BILL NUMBER: SB 482 AMENDED
BILL TEXT
AMENDED IN SENATE APRIL 14, 2009
INTRODUCED BY Senator Padilla
FEBRUARY 26, 2009
An act to amend Section 2000 add Chapter
3.5 (commencing with Section 1500) to Division 2 of the
Business and Professions Code, relating to healing arts.
LEGISLATIVE COUNSEL'S DIGEST
SB 482, as amended, Padilla. Healing arts: medical
practice. Biological data analysis services:
regulation.
Existing law provides for the licensure and regulation of clinical
laboratories and clinical laboratory personnel by the State
Department of Public Health and makes a violation of these provisions
a misdemeanor. Under existing law, only designated health care
personnel are authorized to perform, under specified conditions,
clinical laboratory tests or examinations that are classified as
waived, moderate complexity, or high complexity under federal law.
This bill would require an entity that provides post-CLIA
bioinformatics services, as defined, to contract with a licensed
clinical laboratory to process biological specimen collection kits,
except as specified. The bill would require an entity that provides
post-CLIA bioinformatics services to employ a specified expert for
approval of the algorithms used in the interpretation of the
biological data of a customer. The bill would further impose on an
entity that provides post-CLIA bioinformatics services specified
privacy, recordkeeping, disclosure, and audit requirements, and would
impose specified duties on the State Department of Public Health in
that regard. The bill would also subject those entities to specified
provisions of existing law prohibiting unearned rebates, refunds, and
discounts, a violation of which constitutes a crime. Because the
bill would expand the scope of a crime, the bill would impose a
state-mandated local program.
The California Constitution requires the state to reimburse local
agencies and school districts for certain costs mandated by the
state. Statutory provisions establish procedures for making that
reimbursement.
This bill would provide that no reimbursement is required by this
act for a specified reason.
Under existing law, the Medical Practice Act, the Medical Board of
California licenses and regulates physicians and surgeons.
This bill would make a nonsubstantive change to one of those
provisions.
Vote: majority. Appropriation: no. Fiscal committee: no
yes . State-mandated local program: no
yes .
THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS:
SECTION 1. The Legislature finds and declares all
of the following:
(a) In the wake of the successful completion of the Human Genome
Project and the development of leading edge biotechnologies, the
state recognizes that new benefits to consumers' health have the
potential to be realized. The growing area of personalized medicine
promises to tailor prevention, diagnosis, and treatment of diseases
to an individual's unique biological profile, integrating an
individual's personal data with research findings in genomics,
pharmacogenetics, and, eventually, proteomics and metabolomics.
(b) Because of the complexity and size of the individual data sets
generated using recently developed technologies, specialized
expertise is needed to bridge the gap between production of the data
in a clinical laboratory and use of the data in the delivery of
health care. This expertise, which spans the fields of
bioinformatics, statistics, epidemiology, computer science, and
information technology, is distinct from the skills involved in
traditional clinical laboratory functions and also from the skills
involved in the practice of clinical medicine.
(c) Current regulatory structures enforce high technical standards
for biological data that are produced by licensed clinical
laboratories with appropriate oversight, documentation, and
validation. But in order to facilitate the integration of
personalized medicine into the health care system, the state should
establish standards for the postproduction interpretation of
biological data that are separate and distinct from those established
for the production of that data.
(d) By defining and regulating the distinct role of postproduction
data interpretation, the state intends to promote flexibility and
innovation in the development of methods to interpret individuals'
biological profiles in the context of personalized medicine. Allowing
individuals to access their personal biological data can also offer
research and educational opportunities, since an active, personal
stake can promote scientific literacy and a new research model that
actively engages with consumers. At the same time, ensuring public
trust and consumer protection requires the enumeration of consumer
rights with regard to personal data, as well as appropriate standards
for transparency, quality assurance, and accountability.
(e) In order to achieve the above-stated goals, it is necessary
for entities providing postproduction interpretation of biological
data to be regulated in a different way than are those entities
providing traditional laboratory functions.
(f) Entities providing postproduction interpretation of biological
data should be subject to a specific form of oversight that
facilitates the scientific and personal benefits derived therefrom,
while also ensuring consumer protection.
SEC. 2. Chapter 3.5 (commencing with Section 1500)
is added to Division 2 of the Business and Professions
Code , to read:
CHAPTER 3.5. BIOLOGICAL DATA ANALYSIS
1500. For purposes of this chapter, the following definitions
have the following meanings:
(a) "Algorithm" means a set of calculations, computations, rules,
or other bioinformatics processes transparently based on
peer-reviewed, published scientific literature and publicly available
data that is performed upon a customer's biological data set.
(b) "Biological data" means data that are produced from the
performance of clinical laboratory science, as defined in paragraph
(5) of subdivision (a) of Section 1206, within a clinical laboratory,
as defined in paragraph (7) of subdivision (a) of Section 1206,
including, but not limited to, the results of a clinical laboratory
test, as defined in paragraph (4) of subdivision (a) of Section 1206.
"Biological data" also include results of derivations of an
individual's biological data produced by post-CLIA bioinformatics
services that are presented to, and maintained on behalf of, an
individual.
(c) "CLIA" has the same meaning as set forth in subdivision (a) of
Section 1202.5.
(d) "Customer" means any person 18 years of age or older who
purchases or consents to post-CLIA bioinformatics services for
himself or herself or for a dependent or other individual for whom
the customer has legal authority to consent.
(e) "Entity" includes a natural person.
(f) "Individually identifiable information" means information
about an individual customer collected from that individual,
including any of the following:
(1) A first and last name.
(2) A home or other physical address, including street name and
name of a city or town.
(3) An e-mail address.
(4) A telephone number.
(5) A social security number.
(6) Any other identifier that permits the physical or online
contacting of a specific individual.
(7) Information concerning a user that an Internet Web site or
online service collects online from the user and maintains in
personally identifiable form in combination with an identifier
described in this subdivision.
(g) "Post-CLIA bioinformatics services" means the postproduction
interpretation, by means of an algorithm, of biological data.
1501. (a) An entity providing post-CLIA bioinformatics services
that provides customers with FDA-approved biological specimen
collection kits or biological specimen collection kits exempt from
FDA approval under Section 864.3250 of Title 21 of the Code of
Federal Regulations, but does not receive or handle biological
specimens, shall have a contractual relationship with a licensed
clinical laboratory for the receipt and processing of a customer's
biological specimens. Notwithstanding that requirement, if an entity
that provides post-CLIA bioinformatics services does not provide
biological specimen collection kits to customers, the entity may
still receive biological data obtained elsewhere by that customer.
(b) An entity providing post-CLIA bioinformatics services shall
disclose to its customers the CLIA certification status of any
clinical laboratory with which the entity has a contractual
relationship.
(c) Notwithstanding subdivisions (a) and (b), an entity providing
post-CLIA bioinformatics services shall not be subject to the
requirements for clinical laboratories set forth in Chapter 3
(commencing with Section 1200).
1502. (a) When an entity providing post-CLIA bioinformatics
services receives a request from a customer to delete the customer's
full biological data set, the entity's privacy administrator shall
acknowledge that request within five business days of receipt of the
request. Within 30 business days following the acknowledgment, the
entity shall irreversibly delete all links between the customer's
biological data and his or her individually identifiable information.
(b) Deleted biological data may not be used by an entity providing
post-CLIA bioinformatics services for any reason, except as set
forth in subdivision (c).
(c) Biological data that has been included in data sets for
research purposes prior to the date an entity acknowledges a request
by a customer to delete his or her data, pursuant to subdivision (a),
may be used to support those research efforts only if any and all
links between the customer's biological data and individually
identifiable information has been irreversibly deleted, but may not
be used for research efforts commenced subsequent thereto.
1503. (a) An entity providing post-CLIA bioinformatics services
shall designate an individual with a PhD or Master's degree in
bioinformatics, statistical genetics, biostatistics, or statistics
with a biological or medical specialization to be responsible for
approving algorithms and documentation thereof and to serve as the
point of contact for questions pertaining to the algorithm. The
designated individual shall approve documentation of the following:
(1) The algorithm and any material changes to the algorithm.
(2) (A) The transparent description of the validity of biological
data sets and how to perform the algorithm on a biological data set,
including references to peer-reviewed, published scientific
literature and publicly available data used in the algorithm, along
with an explanation of why these references were chosen.
(B) The transparent description and any updates shall be provided
annually to the State Department of Public Health.
(b) An entity providing post-CLIA bioinformatics services shall
have an external physician advisory board, which shall provide
guidance on the interpretation or presentation of analyses to
customers. At least one member of the board shall be licensed to
practice medicine in California.
(c) An entity providing post-CLIA bioinformatics services may not
advise a customer regarding medical or clinical treatment or
services.
1504. (a) An entity providing post-CLIA bioinformatics services
shall maintain and make available to the public the following
information and update it on a regular basis:
(1) A description of the algorithm used for interpretation of
customers' biological data.
(2) Descriptions of the criteria for inclusion in the algorithm of
data from scientific studies.
(3) Scientific references for background data, evidence,
assumptions, and claims made in the development of the algorithm or
the presentation of interpretations to customers.
(b) In addition to the internal proficiency testing required of
clinical laboratories with California clinical laboratory licenses or
CLIA certification, an entity providing post-CLIA bioinformatics
services shall implement a proficiency testing procedure independent
of the clinical laboratory, to be utilized at least every six months,
to monitor and ensure integrity of sample processing and data flow
or management. Outcomes of internal proficiency testing shall be
considered proprietary.
1505. (a) An entity providing post-CLIA bioinformatics services
shall maintain the privacy of all biological data consistent with its
privacy policies and all requirements of state and federal law.
(b) An entity providing post-CLIA bioinformatics services shall
disclose its privacy policies to potential and existing customers.
(c) An entity providing post-CLIA bioinformatics services shall
take all reasonable steps necessary to prevent the release of
individually identifiable information without explicit consent from a
customer.
(d) An entity providing post-CLIA bioinformatics services shall
present its interpretation of biological data directly to its
customers. If the interpretation is presented over the Internet,
access to interpretations shall be password-protected and encrypted.
1506. Prior to the performance of post-CLIA bioinformatics
services, the customer receiving biological data or an interpretation
of that biological data shall be provided with, and consent to, at a
minimum, all of the following:
(a) A description of the limitations of service.
(b) Clear and conspicuous notice of either of the following:
(1) As a condition of the provision of post-CLIA bioinformatics
services, that the customer's deidentified biological data sets may
be used for research purposes, subject to the requirements of
Sections 1502, 1505, and 1507.
(2) That the customer must consent to use of the customer's
deidentified biological data sets for research purposes, subject to
the requirements of Sections 1502, 1505, and 1507.
(c) A privacy policy.
(d) A procedure for allowing the customer to obtain a copy of his
or her full biological data set.
(e) A procedure for allowing the customer to request deletion of
his or her full biological data set.
1507. (a) An entity providing post-CLIA bioinformatics services
shall store biological data in a manner that, if breached, is
designed to prevent disclosure of individually identifiable
information.
(b) An entity providing post-CLIA bioinformatics services that
utilizes biological data received to perform research functions may
not do either of the following:
(1) Release an individual customer's biological data set to any
third party without explicit consent from the individual customer.
(2) Make any attempt to identify an individual customer's
biological data set through the use of other known data such as
physical characteristics, ancestry, disease state, or specific
biological markers.
(c) An entity providing post-CLIA bioinformatics services shall
undertake annual external audits of data security procedures, which
shall be subject to review by the State Department of Public Health
at the entity's principal place of business.
1508. An entity that provides post-CLIA bioinformatics services
that is subject to or initiates a business transaction that affects
the nature or solvency of the entity, such as a merger, acquisition
by another company, or sale of all or a portion of its assets, shall
notify every customer in advance of that transaction by e-mail and
provide prominent notice on its Internet Web site of any such change
in ownership or control of the customer's personal information. An
acquiring company or merger agreement shall uphold the material terms
of the entity's privacy obligations to its customers, including
honoring requests for account deletion.
1509. All biological data derived from post-CLIA bioinformatics
services shall be considered to contain "genetic characteristics," as
defined in Section 1374.7 of the Health and Safety Code and Section
10146 of the Insurance Code, and shall be subject to the prohibitions
set forth in those provisions.
1510. An entity providing post-CLIA bioinformatics services, upon
a customer's request, shall provide information regarding the
availability of genetic counselors or physicians and surgeons or
other genetic experts.
1511. An entity providing post-CLIA bioinformatics services shall
be subject to Section 650.
SEC. 3. No reimbursement is required by this act
pursuant to Section 6 of Article XIII B of the California
Constitution because the only costs that may be incurred by a local
agency or school district will be incurred because this act creates a
new crime or infraction, eliminates a crime or infraction, or
changes the penalty for a crime or infraction, within the meaning of
Section 17556 of the Government Code, or changes the definition of a
crime within the meaning of Section 6 of Article XIII B of the
California Constitution.
SECTION 1. Section 2000 of the Business and
Professions Code is amended to read:
2000. This chapter shall be known and may be cited as the Medical
Practice Act. Whenever any reference is made to the Medical Practice
Act by the provisions of any statute, it is to be construed as
referring to the provisions of this chapter.