any other person subject to begin delete and compliant with end delete the federal Health
Insurance Portability and Accountability Act of 1996 (HIPAA)
begin delete (P.L. end delete begin insert (Public Law end insert 104-191) begin delete and end delete begin insert or end insert the Confidentiality of Medical
Information Act (Part 2.6 (commencing with Section 56) of
Division 1 of the Civil Code) shall not be subject to this begin delete chapter. end delete

begin insert chapter with respect to any activity regulated by those acts. end insert

(b) The definitions in those acts, in effect on January 1, 2016,
shall apply to this section.