Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law.

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party, as defined, without first obtaining explicit authorization, as provided, and would specify that an authorization is not required where monitoring a 3rd party solely provides a service to the program and does not further use or disclose health monitoring information. providing clear and conspicuous notice and obtaining the consumers affirmative consent, as provided, and would provide that individually identifiable information may be disclosed to specified entities without consent under specified circumstances, including to a government official if necessary to prevent an emergency involving the danger of death or serious physical injury to a person, if the disclosing entity provides notice of the disclosure as soon as practicable. The bill would also require an employer that receives health monitoring information in possession of or derived from a commercial health monitoring program to establish procedures to ensure preserve the confidentiality and security of that information, as provided. The bill would further prohibit an employer from discriminating against an employee based on an employees health monitoring information or if that employee does not authorize consent to the use of his or her health monitoring information. The bill would exempt a covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the Confidentiality of Medical Information Act from these requirements.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law.

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, disclosing, using for marketing, or otherwise using disclosing health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party, as defined, without first obtaining explicit authorization, as provided, and would extend this prohibition to specify that an authorization is not required where monitoring a 3rd party that solely provides a service to the program. program and does not further use or disclose health monitoring information. The bill would also require an employer that receives health monitoring information in possession of or derived from a commercial health monitoring program to establish procedures to ensure the confidentiality of, and protection from unauthorized use and disclosure of, and security of that information, as provided. The bill would further prohibit an employer from discriminating against an employee based on an employees health monitoring information or if that employee does not authorize the use of his or her health monitoring information. The bill would exempt a covered entity, provider of health care, business entity, associate, health care service plan, contractor, employer, or any other person subject to and compliant with the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and or the Confidentiality of Medical Information Act from these requirements.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law.

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, disclosing, using for marketing, or otherwise using health information in possession of or derived from a commercial health monitoring program to a 3rd party, as defined, without first obtaining explicit authorization, as provided, and would extend this prohibition to a 3rd party that solely provides a service to the program. The bill would also require an employer that receives health information in possession of or derived from a commercial health monitoring program to establish procedures to ensure the confidentiality of, and protection from unauthorized use and disclosure of, that information, as provided. The bill would further prohibit an employer from discriminating against an employee based on an employees health information or if that employee does not authorize the use of his or her health information. The bill would exempt a covered entity, provider of health care, business entity, health care service plan, contractor, employer, or any other person subject to and compliant with the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Confidentiality of Medical Information Act from these requirements.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. A violation of the provisions of this act that results in economic loss or personal injury to a patient is a crime.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. A violation of the provisions of this act that results in economic loss or personal injury to a patient is a crime.

The bill would include in the definition of medical information for these purposes any individually identifiable information in possession of or derived from a consumer health monitoring device, as defined.

By expanding the definition of an existing crime, this bill would impose a state-mandated local program by creating new crimes.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

 THIRD READING  

Bill No: AB 2688

Author:

: 8/19/16 Senate

Vote:

SENATE JUDICIARY COMMITTEE: 5-2, 6/28/16

AYES: Jackson, Hertzberg, Leno, Monning, Wieckowski

NOES: Moorlach, Anderson

ASSEMBLY FLOOR: 54-14, 5/12/16 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill prohibits the operator of a commercial health monitoring program, such as a wearable fitness device connected to the Internet, from sharing or using a consumer’s health monitoring information without explicit authorization, and prohibits employers from using health monitoring information collected through a commercial health monitoring program from discriminating against employees.

Senate Floor Amendments of 8/19/16 make various changes throughout the bill. Specifically, the amendments (1) define “service provider” and prohibit a service provider from using or further disclosing a consumer’s information; (2) prohibit a third party from further disclosing a consumer’s information; (3) allow a consumer to access or delete his or her information, as specified; and (4) require an operator of a commercial health monitoring program to make available and provide notice of a process whereby a consumer may withdraw consent to share his or her information, as specified.

ANALYSIS:

Existing law:

1. Provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Specifies, pursuant to the Health Insurance Portability and Accountability Act, privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
3. Prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
4. Defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment, and defines “individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, as specified. (Civ. Code Sec. 56.05(g).)
5. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
6. Provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill:

1. Defines “commercial health monitoring program” to mean a commercial Internet Web site, online service, or product used by consumers whose primary purpose is to collect the consumer’s individually identifiable health monitoring information.
2. Defines “health monitoring information” to mean any information, in electronic or physical form, about a consumer’s mental or physical condition that is collected by a commercial health monitoring program through a direct measurement of a consumer’s mental or physical condition or though user-input regarding a consumer’s mental or physical condition into a commercial health monitoring program.
3. Defines “individually identifiable” to mean information that includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including the consumer’s name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumer’s identity.
4. Defines “third party” to mean an entity with whom the consumer does not have a direct relationship, as specified, and whose processing of individually identifiable health monitoring information is not otherwise necessary for the functionality of the commercial health monitoring program.
5. Defines “service provider” means an entity which does not further use or disclose individually identifiable health information except at the direction of the commercial health monitoring program to other service providers of the commercial health monitoring program and either:

• provides services to the operator that support the functionality or operation of the commercial health monitoring program.
• controls, or is under common control with the provider of the commercial health monitoring program, as specified.

1. Prohibits an operator of a commercial health monitoring program from disclosing individually identifiable health monitoring information without first obtaining consent from the consumer, as specified.
2. Provides that the consent shall be separate from all other authorizations or agreements, and include the name or nature of the third party and purpose for the request.
3. Provides that a consumer’s refusal to consent shall not limit the consumer’s ability to use the commercial health monitoring program, as specified.
4. Requires that the operator of a commercial health monitoring program make available and provide notice of a process whereby a consumer may withdraw his or her consent to share information with a third party, as specified.
5. Requires that, upon request by the consumer, that the commercial health monitoring program delete or provide to the consumer his or her information, as specified.
6. Requires that an operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, destroys, deletes, or disposes of health monitoring information shall do so in a manner to preserve the security and confidentiality of the information.
7. Authorizes the disclosure of individually identifiable health monitoring information to a healthcare provider or government official in specified circumstances without first obtaining the consent of the consumer.
8. Requires that an employer who receives health monitoring information do the following:

• establish appropriate procedures to preserve the security and confidentiality of information, as specified;
• not discriminate against an employee in any terms or conditions of employment due to that employee’s refusal to provide a consent; and
• not use, disclose, or knowingly permit its employees or agents to use, sell, or disclose individually identifiable health monitoring information which the employer possesses pertaining to its employees without first obtaining that employee’s consent to do so.

1. Provides that no employer that has complied with the provision of the bill shall be liable for any unauthorized use or disclosure of individually identifiable health monitoring information.
2. Prohibits an entity which is not a commercial health monitoring program from further disclosing that health monitoring information, and assigns responsibility for a violation to the disclosing entity.

Background

In July 2013, the Privacy Rights Clearinghouse released a report entitled “Mobile Health and Fitness Applications and Information Privacy.” The report examined a total of 43 free and paid mobile phone applications (apps) on more than 150 separate data points related to privacy and security.

The report stated “our research brought us to the conclusion that, from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them.” The report also found that, as of 2013, 39 percent of free apps and 30 percent of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13 percent of free apps and 10 percent of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (March 8, 2016) did an analysis of privacy practices of diabetes management applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81 percent lacked privacy policies, and among those that did, 49 percent included permissions to share data with partners and third parties and 39 percent authorized use of data for advertising purposes.

The JAMA report noted, “this study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps.”

Partially in response, the Legislature passed AB 658 (Calderon, Chapter 296, Statutes of 2013), which applied the prohibitions of the CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual. This bill, seeking to protect the personal health information of individuals and employees collects on mobile applications, regulates how employers, operators, and third parties use that information.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT: (Verified 8/19/16)

None received

OPPOSITION: (Verified 8/31/16)

American Civil Liberties Union of California

California Alliance for Retired Americans

California Chamber of Commerce

California Public Interest Research Group

Cellular Telephone Industries Association

Civil Justice Association of California

CompTia

Consumer Action

Consumer Federation of California

Consumer Watchdog

Direct Marketing Association

Entertainment Software Association

Internet Association

TechNet

Western States Council

ARGUMENTS IN SUPPORT: The author writes, “sensitive health-related data from commercially obtained wearable health monitoring devices or online applications are not currently protected by any state or federal law. There are no restrictions on how companies may use, share or sell this information, even in personally identifiable form. […] Currently, wearable devices can perform substantial monitoring, including everything from heart rate to brain wave patterns. Simple measurements such as walking pattern can indicate injury or disability and measurement of body temperature can reveal ovulation cycles. While this information is valuable and empowering to the consumer, lack of a common agreement on how this information can be shared leaves the consumer without adequate protections.

ARGUMENTS IN OPPOSITION: A number of privacy groups oppose this bill unless amended to provide stronger consumer protections. The Consumer Federation of California, in opposition, argues that without precise language spelling out privacy rights, commercial profit motives will always prevail over consumer privacy rights. Consumer Federation writes:

Our experience over the years with enforcement of privacy laws has shown us that without precise language, such as clearly spelling out the steps required for obtaining information sharing permission, along with strong sanctions for privacy violations, commercial profit motives will always prevail over consumer privacy rights. In recent years, state courts have whittled away at the privacy provisions of the Song Beverly Credit Card Act and the Confidentiality of Medical Information Act. These courts interpreted words contained in these laws as narrowly as possible, siding with business interests, and inferring meanings that were at odds with the intent and legislative histories of these laws.

This hard-learned experience informs our objections to the bill. AB 2688 does not safeguard the privacy of individually identifiable health records.

A coalition of technology companies also oppose the bill unless amended to address “unintended consequences, logistical difficulties, and consumer harm.”

ASSEMBLY FLOOR: 54-14, 5/12/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Bloom, Bonilla, Bonta, Brown, Calderon, Campos, Chang, Chau, Chiu, Chu, Cooley, Cooper, Dababneh, Daly, Dodd, Eggman, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Hadley, Roger Hernández, Holden, Irwin, Jones, Levine, Linder, Lopez, Low, McCarty, Medina, Mullin, Nazarian, O'Donnell, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Mark Stone, Thurmond, Ting, Weber, Williams, Wood, Rendon

NOES: Baker, Chávez, Dahle, Beth Gaines, Gray, Grove, Harper, Lackey, Maienschein, Mayes, Olsen, Patterson, Wagner, Wilk

NO VOTE RECORDED: Bigelow, Brough, Burke, Frazier, Gallagher, Jones-Sawyer, Kim, Mathis, Melendez, Obernolte, Steinorth, Waldron

Prepared by: Nichole Rapier / JUD. / (916) 651-4113

8/31/16 11:49:53

**** END ****

 THIRD READING  

Bill No: AB 2688

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 5-2, 6/28/16

AYES: Jackson, Hertzberg, Leno, Monning, Wieckowski

NOES: Moorlach, Anderson

ASSEMBLY FLOOR: 54-14, 5/12/16 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill prohibits the operator of a commercial health monitoring program, such as a wearable fitness device connected to the Internet, from sharing or using a consumer’s health monitoring information without explicit authorization, and prohibits employers from using health monitoring information collected through a commercial health monitoring program from discriminating against employees.

ANALYSIS:

Existing law:

1. Provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Specifies, pursuant to the federal Health Insurance Portability and Accountability Act (HIPAA), privacy protections for patients’ protected health information and generally provides that a covered entity may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
3. Prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
4. Defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. (Civ. Code Sec. 56.05(g).)
5. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
6. Provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill:

1. Prohibits an operator of a commercial health monitoring program from intentionally sharing, selling or disclosing health monitoring information to or with a third party without first obtaining from the consumer explicit opt-in authorization, which must fulfill the following requirements:
   1. be clear, conspicuous, and separate from all other authorizations or agreements;
   2. include the name and nature of the third party and the reason for the request;
   3. be limited to a single third-party entity;
   4. provide that a consumer's refusal to authorize third-party disclosure of health monitoring information shall not limit the consumer's ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable;
   5. provide that the waiver of any legal right, penalty, remedy, forum, or enforcement procedure imposed as a condition of use is unconscionable and unenforceable, and that any person who seeks to enforce such a waiver shall have the burden of proving that the waiver was knowing and voluntary and was not made as a condition of use; and
   6. state that a consumer has the right to revoke the authorization at any time without cost or penalty by a readily accessible method.
2. Specifies that an authorization is not required where the third party solely provides services to the operator of the commercial health monitoring program and does not further use or disclose health monitoring information.
3. Requires an operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, destroys, or disposes of health monitoring information shall do so in a manner that preserves the security and confidentiality of the health monitoring information contained therein.
4. Permits health monitoring information to be disclosed to a provider of health care or other health care professional or facility to aid the diagnosis or treatment of the consumer, where the consumer is unable to authorize the disclosure due to an emergent medical condition.
5. Requires an employer that receives health monitoring information to establish appropriate procedures to ensure the security and confidentiality of the information, which may include instruction regarding confidentiality of employees and agents handling files containing health monitoring information, and security systems restricting access to files containing health monitoring information.
6. Prohibits an employer from discriminating against an employee in any terms or conditions of employment due to that employee’s refusal to provide an authorization to share, sell, disclose or use an individual's health monitoring information.
7. Prohibits an employer from discriminating against an employee in any terms or conditions of employment due to the findings of that employee’s health monitoring information.
8. Prohibits an employer from using, disclosing, or knowingly permitting its employees or agents to use or disclose health monitoring information which the employer possesses pertaining to its employees without first obtaining authorization to do so.
9. Protects an employer that has attempted in good faith to comply with the requirements and prohibitions of this bill from liability for any unauthorized use or disclosure of the health monitoring information by the person or entity to which the employer disclosed the health monitoring information.

Background

In July 2013, the Privacy Rights Clearinghouse (PRC) released a report entitled “Mobile Health and Fitness Applications and Information Privacy.” The report examined a total of 43 free and paid mobile phone applications (apps) on more than 150 separate data points related to privacy and security.

The report stated “our research brought us to the conclusion that, from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them.” The report also found that, as of 2013, 39 percent of free apps and 30 percent of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13 percent of free apps and 10 percent of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (March 8, 2016) did an analysis of privacy practices of diabetes management applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81 percent lacked privacy policies, and among those that did, 49 percent included permissions to share data with partners and third parties and 39 percent authorized use of data for advertising purposes.

The JAMA report noted, “this study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps.”

Partially in response, the Legislature passed AB 658 (Calderon, Chapter 296, Statutes of 2013), which applied the prohibitions of the Confidentiality of Medical Information Act to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual. This bill, seeking to protect the personal health information of individuals and employees collects on mobile applications, regulates how employers, operators, and third parties use that information.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT: (Verified 7/6/16)

None received

OPPOSITION: (Verified 7/6/16)

American Civil Liberties Union of California

California Alliance for Retired Americans

California Chamber of Commerce

California Public Interest Research Group

Cellular Telephone Industries Association

CompTia

Consumer Action

Consumer Federation of California

Consumer Watchdog

Direct Marketing Association

Entertainment Software Association

Internet Association

TechNet

Western States Council

ARGUMENTS IN SUPPORT: The author writes:

Sensitive health-related data from commercially obtained wearable health monitoring devices or online applications are not currently protected by any state or federal law. There are no restrictions on how companies may use, share or sell this information, even in personally identifiable form.

Currently, wearable devices can perform substantial monitoring, including everything from heart rate to brain wave patterns. Simple measurements such as walking pattern can indicate injury or disability and measurement of body temperature can reveal ovulation cycles. While this information is valuable and empowering to the consumer, lack of a common agreement on how this information can be shared leaves the consumer without adequate protections.

There is also an increasing trend of employers providing these kinds of devices to their employees to promote wellness and bring down healthcare costs for the company. This is a win-win scenario for both employers and employees, but requires significant protections to ensure that health information (or a refusal to wear a health monitoring device) is not used against an employee.

ARGUMENTS IN OPPOSITION: A number of privacy groups, expressing gratitude to the author for introducing a bill which seeks to protect personal health information of consumers, nonetheless oppose this bill unless amended to provide stronger consumer protections. The Consumer Federation of California, in opposition, argues that without precise language spelling out privacy rights, commercial profit motives will always prevail over consumer privacy rights. The bill should further spell out the form of its “Opt-In” authorization, to make it certain that information sharing is prohibited, absent additional affirmative and voluntary steps by the consumer, which are separated in time from the procedures required to set up, register, or use the health monitoring program. AB 2688 addresses the intentional sharing of individually identifiable health information. That is an essential topic but it falls short because it fails to address the many problems with the negligent sharing of sensitive information. The California Attorney General identified 103 separate medical record data breach incidents in our state between 2012 and 2015. These breaches exposed 19 million Californians’ medical records. 54% of these breaches were “physical” breaches which the Attorney General’s report described as “preventable”. Many of these occurred because medical records were not encrypted and/or records were not physically secured. Another 10% were due to “misuse” by employees and 20% due to “errors” by medical entities. These are also categories breaches that are preventable, provided the business establishes proper data security protocols. A coalition of technology companies also oppose the bill unless amended to address “unintended consequences, logistical difficulties, and consumer harm.” Our coalition has proposed language that included a very high standard of clear and conspicuous notice, plus affirmative consent, which would set the bar across the country. While it is impossible to force a consumer to consider these issues, this standard would make sure that a consumer would be clearly presented with the information and would need to agree to the rules before sharing occurs. Adding the requirement of separate consent immediately elevates the broadly defined category of health monitoring information above other types of information, and would likely create a race for each category of information to obtain its own separate consent. The clear and conspicuous standard is in line with reasonable privacy standards and allows an operator to present all of the privacy issues to the consumer together. The bill also requires a process to allow a consumer to withdraw consent, but fails to make clear that this could impact the rights and/or ability of the consumer to make use of the product or service covered by the bill. Data sharing is frequently integral to the working of the product and in other cases; the business model is based upon data sharing. These situations should be acknowledged in the bill.

ASSEMBLY FLOOR: 54-14, 5/12/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Bloom, Bonilla, Bonta, Brown, Calderon, Campos, Chang, Chau, Chiu, Chu, Cooley, Cooper, Dababneh, Daly, Dodd, Eggman, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Hadley, Roger Hernández, Holden, Irwin, Jones, Levine, Linder, Lopez, Low, McCarty, Medina, Mullin, Nazarian, O'Donnell, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Mark Stone, Thurmond, Ting, Weber, Williams, Wood, Rendon

NOES: Baker, Chávez, Dahle, Beth Gaines, Gray, Grove, Harper, Lackey, Maienschein, Mayes, Olsen, Patterson, Wagner, Wilk

NO VOTE RECORDED: Bigelow, Brough, Burke, Frazier, Gallagher, Jones-Sawyer, Kim, Mathis, Melendez, Obernolte, Steinorth, Waldron

Prepared by: Nichole Rapier / JUD. / (916) 651-4113

7/29/16 12:31:19

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 2688 (Author:Gordon)

Version: April 28, 2016

Hearing Date: June 28, 2016

Fiscal: No

Urgency: No

Consultant: NR

SUBJECT

Privacy: commercial health monitoring programs

DESCRIPTION

This bill would prohibit the operator of a commercial health monitoring program, such as a wearable fitness device connected to the Internet, from sharing or using a consumer’s health monitoring information without explicit authorization, and would prohibit employers from using health monitoring information collected through a commercial health monitoring program from discriminating against employees.

BACKGROUND

In July 2013, the Privacy Rights Clearinghouse (PRC) released a report entitled “Mobile Health and Fitness Applications and Information Privacy.” The report examined a total of 43 free and paid mobile phone applications (apps) on more than 150 separate data points related to privacy and security.

The report stated “our research brought us to the conclusion that, from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them.” The report also found that, as of 2013, 39 percent of free apps and 30 percent of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13 percent of free apps and 10 percent of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (March 8, 2016) did an analysis of privacy practices of diabetes management applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81 percent lacked privacy policies, and among those that did, 49 percent included permissions to share data with partners and third parties and 39 percent authorized use of data for advertising purposes.

The JAMA report noted, “this study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps.”

Partially in response, the Legislature passed AB 658 (Calderon, Ch. 296, Stats. 2013), which applied the prohibitions of the Confidentiality of Medical Information Act (CMIA) to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual. This bill, seeking to protect the personal health information of individuals and employees collects on mobile applications, would regulate how employers, operators, and third parties use that information.

CHANGES TO EXISTING LAW

Existing law, the California Constitution, provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)

Existing federal law, the Health Insurance Portability and Accountability Act (HIPAA), specifies privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)

Existing law prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)

Existing law defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Existing law defines “individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(g).)

Existing law provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)

Existing law provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling or disclosing health monitoring information to or with a third party without first obtaining from the consumer explicit opt-in authorization, which must fulfill the following requirements:

• be clear, conspicuous, and separate from all other authorizations or agreements;
• include the name and nature of the third party and the reason for the request;
• be limited to a single third-party entity;
• provide that a consumer's refusal to authorize third-party disclosure of health monitoring information shall not limit the consumer's ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable;
• provide that the waiver of any legal right, penalty, remedy, forum, or enforcement procedure imposed as a condition of use is unconscionable and unenforceable, and that any person who seeks to enforce such a waiver shall have the burden of proving that the waiver was knowing and voluntary and was not made as a condition of use; and
• state that a consumer has the right to revoke the authorization at any time without cost or penalty by a readily accessible method.

This bill would specify that an authorization is not required where the third party solely provides services to the operator of the commercial health monitoring program and does not further use or disclose health monitoring information.

This bill would require an operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, destroys, or disposes of health monitoring information shall do so in a manner that preserves the security and confidentiality of the health monitoring information contained therein.

This bill would permit health monitoring information to be disclosed to a provider of health care or other health care professional or facility to aid the diagnosis or treatment of the consumer, where the consumer is unable to authorize the disclosure due to an emergent medical condition.

This bill would require an employer that receives health monitoring information to establish appropriate procedures to ensure the security and confidentiality of the information, which may include instruction regarding confidentiality of employees and agents handling files containing health monitoring information, and security systems restricting access to files containing health monitoring information.

This bill would prohibit an employer from discriminating against an employee in any terms or conditions of employment due to that employee’s refusal to provide an authorization to share, sell, disclose or use an individual's health monitoring information.

This bill would prohibit an employer from discriminating against an employee in any terms or conditions of employment due to the findings of that employee’s health monitoring information.

This bill would prohibit an employer from using, disclosing, or knowingly permitting its employees or agents to use or disclose health monitoring information which the employer possesses pertaining to its employees without first obtaining authorization to do so.

This bill would protect an employer that has attempted in good faith to comply with the requirements and prohibitions of this bill from liability for any unauthorized use or disclosure of the health monitoring information by the person or entity to which the employer disclosed the health monitoring information.

COMMENT

1. Stated need for the bill

According to the author:

Sensitive health-related data from commercially obtained wearable health monitoring devices or online applications are not currently protected by any state or federal law. There are no restrictions on how companies may use, share or sell this information, even in personally identifiable form.

Currently, wearable devices can perform substantial monitoring, including everything from heart rate to brain wave patterns. Simple measurements such as walking pattern can indicate injury or disability and measurement of body temperature can reveal ovulation cycles. While this information is valuable and empowering to the consumer, lack of a common agreement on how this information can be shared leaves the consumer without adequate protections.

There is also an increasing trend of employers providing these kinds of devices to their employees to promote wellness and bring down healthcare costs for the company. This is a win-win scenario for both employers and employees, but requires significant protections to ensure that health information (or a refusal to wear a health monitoring device) is not used against an employee.

1. Health information collected by mobile applications not expressly protected under existing law

In its current form, this bill has two primary aims: it prohibits operators from intentionally sharing, selling, or disclosing health monitoring information to a third party without explicit authorization; and it prohibits employers with health monitoring programs from discriminating against employees based on their results or on their refusal to participate in the health monitoring program.

The requirement that operators get the explicit opt-in authorization of the consumer before sharing, using, or disclosing information has a number of additional provisions intended to ensure that the consumer is adequately informed about the decision. For example: the request must be clear, conspicuous and separate; the request must specify the name and nature of the third party and the reason for the request; the request must be limited to a single third party; and refusal cannot limit the consumer’s ability to use the program. These protections are not waivable, and a consumer has the right to revoke an authorization without penalty at any time.

The provisions for employer-provided programs are more varied, but generally require employers not to discriminate against program participants because of the information collected or the consumer’s refusal to authorize third party sharing. Employers are prohibited from using or disclosing health monitoring information without authorization, and are required to have procedures in place for securing the collected information. Employers are also granted immunity for unauthorized use or disclosure by a third party to which health monitoring information was disclosed if the employer shows a good faith effort to comply with restrictions.

1. Privacy concerns related to mobile phone health applications

A number of privacy groups, expressing gratitude to the author for introducing a bill which seeks to protect personal health information of consumers, nonetheless oppose this bill unless amended provide stronger consumer protections. The Consumer Federation of California (CFC), in opposition, argues that without precise language spelling out privacy rights, commercial profit motives will always prevail over consumer privacy rights. The CFC writes:

Though recent amendments are an improvement on the concept of sharing of health information from a commercial health monitoring program to advertising networks, data aggregators, social networks and others require a consumer’s “explicit authorization,” however the language of the bill does not clarify that the consumer controls this “authorization”. The bill should further spell out the form of its “Opt-In” authorization, to make it certain that information sharing is prohibited, absent additional affirmative and voluntary steps by the consumer, which are separated in time from the procedures required to set up, register, or use the health monitoring program.

AB 2688 addresses the intentional sharing of individually identifiable health information. That is an essential topic but it falls short because it fails to address the many problems with the negligent sharing of sensitive information. The California Attorney General identified 103 separate medical record data breach incidents in our state between 2012 and 2015. These breaches exposed 19 million Californians’ medical records. 54% of these breaches were “physical” breaches which the Attorney General’s report described as “preventable”. Many of these occurred because medical records were not encrypted and/or records were not physically secured. Another 10% were due to “misuse” by employees and 20% due to “errors” by medical entities. These are also categories breaches that are preventable, provided the business establishes proper data security protocols.

The American Civil Liberties Union of California argues that stronger penalties are needed to prevent the unauthorized disclosure of health information obtained through mobile apps:

The Confidentiality of Medical Information Act (CMIA) provides a strong deterrent against the negligent or intentional exposure of individually identifiable health records. CMIA may be enforced by government agencies or private civil action. CMIA was modernized in 2013 to begin to address new health recording technologies when AB 658 (Ian Calderon) extended CMIA to cover businesses that offer software or hardwar to consumers, including a mobile application or related device that maintains medical information for management, diagnosis, or treatment of a medical condition. […] CMIA creates strict sanctions against the negligent release of this information. AB 2688 is silent on a device maker’s negligence in establishing security safeguards, though both intentional and negligent data security are major concerns. […] AB 2688 addresses only the sharing or selling of “individually identifiable” health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic.

AB 2688 also contains language that places health information obtained by an employer from a wearable device or other ill-defined methods under its weak privacy regulations. AB 2688 prohibits an employer from using, disclosing, or knowingly permitting its employees or agents from using or disclosing worker health information without first obtaining the worker’s authorization, [but] does not describe how this information sharing is “authorized” and the authorization may be buried in app’s privacy policy fine print that a user must accept as a condition for setting up the device.

Staff notes that the author has been in negotiations with the opposition in an attempt to resolve these concerns, but has not yet been able to reach an agreement.  In light of these issues and ongoing efforts to achieve a consensus, if this Committee were to approve this bill, it should consider doing so with the commitment that the author continues to work with stakeholders to find an appropriate balance between information disclosure and consumer protection.

1. Concerns noted by technology companies

A coalition of technology companies oppose the bill unless amended to address “unintended consequences, logistical difficulties, and consumer harm.”

Our coalition has proposed language that included a very high standard of clear and conspicuous notice, plus affirmative consent, which would set the bar across the country. While it is impossible to force a consumer to consider these issues, this standard would make sure that a consumer would be clearly presented with the information and would need to agree to the rules before sharing occurs.

Adding the requirement of separate consent immediately elevates the broadly defined category of health monitoring information above other types of information, and would likely create a race for each category of information to obtain its own separate consent. The clear and conspicuous standard is in line with reasonable privacy standards and allows an operator to present all of the privacy issues to the consumer together.

The bill also requires a process to allow a consumer to withdraw consent, but fails to make clear that this could impact the rights and/or ability of the consumer to make use of the product or service covered by the bill. Data sharing is frequently integral to the working of the product and in other cases; the business model is based upon data sharing. These situations should be acknowledged in the bill.

In response, the author writes, “We thank the diligence and hard work of representatives from the tech industry to make this bill more robust and realistic, taking into consideration the advances that are likely to emerge in coming years. We have spent hours in productive meetings both here in the Capitol and on tech company campuses to ensure that this bill will safeguard consumers while not hindering innovation in Silicon Valley. With regard to the concerns listed by industry associations in their opposition letter, we think it important to share our thoughts. 

First is that a clear and conspicuous notice with affirmative consent can simply be included in the user's initial terms of service agreement -- which research has shown is rarely read by users. We firmly believe that the consent needs to be separate from those agreements in order to give a consumer truly informed control over their own identifiable health information. 

Second, the opposition states that the bill would elevate health monitoring information above other type of information. We do not disagree with this point: health information should be​ elevated above other types of data. The confidentiality of one's health information is a concept dating back to Hippocrates, and our society has always recognized the sensitive nature of our personal health information and sought to give it additional protections. 

Lastly, there is a concern raised that stopping this type of data sharing would be detrimental to companies that rely upon it for their business model. It's our opinion that the sale of health monitoring information in personally identifiable form without a user's consent is not an acceptable business model. Consent must be obtained. The top tech companies in California seem to agree, as their privacy policies uniformly state that they never share personally identifiable information with third parties.” 

Support: None Known

Opposition: American Civil Liberties Union of California; California Chamber of Commerce; Cellular Telephone Industries Association (CTIA); CompTia; Consumer Federation of California; Direct Marketing Association; Entertainment Software Association; Internet Association; TechNet

HISTORY

Source: Author

Related Pending Legislation: None Known

Prior Legislation:

AB 2747 (Assembly Committee on Judiciary, Chapter 913, Statutes of 2014) extends CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.

AB 658 (Calderon, Ch. 296, Stats. 2013) applies the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.

AB 1298 (Snyder, Chapter 699, Statutes of 2007), subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the Confidentiality of Medical Information Act (CMIA).

AB 336 (Snyder, Chapter 1004, Statutes of 1993), deemed certain corporations to be providers of health care under the CMIA.

Prior Vote:

Assembly Floor (Ayes 54, Noes 14)

Assembly Privacy and Consumer Protection Committee (Ayes 8, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 2688

Author:(Gordon)

As Amended Ver:April 28, 2016

Majority vote

SUMMARY: Prohibits the operator of a commercial health monitoring program, such as a wearable fitness device connected to the Internet, from sharing or using a consumer's health monitoring information without explicit authorization, and prohibits employers from using health monitoring information collected through a commercial health monitoring program from discriminating against employees. Specifically, this bill:

1. Prohibits an operator of a commercial health monitoring program from intentionally sharing, selling or disclosing health monitoring information to or with a third party without first obtaining from the consumer explicit opt-in authorization, as specified.
2. The opt-in authorization request must fulfill the following requirements:
   1. Be clear, conspicuous and separate from all other authorizations or agreements;
   2. Include the name and nature of the third party and the reason for the request;
   3. Be limited to a single third-party entity;
   4. Provide that a consumer's refusal to authorize third-party disclosure of health monitoring information shall not limit the consumer's ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable;
   5. State that a consumer has the right to revoke the authorization at any time without cost or penalty by a readily accessible method.
3. Specifies that an authorization is not required where the third party solely provides services to the operator of the commercial health monitoring program and does not further use or disclose health monitoring information.
4. Requires an operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, destroys, or disposes of health monitoring information shall do so in a manner that preserves the security and confidentiality of the health monitoring information contained therein.
5. Prohibits an employer from 1) discriminating against an employee in any terms or conditions of employment due to that employee's refusal to provide an authorization to share, sell, disclose or use an individual's health monitoring information; 2) discriminating against an employee in any terms or conditions of employment due to the findings of that employee's health monitoring information; and 3) using, disclosing, or knowingly permitting its employees or agents to use or disclose health monitoring information which the employer possesses pertaining to its employees without first obtaining authorization to do so.
6. Exempts an employer that has attempted in good faith to comply with the requirements and prohibitions of this bill from liability for any unauthorized use or disclosure of the health monitoring information by the person or entity to which the employer disclosed the health monitoring information.
7. Prohibits a recipient of health monitoring information pursuant to an authorization from further disclosing that health monitoring information unless in accordance with a new authorization.

FISCAL EFFECT: None. This bill is keyed non-fiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill. This bill is intended to apply a limited set of protections against unauthorized disclosure and employment discrimination for personal health monitoring information collected through a commercial health monitoring device that falls outside of existing federal and state protections for medical and health information. This bill is author-sponsored.
2. The "Internet of Things" and health devices. The term "Internet of Things" (or IoT) was created to describe a network of physical objects embedded with sensors and network connectivity that enables the objects to collect and transmit data remotely, as well as be controlled. As a result, massive amounts of data can be collected and analyzed, much of it in real time or near to it, allowing these systems to be monitored and operated with greater efficiency, accuracy and economic benefit – leading to the use of the term "smart" in relation to these technologies. IoT is expected to have a major impact in the health care industry.

Well-known examples of IoT health devices are the Fitbit fitness band, the Apple Watch, and the Google Smart Contact Lens.

This bill has two primary aims: a) It prohibits operators from intentionally sharing, selling or disclosing health monitoring information to a third party without explicit authorization; and b) It requires employers with health monitoring programs not to discriminate against employees based on their results or their refusal to participate. This bill also clarifies that activities by a company or employer that are covered under the Health Insurance Portability and Accountability Act of 1996 and California Medical Instrumentation Association are not subject to the provisions of this bill.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002877

Date of Hearing: May 3, 2016

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2688 (

Author:Gordon) – As Amended Ver:April 28, 2016

SUBJECT: Privacy: commercial health monitoring programs

SUMMARY: Prohibits the operator of a commercial health monitoring program, such as a wearable fitness device connected to the Internet, from sharing or using a consumer's health monitoring information without explicit authorization, and prohibits employers from using health monitoring information collected through a commercial health monitoring program from discriminating against employees. Specifically, this bill:

1. Prohibits an operator of a commercial health monitoring program from intentionally sharing, selling or disclosing health monitoring information to or with a third party without first obtaining from the consumer explicit opt-in authorization, as specified.
2. The opt-in authorization request must fulfill the following requirements:
   1. Be clear, conspicuous and separate from all other authorizations or agreements;
   2. Include the name and nature of the third party and the reason for the request;
   3. Be limited to a single third-party entity;
   4. Provide that a consumer's refusal to authorize third-party disclosure of health monitoring information shall not limit the consumer's ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable;
   5. Provide that the waiver of any legal right, penalty, remedy, forum, or enforcement procedure imposed as a condition of use is unconscionable and unenforceable, and that any person who seeks to enforce such a waiver shall have the burden of proving that the waiver was knowing and voluntary and was not made as a condition of use; and
   6. State that a consumer has the right to revoke the authorization at any time without cost or penalty by a readily accessible method.
3. Specifies that an authorization is not required where the third party solely provides services to the operator of the commercial health monitoring program and does not further use or disclose health monitoring information.
4. Requires an operator of a commercial health monitoring program that creates, maintains, preserves, stores, abandons, destroys, or disposes of health monitoring information shall do so in a manner that preserves the security and confidentiality of the health monitoring information contained therein.
5. Provides that the provisions of this bill are not intended to limit the required disclosure of health monitoring information pursuant to another provision of law.
6. Provides that the provisions of this bill shall not be construed to limit or otherwise reduce existing privacy protections provided for in state or federal law.
7. Permits health monitoring information to be disclosed to a provider of health care or other health care professional or facility to aid the diagnosis or treatment of the consumer, where the consumer is unable to authorize the disclosure due to an emergent medical condition.
8. Requires an employer that receives health monitoring information to establish appropriate procedures to ensure the security and confidentiality of the information, which may include instruction regarding confidentiality of employees and agents handling files containing health monitoring information, and security systems restricting access to files containing health monitoring information.
9. Prohibits an employer from discriminating against an employee in any terms or conditions of employment due to that employee’s refusal to provide an authorization to share, sell, disclose or use an individual's health monitoring information.
10. Prohibits an employer from discriminating against an employee in any terms or conditions of employment due to the findings of that employee’s health monitoring information.
11. Prohibits an employer from using, disclosing, or knowingly permitting its employees or agents to use or disclose health monitoring information which the employer possesses pertaining to its employees without first obtaining authorization to do so.
12. Exempts an employer that has attempted in good faith to comply with the requirements and prohibitions of this bill from liability for any unauthorized use or disclosure of the health monitoring information by the person or entity to which the employer disclosed the health monitoring information.
13. Prohibits a recipient of health monitoring information pursuant to an authorization from further disclosing that health monitoring information unless in accordance with a new authorization.
14. Exempts from the provisions of this bill any covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA).
15. Applies the definitions contained in HIPAA and CMIA as of January 1, 2016, to the provisions of this bill.
16. Defines “commercial health monitoring program” to mean "a commercial Internet Web site or online service used by consumers that collects health monitoring information regarding the consumer's mental or physical condition from sources including, but not limited to, manual entry, sensors, or both."
17. Defines “health information” to mean "any individually identifiable information, in electronic or physical form, in possession of, or derived from, a commercial health monitoring program regarding a consumer’s mental or physical condition."
18. Defines “individually identifiable” to mean "that the health monitoring information includes or contains an element of personal identifying information sufficient to allow identification of the consumer, including, but not limited to, the consumer's name, address, electronic mail address, telephone number, social security number, or unique electronic identifier, or other information that, alone or in combination with other publicly available information, reveals the consumer's identity."
19. Defines "third party” to include, but is not limited to, "an advertising network, consumer data reseller, data analytics provider, health care service plan, pharmaceutical company, government entity, operating system or platform, social network, or other commercial Internet Web site or online service."
20. Defines "consumer" as including employees of employers subject to the employer provisions of this bill.
21. Defines "business associate" to mean "a person or entity who provides, other than in the capacity of a member of the workforce of an operator of a commercial health monitoring program, legal, actuarial, accounting, consulting, data aggregation [as defined], management, administrative, accreditation, or financial services to or for a consumer health monitoring program where the provision of the service involves the disclosure of health monitoring information from a commercial health monitoring program or from another business associate of a commercial health monitoring program."

EXISTING LAW:

1. Establishes, pursuant to HIPAA, certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. HIPAA prohibits a covered entity that uses electronic means to perform HIPAA-covered transactions, from using or disclosing personal health information except pursuant to a written authorization signed by the patient or for treatment, payment, or health care operations. Notwithstanding those provisions, HIPAA allows a covered entity to maintain a directory of patients in its facility for specified purposes, and to disclose the protected health information (PHI) of a patient to family members, relatives, or other persons identified by the patient, if certain conditions are met. Covered entities include health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers that transmit health care data in a way that is regulated by HIPAA. HIPAA further provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails. (Public Law 104–191 104th Congress)
2. Prohibits, pursuant to the state CMIA, a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. A violation of the provisions of this act that results in economic loss or personal injury to a patient is a crime. (Civil Code Section (CC) 56, et seq.)
3. Defines, for purposes of the CMIA, "medical information" to mean "any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity." (CC 56.05(g))

FISCAL EFFECT: None. This bill is keyed nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill. This bill is intended to apply a limited set of protections against unauthorized disclosure and employment discrimination for personal health monitoring information collected through a commercial health monitoring device that falls outside of existing federal and state protections for medical and health information. This bill is author-sponsored.
2. Author's statement. According to the author, "[c]ommercial health monitoring devices, such as wearables or health maintenance apps, are an innovative and empowering way to put healthcare awareness in the hands of the consumer. The information gathered by these applications and devices, which can range from heart rate to menstrual cycle to brain wave patterns, would be considered sensitive to most. But such data currently have no privacy protections. This bill updates current law to contend with this emerging technology by laying down reasonable basic standards for the sharing of personally identifiable information that can be applied to any future development of this technology that comes along. This will ensure that information used for health maintenance by consumers is not widely shared without that consumer’s very explicit and intentional permission, and that those employers using such technologies to improve the health of their employees do not use the information against them."
   
3. The "Internet of Things" and health devices. The term "Internet of Things" (or IoT) was created to describe a network of physical objects embedded with sensors and network connectivity that enables the objects to collect and transmit data remotely, as well as be controlled. As a result, massive amounts of data can be collected and analyzed, much of it in real time or near to it, allowing these systems to be monitored and operated with greater efficiency, accuracy and economic benefit – leading to the use of the term "smart" in relation to these technologies.
   
   In an August 2014 article, Forbes.com describes IoT and its scope this way: "Simply put, this is the concept of basically connecting any device with an on and off switch to the Internet (and/or to each other). This includes everything from cellphones, coffee makers, washing machines, headphones, lamps, wearable devices and almost anything else you can think of. This also applies to components of machines, for example a jet engine of an airplane or the drill of an oil rig…[I]f it has an on and off switch then chances are it can be a part of the IoT. The analyst firm Gartner says that by 2020 there will be over 26 billion connected devices… That’s a lot of connections (some even estimate this number to be much higher, over 100 billion). The IoT is a giant network of connected 'things' (which also includes people). The relationship will be between people-people, people-things, and things-things."
   

The same article goes on mention the potential challenges raised by IoT, security and privacy chiefest among them: "The reality is that the IoT allows for virtually endless opportunities and connections to take place, many of which we can’t even think of or fully understand the impact of today….With billions of devices being connected together, what can people do to make sure that their information stays secure? Will someone be able to hack into your toaster and thereby get access to your entire network? The IoT also opens up companies all over the world to more security threats. Then we have the issue of privacy and data sharing. This is a hot-button topic even today, so one can only imagine how the conversation and concerns will escalate when we are talking about many billions of devices being connected. Another issue that many companies specifically are going to be faced with is around the massive amounts of data that all of these devices are going to produce. Companies need to figure out a way to store, track, analyze and make sense of the vast amounts of data that will be generated."

IoT is also expected to have a major impact in the health care industry. Wired.com writes: "Quite a lot of inventions are occurring in the healthcare industry which is part of Internet of Things adoption…Wearable devices and home health monitoring devices assisting patients is a common thing now…The devices are capable enough to transmit vital sign data from a patient home to the hospital staff. It allows them to have a real time monitoring of patient’s health. These devices use wirelessly connected glucometers, scales, heart rate and blood pressure monitors. Devices helping in monitoring real time ICU procedure are indeed a big part of IoT. There are devices for wireless ultrasound monitoring and remote vital sign monitoring from a hospital environment."

The same article also notes that there are major commercial applications for health-related IoT products: "Fitness bands are another addition in the medical devices and IoT [fields]. These connected bands take vital data from the body throughout the day and transmit wirelessly to user devices such as computers, smartphones and tablets. As they are indeed a great tool to reduce the medical expenses, even the health insurance companies too are taking interest in promoting them." Well-known examples of such technology are the Fitbit fitness band, the Apple Watch, and the Google Smart Contact Lens.

One March 2014 law review article entitled "Regulating the Internet of Things" addressed what a significant business IoT devices have already become: "Sales of fitness trackers such as Fitbit and Nike+ FuelBand topped $300 million last year, and consumer sensor devices dominated the January 2014 International Consumer Electronics Show. The hype is real: such devices are revolutionizing personal health, home security and automation, business analytics, and many other fields of human activity."

The use of such devices to monitor and collect health information, whether by sensor or manual entry, along with any online interface, is termed a "commercial health monitoring program" for purposes of this bill.

1. Previous privacy concerns over mobile phone health apps. Questions about the privacy and security implications of consumer health technology are not new. In July 2013, the Privacy Rights Clearinghouse (PRC) released a report entitled "Mobile Health and Fitness Applications and Information Privacy," funded by the California Consumer Protection Foundation. The report examined a total of 43 free and paid mobile phone applications on more than 150 separate data points related to privacy and security.

The report found "Our research brought us to the conclusion that, from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them." However, PRC did recommend efforts to increase consumer education of data collection and use practices in order to "assess for themselves the overall privacy risks that mobile health and fitness apps pose."
The report also found that, as of 2013, 39% of free apps and 30% of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13% of free apps and 10% of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (March 8, 2016) did an analysis of privacy practices of diabetes managements applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81% lacked privacy policies, and among those that did, 49% included permissions to share data with partners and third parties and 39% authorized use of data for advertising purposes.

The JAMA report opined: "This study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps."

Partially in response, the Legislature passed AB 658 (Calderon), Chapter 296, Statutes of 2013, which applied the prohibitions of California's CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his/her information, or for the diagnosis, treatment, or management of a medical condition of the individual.

1. HIPAA, CMIA and beyond. The privacy of medical information is protected under both federal and state law. The federal statute, HIPAA, protects the confidentiality of medical records in the health care field by generally restricting "covered entities" (such as health plans, health care clearinghouses, such as billing services and community health information systems, and health care providers) from using or disclosing PHI without written authorization.
   
   California's own CMIA restricts a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, from intentionally sharing, selling, using for marketing, or otherwise using any medical information for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, or as otherwise required or authorized by law. A violation of the provisions of CMIA that results in economic loss or personal injury to a patient is a crime and grounds for nominal or punitive damages, court costs and civil liability up to $250,000 per violation, depending on the circumstances.

It should be noted that the introduced version of this bill would have expanded CMIA to cover commercial health information devices, but was amended on March 28, 2016, to separate its provisions from CMIA and shift those requirements to a separate chapter in the Business and Professions Code.

1. This bill in practice. In its current form, this bill has two primary aims: it prohibits operators from intentionally sharing, selling or disclosing health monitoring information to a third party without explicit authorization; and it requires employers with health monitoring programs not to discriminate against employees based on their results or their refusal to participate.
   
   The requirement that operators get the explicit opt-in authorization of the consumer before sharing, using or disclosing information has a number of additional provisions intended to ensure that the consumer is adequately informed about the decision: the request must be clear, conspicuous and separate; the request must specify the name and nature of the third party and the reason for the request; the request must be limited to a single third party; and refusal cannot limit the consumer's ability to use the program. These protections are not waivable, and a consumer has the right to revoke an authorization without penalty at any time.

The provisions for employer-provided programs are more varied, but generally require employers not to discriminate against program participants because of the information collected or the consumer's refusal to authorize third party sharing. Employers are prohibited from using or disclosing health monitoring information without authorization, and are required to have procedures in place for securing the collected information. Employers are also granted immunity for unauthorized use or disclosure by a third party to which health monitoring information was disclosed if the employer shows a good faith effort to comply with restrictions.

This bill also clarifies that activities by a company or employer that are covered under HIPAA and CMIA are not subject to the provisions of this bill.

1. Arguments in opposition. According to the Consumer Federation of California (CFC), the primary objection to the bill is that it lacks the breadth and tough remedies of the CMIA: "Our experience over the years with enforcement of privacy laws has shown us that without precise language, such as clearly spelling out the steps required for obtaining information sharing permission, along with strong sanctions for privacy violations, commercial profit motives will always prevail over consumer privacy rights. In recent years, state courts have whittled away at the privacy provisions of the Song Beverly Credit Card Act and the Confidentiality of Medical Information Act. These courts interpreted words contained in these laws as narrowly as possible, siding with business interests, and inferring meanings that were at odds with the intent and legislative histories of these laws. This hard-learned experience informs our objections to the bill in its current and proposed versions. AB 2688 does not safeguard the privacy of individually identifiable health records."
   
   "Because the bill identifies by name, and thereby shields information sharing with specific industries that are notorious privacy abusers, it is essential that it establish strict consumer controls over the private data these businesses would be entitled to receive, and it must contain strong, enforceable deterrents against privacy violations by commercial health monitoring programs….CMIA and HIPAA-covered entities are imposing ever more rigorous internal privacy and security protocols, in part because of their potential exposure to substantial penalties for privacy violations and damages for negligent record exposure."
   
   According to a coalition of opponents, this bill compares unfavorably to CMIA's "strict rules", protection against negligent disclosure, and right of private action: "AB 2688 only establishes minimal, industry controlled rules regarding the intentional sharing or selling of this same data by an online commercial entity. It does not address the negligent release of health information by a commercial entity. It does not have the deterrent of strict penalties and damages for a privacy violation."
   
   The coalition also expresses concern that a consumer could take CMIA-protected data and manually enter it into a commercial health monitoring program and cause that data to lose its protection under CMIA. They also contend that the bill "gives employers an additional way out of legal liability for unauthorized information sharing by allowing it to show its 'good faith' attempt to comply…"
2. Recent amendments. Amendments taken by the author on April 28^th made a wide variety of changes and clarifications in response to questions raised by opponents, including an expansion of the authorization request requirements to make it explicitly "opt-in," clear and conspicuous, separate from other requests, limited to a single third party, specifying the name and nature of the third party, requiring that refusal to authorize third party sharing shall not limit use of the program, and disclose that consumers have the right to revoke the authorization at any time. As a result of these amendments and others, the California Hospital Association and the California Life Sciences Association have removed their previous opposition.
3. Previous legislation. AB 658 (Calderon), Chapter 296, Statutes of 2013, applied the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his/her information, or for the diagnosis, treatment, or management of a medical condition of the individual.

SB138 (Hernandez), Chapter 444, Statutes of 2013, required health care service plans and health insurers to take specified steps to protect the confidentiality of an insured individual's medical information for purposes of sensitive services or if disclosure will endanger an individual.

AB 1298 (Jones), Chapter 699, Statutes of 2007, subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the CMIA.

AB 2747 (Committee on Judiciary), Chapter 913, Statutes of 2014, extended CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

ACLU of California

California Alliance for Retired Americans

CALPIRG

Consumer Action

Consumer Attorneys of California (concerns)

Consumer Federation of California

Consumer Watchdog

UFCW Western States Council

World Privacy Forum

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200