Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law also defines the term provider of health care for purposes of these provisions and provides that any business that offers software or hardware to consumers for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of the act. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.

This bill would define medical information for purposes of the act to include any information in possession or derived from a digital health feedback system, which the bill would define. The bill would also require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. Because this bill would expand the definition of a crime, it would impose a state-mandated local program. The bill would make other related conforming changes.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law also defines the term provider of health care for purposes of these provisions and provides that any business that offers software or hardware to consumers for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of the act. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.

This bill would define medical information for purposes of the act to include any information in possession or derived from a digital health feedback system, which the bill would define. The bill would also require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. Because this bill would expand the definition of a crime, it would impose a state-mandated local program. The bill would make other related conforming changes.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law also defines the term provider of health care for purposes of these provisions and provides that any business that offers software or hardware to consumers for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of the act. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.

This bill would define medical information for purposes of the act to include any information, regardless of whether individually identifiable, information in possession or derived from a digital health feedback system, which the bill would define. The bill would also require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. Because this bill would expand the definition of a crime, it would impose a state-mandated local program. The bill would make other related conforming changes.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Confidentiality of Medical Information Act, generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as otherwise specified. Existing law defines medical information for purposes of these provisions to mean certain individually identifiable health information in possession of or derived from a provider of health care, among others. Existing law also defines the term provider of health care for purposes of these provisions and provides that any business that offers software or hardware to consumers for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, is deemed to be a provider of health care subject to the requirements of the act. Existing law makes a violation of these provisions that results in economic loss or personal injury to a patient punishable as a misdemeanor.

This bill would define medical information for purposes of the act to include any information, regardless of whether individually identifiable, in possession or derived from a digital health feedback system, which the bill would define. The bill would also require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the system device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. Because this bill would expand the definition of a crime, it would impose a state-mandated local program. The bill would make other related conforming changes.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

The Confidentiality of Medical Information Act, among other things, prohibits a business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information for the purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, from disclosing medical information regarding a patient, except as specified. A violation of the act that results in economic loss or personal injury to a patient is a crime, and a patient whose medical information was used or disclosed, and who has sustained economic loss or personal injury, may recover damages, as specified.

This bill would state the intent of the Legislature to enact legislation relating to the use of technology that provides an electronic alert when a patient has ingested a prescription pill, also known as a digital pill, to ensure that medical privacy protections are safeguarded.

 THIRD READING  

Bill No: AB 2167

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 5-0, 6/26/18

AYES: Jackson, Anderson, Hertzberg, Monning, Wieckowski

NO VOTE RECORDED: Moorlach, Stern

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/16/18

AYES: Portantino, Beall, Bradford, Hill, Wiener

NOES: Bates, Nielsen

SENATE FLOOR: 16-14, 8/28/18 (FAIL)

AYES: Allen, Atkins, Beall, De León, Hernandez, Hueso, Jackson, Lara, Leyva, McGuire, Mitchell, Monning, Portantino, Skinner, Wieckowski, Wiener

NOES: Anderson, Dodd, Fuller, Gaines, Galgiani, Glazer, Hertzberg, Hill, Moorlach, Morrell, Nielsen, Pan, Stone, Vidak

NO VOTE RECORDED: Bates, Berryhill, Bradford, Cannella, Chang, Delgado, Nguyen, Roth, Stern, Wilk

ASSEMBLY FLOOR: 56-12, 5/17/18 - See last page for vote

SUBJECT: Information privacy: digital health feedback systems

SOURCE: Author

DIGEST:

This bill amends California’s Confidentiality of Medical Information Act (CMIA) to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. This bill requires manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

Senate Floor Amendments of 8/22/18 include chaptering out amendments that incorporate changes made to Section 56.06 by AB 2402 (Low).

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights, among these are pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, Sec. 1.)
2. Specifies, through the Health Insurance Portability and Accountability Act (HIPAA), privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
3. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. Sec. 164.500 et seq.)
4. Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code Sec. 56 et seq.)
5. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56.10.)
6. Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code Sec. 56.101.)
7. Defines “patient,” for purposes of the CMIA, to mean any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (Civ. Code Sec. 56.05(k).)
8. Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(j).)
9. Defines “health care service plan” to mean any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975. (Civ. Code Sec. 56.05(g).)
10. Defines a “licensed health care professional,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or the Health and Safety Code, as specified. (Civ. Code Sec. 56.05(h).)
11. Defines “provider of health care,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code Sec. 56.05(m).)
12. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
13. Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(b).)
14. Provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in the CMIA. (Civ. Code Sec. 56.06(c), (d).)
15. Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill:

1. Defines “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• A sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

1. Provides that the term “medical information,” as used in the CMIA, also includes any information in electronic or physical form in possession of, or derived from, a digital health feedback system.
2. Provides that a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California shall equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.
3. Defines “unauthorized access, destruction, use, modification, or disclosure” to mean access, destruction, use, modification, or disclosure that is not authorized by the person about whom the information pertains unless the access, destruction, use, modification, or disclosure is authorized or required by law.

Background

Existing California and federal law contain a number of provisions relating to the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats to the sharing of patient’s medical information when necessary for treatment.

HIPAA, enacted in 1996, guarantees privacy protection for individuals with regards to specific health information. (Pub.L. 104–191, 110 Stat. 1936.) Generally, protected health information is any information held by a covered entity which concerns health status, provision of healthcare, or payment for healthcare that can be connected to an individual. HIPAA privacy regulations require healthcare providers and organizations to develop and follow procedures that ensure the confidentiality and security of personal health information when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.

California’s CMIA (Civ. Code Sec. 56 et seq.) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions are guided to protect Californians’ fundamental right to privacy. (Cal. Const., art. I, Sec. 1.) The CMIA provides a definition for what constitutes “medical information,” and therefore what is protected under the CMIA.

This bill amends the CMIA to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. This bill requires manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

Comments

The author writes:

While technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered “medical information,” this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications are prohibited from sharing this information and data without the patient’s informed consent.

Providing stronger protections for sensitive medical information

Late last year, the Federal Food and Drug Administration approved its first digital drug. The drug came in the form of a pill with an embedded sensor that has the capability to determine and transmit whether someone has taken it. The sensor inside this pill is the size of a grain of sand and detects and records when it is ingested, sending that information to a patch worn by the patient. The patch thereafter transmits the information to an application that can be downloaded to a smartphone.

As with many technological advances and innovations, this breakthrough comes with serious concerns about privacy. This bill provides protections for the information collected by ingestible medical sensors such as the one found in the pill described above.

Amending the CMIA’s definition of “medical information”

This bill defines “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• A sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

This bill includes within the CMIA’s definition of “medical information” any information in electronic or physical form in possession of, or derived from, a digital health feedback system. This bill thereby applies the broad protections of the CMIA to the information collected through these advanced medical sensors. This ensures that providers of healthcare, healthcare service plans, or contractors are prohibited from intentionally sharing, selling, using for marketing, or otherwise using the medical information collected from these sensors for any purpose not necessary to provide health care services to the patient, except as expressly authorized by the patient. It also subjects those violating these provisions to the remedies and penalties provided for by the CMIA.

This classification of the information acquired by a digital health feedback system as medical information under the CMIA triggers the restrictions on the sharing and selling of medical information without express authorization found in the CMIA for the manufacturers and operators of the various products associated with these systems, and holds these entities to the same standards of confidentiality required by a provider of health care. (See Civ. Code Sec. 56.06.)

Requiring these systems to be equipped with reasonable security features

Unfortunately, because of the size of its economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals. Recent examples of data security issues include a popular fitness application that claims millions of users. The server used for the application was leaking private and sensitive data, including health information and private messages sent between users. Just last month, the San Francisco Department of Public Health informed nearly 900 patients that there was a security breach involving their personal information, including sensitive medical information.

The countless examples of internet-connected devices being hacked together with the frequency of data breaches in California and the threat that such breaches pose makes increased security features for any digital health devices, such as the pills described above, and the information they collect, contain, and transmit, vital to maintaining the right to privacy for California residents.

This bill requires a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. These provisions work to ensure the sensitive medical information that is being collected and transmitted by these ingestible, digital sensors are protected and do not end up in the hands of unauthorized parties.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee:

• Court: Unknown, potentially-significant workload cost pressures to the court to adjudicate any civil actions, civil fines, and misdemeanor charges filed against defendants who violate the provisions added to CMIA by this bill. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. For example, the 2018 Budget Act appropriated $64 million from the General Fund to backfill continued reduction in fine and penalty revenue for trial court operations. (General Fund*)
• Prosecution & incarceration: Unknown potential increase in non-reimbursable local enforcement and incarceration costs to prosecute and incarcerate those charged with and found guilty of conduct proscribed by this bill. Costs would be offset, to a degree, by fee and assessment revenue. (Local funds)

SUPPORT: (Verified 8/23/18)

None received

OPPOSITION: (Verified 8/23/18)

Advanced Medical Technology Association

California Life Sciences Association

ASSEMBLY FLOOR: 56-12, 5/17/18

AYES: Aguiar-Curry, Arambula, Baker, Berman, Bloom, Bonta, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chiu, Chu, Cooley, Cooper, Daly, Eggman, Flora, Frazier, Friedman, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Lackey, Levine, Limón, Low, Maienschein, Mayes, McCarty, Medina, Mullin, Nazarian, O'Donnell, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Mark Stone, Thurmond, Ting, Waldron, Weber, Wood, Rendon

NOES: Travis Allen, Bigelow, Brough, Chávez, Cunningham, Fong, Gallagher, Harper, Kiley, Mathis, Obernolte, Patterson

NO VOTE RECORDED: Acosta, Chen, Choi, Dahle, Cristina Garcia, Melendez, Muratsuchi, Santiago, Steinorth, Voepel

Prepared by:

8/28/18 21:58:20

**** END ****

 THIRD READING  

Bill No: AB 2167

Author:

:

Vote:

SENATE JUDICIARY COMMITTEE: 5-0, 6/26/18

AYES: Jackson, Anderson, Hertzberg, Monning, Wieckowski

NO VOTE RECORDED: Moorlach, Stern

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/16/18

AYES: Portantino, Beall, Bradford, Hill, Wiener

NOES: Bates, Nielsen

ASSEMBLY FLOOR: 56-12, 5/17/18 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST:

This bill amends California’s Confidentiality of Medical Information Act (CMIA) to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. This bill requires manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights, among these are pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, Sec. 1.)
2. Specifies, through the Health Insurance Portability and Accountability Act (HIPAA), privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
3. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. Sec. 164.500 et seq.)
4. Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code Sec. 56 et seq.)
5. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56.10.)
6. Provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code Sec. 56.101.)
7. Defines “patient,” for purposes of the CMIA, to mean any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (Civ. Code Sec. 56.05(k).)
8. Defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(j).)
9. Defines “health care service plan” to mean any entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975. (Civ. Code Sec. 56.05(g).)
10. Defines a “licensed health care professional,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or the Health and Safety Code, as specified. (Civ. Code Sec. 56.05(h).)
11. Defines “provider of health care,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code Sec. 56.05(m).)
12. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
13. Provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(b).)
14. Provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in the CMIA. (Civ. Code Sec. 56.06(c), (d).)
15. Provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill:

1. Defines “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• A sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

1. Provides that the term “medical information,” as used in the CMIA, also includes any information in electronic or physical form in possession of, or derived from, a digital health feedback system.
2. Provides that a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California shall equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.
3. Defines “unauthorized access, destruction, use, modification, or disclosure” to mean access, destruction, use, modification, or disclosure that is not authorized by the person about whom the information pertains unless the access, destruction, use, modification, or disclosure is authorized or required by law.

Background

Existing California and federal law contain a number of provisions relating to the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats to the sharing of patient’s medical information when necessary for treatment.

HIPAA, enacted in 1996, guarantees privacy protection for individuals with regards to specific health information. (Pub.L. 104–191, 110 Stat. 1936.) Generally, protected health information is any information held by a covered entity which concerns health status, provision of healthcare, or payment for healthcare that can be connected to an individual. HIPAA privacy regulations require healthcare providers and organizations to develop and follow procedures that ensure the confidentiality and security of personal health information when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.

California’s CMIA (Civ. Code Sec. 56 et seq.) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions are guided to protect Californians’ fundamental right to privacy. (Cal. Const., art. I, Sec. 1.) The CMIA provides a definition for what constitutes “medical information,” and therefore what is protected under the CMIA.

This bill amends the CMIA to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. This bill requires manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

Comments

The author writes:

While technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered “medical information,” this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications are prohibited from sharing this information and data without the patient’s informed consent.

Providing stronger protections for sensitive medical information

Late last year, the Federal Food and Drug Administration approved its first digital drug. The drug came in the form of a pill with an embedded sensor that has the capability to determine and transmit whether someone has taken it. The sensor inside this pill is the size of a grain of sand and detects and records when it is ingested, sending that information to a patch worn by the patient. The patch thereafter transmits the information to an application that can be downloaded to a smartphone.

As with many technological advances and innovations, this breakthrough comes with serious concerns about privacy. This bill provides protections for the information collected by ingestible medical sensors such as the one found in the pill described above.

Amending the CMIA’s definition of “medical information”

This bill defines “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• A sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

This bill includes within the CMIA’s definition of “medical information” any information in electronic or physical form in possession of, or derived from, a digital health feedback system. This bill thereby applies the broad protections of the CMIA to the information collected through these advanced medical sensors. This ensures that providers of healthcare, healthcare service plans, or contractors are prohibited from intentionally sharing, selling, using for marketing, or otherwise using the medical information collected from these sensors for any purpose not necessary to provide health care services to the patient, except as expressly authorized by the patient. It also subjects those violating these provisions to the remedies and penalties provided for by the CMIA.

This classification of the information acquired by a digital health feedback system as medical information under the CMIA triggers the restrictions on the sharing and selling of medical information without express authorization found in the CMIA for the manufacturers and operators of the various products associated with these systems, and holds these entities to the same standards of confidentiality required by a provider of health care. (See Civ. Code Sec. 56.06.)

Requiring these systems to be equipped with reasonable security features

Unfortunately, because of the size of its economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals. Recent examples of data security issues include a popular fitness application that claims millions of users. The server used for the application was leaking private and sensitive data, including health information and private messages sent between users. Just last month, the San Francisco Department of Public Health informed nearly 900 patients that there was a security breach involving their personal information, including sensitive medical information.

The countless examples of internet-connected devices being hacked together with the frequency of data breaches in California and the threat that such breaches pose makes increased security features for any digital health devices, such as the pills described above, and the information they collect, contain, and transmit, vital to maintaining the right to privacy for California residents.

This bill requires a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. These provisions work to ensure the sensitive medical information that is being collected and transmitted by these ingestible, digital sensors are protected and do not end up in the hands of unauthorized parties.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee:

• Court: Unknown, potentially-significant workload cost pressures to the court to adjudicate any civil actions, civil fines, and misdemeanor charges filed against defendants who violate the provisions added to CMIA by this bill. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. For example, the 2018 Budget Act appropriated $64 million from the General Fund to backfill continued reduction in fine and penalty revenue for trial court operations. (General Fund*)
• Prosecution & incarceration: Unknown potential increase in non-reimbursable local enforcement and incarceration costs to prosecute and incarcerate those charged with and found guilty of conduct proscribed by this bill. Costs would be offset, to a degree, by fee and assessment revenue. (Local funds)

SUPPORT: (Verified 8/17/18)

None received

OPPOSITION: (Verified 8/17/18)

Advanced Medical Technology Association

California Life Sciences Association

ASSEMBLY FLOOR: 56-12, 5/17/18

AYES: Aguiar-Curry, Arambula, Baker, Berman, Bloom, Bonta, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chiu, Chu, Cooley, Cooper, Daly, Eggman, Flora, Frazier, Friedman, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Lackey, Levine, Limón, Low, Maienschein, Mayes, McCarty, Medina, Mullin, Nazarian, O'Donnell, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Mark Stone, Thurmond, Ting, Waldron, Weber, Wood, Rendon

NOES: Travis Allen, Bigelow, Brough, Chávez, Cunningham, Fong, Gallagher, Harper, Kiley, Mathis, Obernolte, Patterson

NO VOTE RECORDED: Acosta, Chen, Choi, Dahle, Cristina Garcia, Melendez, Muratsuchi, Santiago, Steinorth, Voepel

Prepared by:

8/18/18 13:35:18

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2017 - 2018 Regular Session

AB 2167 (Chau) - Information privacy: digital health feedback systems

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 2167 would amend the Confidentiality of Medical Information Act (CMIA) by expanding the definition of “medical information.” It also would require manufacturers or operators to equip specified devices or applications that they sell with reasonable security features.

Fiscal Impact:

• Court: Unknown, potentially-significant workload cost pressures to the court to adjudicate any civil actions, civil fines, and misdemeanor charges filed against defendants who violate the provisions added to CMIA by this measure. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. For example, the 2018 Budget Act appropriated $64 million from the General Fund to backfill continued reduction in fine and penalty revenue for trial court operations. (General Fund*)

• Prosecution & incarceration: Unknown potential increase in non-reimbursable local enforcement and incarceration costs to prosecute and incarcerate those charged with and found guilty of conduct proscribed by this bill. Costs would be offset, to a degree, by fee and assessment revenue. (Local funds)

*Trial Court Trust Fund

Background:

According to the analysis of this bill by the Senate Committee on Judiciary: “California’s Confidentiality of Medical Information Act (CMIA) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions are guided to protect Californians’ fundamental right to privacy. The CMIA provides a definition for what constitutes “medical information,” and therefore what is protected under the CMIA.” (Citations omitted.) Additionally, federal law, namely the Health Insurance Portability and Accountability Act (HIPPA), institutes consumer privacy protections related to specified health information and requires reasonable efforts to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose when using, disclosing, or requesting protected health information.

A violation of CMIA is actionable in a few different ways. Existing law provides a private right of action to a person whose confidential information or records were negligently released by a person or entity subject to CMIA. The person may recover either or both nominal damages of $1,000 and/or actual damages. Additionally, a violation of CMIA that results in economic loss or personal injury to a patient is a misdemeanor, punishable by incarceration of up to six months in county jail and/or a base fine of up to $1,000. Lastly, the act imposes liability in the form of administrative fines and civil penalties for specified violations. A person or entity that negligently discloses medical information in violation of CMIA is liable for an administrative fine or civil penalty of up to $2,500 per violation. Additionally, a person or entity, other than a licensed health care professional, that knowingly and willfully obtains, discloses, or uses medical information in violation of CMIA is liable for an administrative fine or civil penalty of up to $25,000 per violation.

Proposed Law:

This bill would:

• Define “medical information” for purposes of CMIA to include any individually-identifiable information in electronic or physical form in possession of, or derived from, a digital health feedback system.
• Define “digital health feedback system” for purposes of CMIA to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:
  • A sensor or device placed inside or worn on the body that collects or sends information about an individual.
  • A software platform that is connected to the internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described in the bullet point above.
• Require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit, that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

Related Legislation:

SB 327 (Jackson, 2017) would require a manufacturer that sells or offers to sell a connected device to equip the device with reasonable security features appropriate to the nature of the device and the information it may collect, contain, or transmit, that protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. SB 327 is pending on the Assembly floor.

AB 658 (Calderon, Ch. 296, Stats. 2013) applied the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual.

AB 1298 (Jones, Ch. 699, Stats. 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of CMIA.

Staff Comments:

The fiscal impact of this bill cannot be known with certainty, as the actual impact will be dependent on numerous factors, including, but not limited to, the frequency with which persons and entities are accused of violating CMIA, the complexity of alleged violations, if parties settle matters prior to litigation, and the factors unique to each case. It costs the court a little over $2,600, on average, in personnel and resources to adjudicate a limited civil case and a little over $11,600, on average, in personnel and resources to adjudicate an unlimited civil case. Also, it generally costs about $7,010 to operate a courtroom for one day. So if violations of the expansion of CMIA proposed by this bill led to more than nineteen new limited civil cases, more than four unlimited civil cases, a dozen or more misdemeanor charges, or a few complex case that took longer than seven days, the cost pressures of this bill to the court would surpass the Suspense File threshold.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: AB 2167 (Author:Chau)

Version: May 3, 2018

Hearing Date: June 26, 2018

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Information privacy: digital health feedback systems

DESCRIPTION

This bill would amend California’s Confidentiality of Medical Information Act (CMIA) to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. It would require manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

BACKGROUND

Existing California and federal law contain a number of provisions relating to the use of a patient’s medical information. These statutory frameworks favor the privacy of the patient, with caveats to the sharing of patient’s medical information when necessary for treatment.

The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, guarantees privacy protection for individuals with regards to specific health information. (Pub.L. 104–191, 110 Stat. 1936.) Generally, protected health information is any information held by a covered entity which concerns health status, provision of healthcare, or payment for healthcare that can be connected to an individual. HIPAA privacy regulations require healthcare providers and organizations to develop and follow procedures that ensure the confidentiality and security of personal health information when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting protected health information, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.

California’s Confidentiality of Medical Information Act (CMIA) (Civ. Code Sec. 56 et seq.) allows adult patients in California to keep personal health information confidential and decide whether and when to share that information. These provisions are guided to protect Californians’ fundamental right to privacy. (Cal. Const., art. I, Sec. 1.) The CMIA provides a definition for what constitutes “medical information,” and therefore what is protected under the CMIA.

This bill would amend the CMIA to include within the definition of “medical information” any information in possession of, or derived from, a digital health feedback system. It would require manufacturers or operators that sell devices or applications that may be used as part of these digital health feedback systems to equip them with reasonable security features, as specified.

CHANGES TO EXISTING LAW

Existing law, the California Constitution, provides that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, Sec. 1.)

Existing federal law, the Health Insurance Portability and Accountability Act (HIPAA), specifies privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)

Existing federal law provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. Sec. 164.500 et seq.)

Existing law establishes the Confidentiality of Medical Information Act (CMIA), which establishes protections for the use of medical information. (Civ. Code Sec. 56 et seq.)

Existing law prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56.10.)

Existing law provides that every provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall do so in a manner that preserves the confidentiality of the information contained therein. Any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to remedies and penalties, as specified. (Civ. Code Sec. 56.101.)

Existing law defines “patient,” for purposes of the CMIA, to mean any natural person, whether or not still living, who received health care services from a provider of health care and to whom medical information pertains. (Civ. Code Sec. 56.05(k).)

Existing law defines “medical information,” for purposes of CMIA, to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(j).)

Existing law defines “health care service plan” to mean any entity regulated pursuant

to the Knox-Keene Health Care Service Plan Act of 1975. (Civ. Code Sec. 56.05(g).)

Existing law defines a “licensed health care professional,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, the Osteopathic Initiative Act or the Chiropractic Initiative Act, or the Health and Safety Code, as specified. (Civ. Code Sec. 56.05(h).)

Existing law defines “provider of health care,” for purposes of the CMIA, to mean any person licensed or certified pursuant to the Business and Professions Code, as specified; the Osteopathic Initiative Act or the Chiropractic Initiative Act; the Health and Safety Code, as specified; or any licensed clinic, health dispensary, or health facility, as specified. The term does not include insurance institutions, as defined. (Civ. Code Sec. 56.05(m).)

Existing law provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)

Existing law provides that any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(b).)

Existing law provides that any business described in the preceding two paragraphs must maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business. Such businesses are subject to the penalties for improper use and disclosure of medical information prescribed in the CMIA. (Civ. Code Sec. 56.06(c), (d).)

Existing law provides that any provider of health care, a health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

This bill would define “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• a sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• a software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

This bill would provide that the term “medical information,” as used in the CMIA, also includes any information in electronic or physical form in possession of, or derived from, a digital health feedback system.

This bill would provide that a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California shall equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

This bill would define “unauthorized access, destruction, use, modification, or disclosure” to mean access, destruction, use, modification, or disclosure that is not authorized by the person about whom the information pertains unless the access, destruction, use, modification, or disclosure is authorized or required by law.

COMMENT

1. Stated need for the bill

According to the author:

While technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered “medical information,” this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications are prohibited from sharing this information and data without the patient’s informed consent.

2. Providing stronger protections for sensitive medical information

Late last year, the Federal Food and Drug Administration approved its first digital drug. The drug came in the form of a pill with an embedded sensor that has the capability to determine and transmit whether someone has taken it. The sensor inside this pill is the size of a grain of sand and detects and records when it is ingested, sending that information to a patch worn by the patient. The patch thereafter transmits the information to an application that can be downloaded to a smartphone.

As with many technological advances and innovations, this breakthrough comes with serious concerns about privacy. This bill would provide protections for the information collected by ingestible medical sensors such as the one found in the pill described above.

1. Amending the CMIA’s definition of “medical information”

This bill would define “digital health feedback system,” for purposes of the CMIA, to mean an ingestible sensor that collects or sends information about an individual, and is used in conjunction with either, or both, of the following:

• a sensor or device placed inside or worn on the body that collects or sends information about an individual; and/or
• a software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described.

The bill would include within the CMIA’s definition of “medical information” any information in electronic or physical form in possession of, or derived from, a digital health feedback system. The bill would thereby apply the broad protections of the CMIA to the information collected through these advanced medical sensors. This will ensure that providers of healthcare, healthcare service plans, or contractors are prohibited from intentionally sharing, selling, using for marketing, or otherwise using the medical information collected from these sensors for any purpose not necessary to provide health care services to the patient, except as expressly authorized by the patient. It would also subject those violating these provisions to the remedies and penalties provided for by the CMIA.

This classification of the information acquired by a digital health feedback system as medical information under the CMIA would trigger the restrictions on the sharing and selling of medical information without express authorization found in the CMIA for the manufacturers and operators of the various products associated with these systems, and would hold these entities to the same standards of confidentiality required by a provider of health care. (See Civ. Code Sec. 56.06.)

1. Requiring these systems to be equipped with reasonable security features

Unfortunately, because of the size of its economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that, in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy /2014data_breach_rpt.pdf> [as of Apr. 20, 2015].)

Over the four-year period from 2012 to 2015, the Attorney General received reports on over 657 breaches, affecting over 49 million records. (California Department of Justice, California Data Breach Report (Feb. 2016) <https://oag.ca.gov/breachreport2016> [as of Apr. 30, 2017].) In 2015 alone, nearly three in five Californians were victims of a data breach. These data breaches are not harmless. The Attorney General reports that in 2014, 67 percent of breach victims in the United States were also victims of fraud.

Recent examples of data security issues include a popular fitness application that claims millions of users. The server used for the application was leaking private and sensitive data, including health information and private messages sent between users. Just last month, the San Francisco Department of Public Health informed nearly 900 patients that there was a security breach involving their personal information, including sensitive medical information.

The countless examples of internet-connected devices being hacked together with the frequency of data breaches in California and the threat that such breaches pose makes increased security features for any digital health devices, such as the pills described above, and the information they collect, contain, and transmit, vital to maintaining the right to privacy for California residents.

This bill would require a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features appropriate to the nature of the device, software application, or system and the information it may collect, contain, or transmit that protect the device, software application, or system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. These provisions would work to ensure the sensitive medical information that is being collected and transmitted by these ingestible, digital sensors are protected and do not end up in the hands of unauthorized parties.

Support: None Known

Opposition: None Known

HISTORY

Source: Author

Related Pending Legislation: SB 327 (Jackson, 2017) would require a manufacturer that sells or offers to sell a connected device in this state to equip the device with reasonable security features appropriate to the nature of the device and the information it may collect, contain, or transmit, that protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

Prior Legislation:

AB 658 (Calderon, Ch. 296, Stats. 2013) applies the prohibitions of the CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage the individual’s information, or for the diagnosis, treatment, or management of a medical condition of the individual.

AB 1298 (Jones, Ch. 699, Stats. 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the CMIA.

Prior Vote:

Assembly Floor (Ayes 56, Noes 12)

Assembly Appropriations Committee (Ayes 12, Noes 5)

Assembly Privacy and Consumer Protection Committee (Ayes 8, Noes 2)

Assembly Health Committee (Ayes 15, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 2167

Author:(Chau)

As Amended Ver:May 3, 2018

Majority vote

SUMMARY: Revises the Confidentiality of Medical Information Act (CMIA), to expand the definition of medical information to include any information in electronic or physician form in possession of, or derived from, a digital health feedback system, as defined. Defines digital health feedback system as an ingestible sensor that collects or sends information about an individual and is used in conjunction with either or both, of the following: a sensor or device and/or software platform. Requires a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features and to protect information from unauthorized disclosure.

FISCAL EFFECT: According to the Assembly Appropriations Committee, unknown, likely minor general fund costs to the Department of Justice for information technology changes necessary to reflect the creation of a new crime.

COMMENTS: According to the author, while technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered "medical information," this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications are prohibited from sharing this information and data without the patient’s informed consent.

Digital Pills. A recent New York Times article described that for the first time, the federal Food and Drug Administration has approved a digital pill, specifically, a medication embedded with a sensor that can tell doctors whether, and when, patients take their medicine. This approval marks a significant advance in the growing field of digital devices designed to monitor medicine-taking and to address the issue of patients not taking drugs as prescribed. The article notes that experts estimate that so-called nonadherence or noncompliance to medication costs about $100 billion a year because patients get sicker and need additional treatment or hospitalization. Patients who agree to take the digital medication can sign consent forms allowing their doctors and up to four other people, including family members, to receive electronic data showing the date and time pills are ingested. A smartphone app will allow patients to block recipients anytime they change their mind. Although voluntary, the technology is still likely to prompt questions about privacy and whether patients might feel pressured to take medication in a form their doctors can monitor. The article also notes that companies are developing digital medication technologies, including another ingestible sensor and visual recognition technology capable of confirming whether a patient has placed a pill on the tongue and has swallowed it and not all will need regulatory clearance, and some are already being used or tested in patients with heart problems, stroke, Human Immunodeficiency Virus (HIV), diabetes and other conditions.

Confidentiality of Health Information. Existing state and federal law protect the confidentiality of health information, but medical information, under California's CMIA, and protected health information, under the federal Health Insurance Portability and Accountability Act, generally receive such a classification only because the information originates with a health care provider or other "covered entity," as defined in current law. Information generated by a digital health feedback system, however, would not necessarily be captured under the existing definitions.

Analysis Prepared by: Kristene Mapile / HEALTH / (916) 319-2097 FN: 0002800

Date of Hearing: May 2, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 2167

Author:(Chau) – As Amended Ver:April 19, 2018

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

As proposed to be amended, this bill establishes privacy protections for digital health feedback systems. Specifically, this bill:

1. Defines "digital health feedback system" as an ingestible sensor that collects or sends information about an individual and is used in conjunction with another device or software platform.
2. Protects the privacy of information in possession of or derived from a digital health feedback system by including such information in the definition of medical information.
3. Requires a manufacturer or operator that sells or offers to sell a device or software application that may be used with a digital health feedback system to a consumer in California to equip the device or software application, and the system, with reasonable security features and to protect information from unauthorized disclosure.

Amendments correct an inadvertent error in the definition of "medical information" from a digital health feedback system by striking the phrase "regardless of whether individually identifiable." This phrase inadvertently broadens what type of information is protected, and the author states this bill was not intended to make such a change.

FISCAL EFFECT:

Unknown, likely minor GF costs to the Department of Justice for information technology changes necessary to reflect the creation of a new crime.

COMMENTS:

1. Purpose. This author-sponsored bill seeks to implement reasonable regulations for the use of “digital pills.” First, it would define “digital health feedback system.” Second, by amending the definition of “medical information” in the Confidentiality of Medical Information Act (CMIA), this bill would also ensure information derived from or in the possession of these systems is subject to California’s medical privacy laws. Finally, this bill would require that manufacturers equip digital health feedback systems with reasonable security features.
2. Digital Pills. Several forms of “digital pills” that send information from places like the digestive tract or bloodstream are being developed, with a few already in use. Digital pills, which combine ingestible microchip sensors with pharmaceuticals can, for instance, control and monitor the release of active pharmaceutical ingredients after digestion. They can also record whether, when, and in what quantity a drug is released, as well as information about the physical state of the person taking the drug, such as temperature, activity level, heart rate, and respiration.
3. Confidentiality of Health Information. Existing state and federal law protect the confidentiality of health information, but medical information (under California's CMIA) and protected health information (under the federal Health Insurance Portability and Accountability Act (HIPAA)) generally receive such a classification only because the information originates with a health care provider or other "covered entity," as defined in current law. Information generated by a digital health feedback system, however, would not necessarily be captured under the existing definitions.

Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081

Date of Hearing: April 17, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2167 (

Author:Chau) – As Amended Ver:March 23, 2018

SUBJECT: Information privacy: digital health feedback systems

SUMMARY: This bill would define “medical information” for purposes of the Confidentiality of Medical Information Act (CMIA) to include any information in the possession of or derived from a digital health feedback system, as specified. The bill would also require a manufacturer that sells or offers to sell a digital health feedback system to a consumer in California to equip the system with reasonable security features. Specifically, this bill would:

1. Define “digital health feedback system” to mean an ingestible sensor that collects and sends information about an individual that may be used in conjunction with either of the following:

• A sensor or device placed inside or worn on the body that collects and sends information about an individual.
• A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device as described in the paragraph above.

1. Include within the definition of “medical information” in the CMIA “any information in electronic or physical form, regardless of whether individually identifiable, in possession of or derived from a digital health feedback system.”
2. Require any manufacturer that sells or offers to sell a digital health feedback system to a consumer in California to equip the system with reasonable security features appropriate to the nature of the system and the information it may collect, contain, or transmit that protect the system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

EXISTING LAW:

1. Specifies, under the federal Health Insurance Portability and Accountability Act (HIPAA), privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
2. Provides, under the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
3. Prohibits, under CMIA, providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
4. Defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. CMIA defines “individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(g).)
5. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
6. Provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of the bill: This bill seeks to implement reasonable regulations for the use of “digital pills.” First, it would define a “digital health feedback system” to mean an ingestible sensor that collects and sends information about an individual to a software platform or device that is connected to the Internet, as specified. Second, by amending the definition of “medical information” in the CMIA, this bill would also ensure that the information derived from or in the possession of these systems is subject to California’s medical privacy laws. Finally, this bill would require that manufacturers equip digital health feedback systems with reasonable security features appropriate to protect the system and any information contained therein. This is an author-sponsored bill.
2. Author’s statement: According to the author, “While technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered ‘medical information,’ this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications used in conjunction with digital pills are prohibited from sharing this information and data without the patient’s informed consent.”
3. Digital pills: Technology enables individuals to receive more detailed and time-sensitive information about the world around them all the time. A network of devices with the ability to connect to the internet (commonly known as “the Internet of Things”) has created previously unimagined conveniences for consumers who have come to rely on connected devices such as cellphones, fitness applications, smart appliances, smart cars, and wearable devices.

The next area of connection will likely be inside the human body. Several forms of “digital pills” that send information from places like the digestive tract or bloodstream are being developed, with a few already in use. These digital pills, which combine ingestible microchip sensors with pharmaceuticals, can operate in a number of ways. They can control and monitor the release of active pharmaceutical ingredients after digestion. They can also record whether, when, where and in what quantity a drug is released, as well as information about the physical state of the person taking the drug, such as temperature, activity level, heart rate, and respiration. Digital pills then transmit signals and information about the patient to devices like mobile phones, tablets, and computers belonging to the patient, the patient’s caregivers, or the patient’s doctor. (Avery & Liu, Bringing Smart Pills to Market: FDA Regulation of Ingestible Drug/Device Combination Products, 66 Food & Drug L.J. 329, 330-32 (2011).)

These pills and their accompanying technology stand to provide information that may drastically improve the lives of many people. For example, an estimated 50 percent of patients with chronic diseases in developed countries do not take their medication, as prescribed. This can cause relapse and recurrence of chronic disease and results in an estimated $100 billion - $300 billion in avoidable healthcare costs. (Whitefield, Bus. Wire US FDA Accepts Digital Medicine Drug Application for Otsuka and Proteus Digital Health, (Sept. 10, 2015), found at < https://www.businesswire.com/news/home/20150910005497/en/ U.S.-FDA-Accepts-Digital-Medicine-Drug-Application > [as of April 4, 2018].) By measuring medication adherence, digital health feedback systems could allow healthcare professionals to more effectively tailor treatment of chronic diseases to individual patients, which could both lead to better health outcomes and save billions of dollars in healthcare costs. (Id.)

Yet, despite digital health feedback systems’ potential for positive impact, there are significant concerns related to privacy and data security, which may act as barriers to their success. Specifically, should privacy laws proactively determine how information generated and collected by these systems is disclosed, and to whom. Furthermore, are current privacy and data collection laws sufficient to ensure that data created and transmitted via digital health feedback systems is secure.

1. State and Federal medical privacy laws: The federal Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, guarantees privacy protection for individuals with regards to specific health information (Pub.L. 104–191, 110 Stat. 1936). Generally, protected health information (PHI) is any information held by a covered entity which concerns health status, provision of health care, or payment for health care that can be connected to an individual. HIPAA privacy regulations require health care providers and organizations to develop and follow procedures that ensure the confidentiality and security of PHI when it is transferred, received, handled, or shared. HIPAA further requires reasonable efforts when using, disclosing, or requesting PHI, to limit disclosure of that information to the minimum amount necessary to accomplish the intended purpose.

California’s CMIA also protects medical information and restricts its disclosure by health care providers, and health care service plans, as specified. Under existing law, a corporation organized for the purpose of maintaining medical information in order to make that information available to the patient, or a provider at the request of the patient for purposes of diagnosis or treatment, is deemed to be a provider of health care subject to the requirements of the CMIA. AB 658 (Calderon, Ch. 296, Stats. 2013) further ensured that any business that offers software or hardware to consumers, including a mobile application or other related device, that is designed to maintain medical information or for the diagnosis, treatment, or management of a medical condition of the individual, is also subject to CMIA. While the chaptered version of AB 658 had no recorded opposition, the Chamber of Commerce opposed an earlier version of that bill because it was “unclear which mobile application software providers [would] be included. There are many small companies offering a variety of mobile apps that may be captured in the bill. For instance, it is difficult to determine if an app used for health fitness would be captured.” To address those concerns, the author of AB 658 accepted amendments in the Assembly Judiciary Committee which clarified that the provisions of the bill would apply only to medical information, as defined by the CMIA, meaning information which originates with a covered entity.

Subsequently, the Legislature considered AB 2688 (Gordon, 2016) which sought to regulate the disclosure of information in possession of or derived from a commercial health monitoring program to a third party without providing clear and conspicuous notice and obtaining the consumer’s affirmative consent. The introduced version of that bill would have expanded CMIA to cover commercial health information devices (such as the “FitBit”), but was amended on March 28, 2016, to separate its provisions from CMIA and shift those requirements to a separate chapter in the Business and Professions Code. Thus, when AB 2688 ultimately died on the Senate floor, privacy advocates were in opposition because the bill did not create strong enough protections for privacy, and a coalition of technology companies were also in opposition, but because the bill in its current form would result in “unintended consequences, logistical difficulties, and consumer harm.”

With this bill, AB 2167, the question of what health and/or medical information is protected by existing privacy laws comes before the Legislature again. As with the two bills discussed above, the classifications of “medical information” (under CMIA) or “PHI” (pursuant to HIPAA), both come with important privacy protections and penalty structures when an individual’s information is impermissibly disclosed. Unfortunately, medical information and PHI generally only receive such a classification because of when it originates with a health care provider or other covered entity. As a “business associate” or “contractor”, a manufacturer of a digital health feedback system would also be subject to these privacy laws if they contracted directly with health care providers. Because this would require an affirmative act on the part of the manufacturer or software developer/operator in the form of contract negotiation, this avenue seems like an unlikely action for the manufacturers or operators of digital health feedback systems to pursue. The more likely scenario is that because healthcare providers only receive information from the digital health feedback systems if authorized/released by the patient, that information will not protected under existing medical privacy laws until it actually reaches the doctor.

Accordingly, this bill would proactively designate information generated by digital pills/digital health feedback systems as medical information, thus determining, at least for the purposes of California’s CMIA, that the manufacturers/operators/developers of the software and hardware that collect and send information cannot sell or disclose an individual’s information without authorization.

1. Author’s amendment: The following amendment is technical in nature and would ensure that any device or software application which receives information from a digital pill is included in the definition of a digital health feedback system.

Author’s amendment:

On page 3, line 24 strike “and” and insert “or”

On page 3, line 24, after “individual” insert “and is used in conjunction with either or both of the following:”

On page 3, line 24, strike “that may be used in conjunction with either of the following:”

On page 3, after line 31, insert “(3) Either or both of the items above that are used in conjunction with an ingestible sensor are expressly included in this definition of digital health feedback system.”

1. Manufacturers that sell digital health feedback systems must equip systems with reasonable security features. The health care industry is plagued with data breaches. (Snell, Health IT Security, How Much Do Healthcare Data Breaches Cost Organizations? (Feb. 2018) < https://healthitsecurity.com/news/how-much-do-healthcare-data-breaches-cost-organizations> [as of April 10, 2018].) Each act of data transmission presents some risk that data will be breached, even with security precautions in place, and the frequency of breaches is increasing. In 2015, 113 million electronic health records were breached. (See Ponemon Inst., Sixth Annual Benchmark Study on Privacy & Security of Healthcare Data (2016) (discussing “the increased frequency of [data] breaches” in the health care industry). At the same time, connected medical devices – components of the so-called Internet of Things – are multiplying, opening more holes in security.

Digital health feedback systems stand to greatly improve adherence to prescriptions, and thus healthcare, as discussed in Comment 3, above. However, at the core of the systems lies digital applications and software, which are ripe for data security breach. Accordingly, this bill would require a manufacturer that sells or offers to sell a digital health feedback system to a consumer in California equip the system with reasonable security features appropriate to the nature of the system and the information it collects, contains, or transmits, in order to protect the system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.

This requirement is consistent with other proposals that the Legislature has reviewed in the past few years. (See, e.g., AB 658 (Calderon, Ch. 296, Stats. 2013) and AB 1298 (Snyder, Ch. 699, Stats. 2007).) While, at this time, no stakeholders have submitted formal opposition to this bill, some groups connected with the pharmaceutical industry have expressed concern that the digital sensor component of the digital health feedback system which they are responsible for, cannot be “equipped” with reasonable security features as required by this bill. Indeed, the only sensor approved currently by the FDA is “a silicon chip about the size of a sand particle. With no battery or sensor, it is powered by the body itself. The chip contains small amounts of copper and magnesium. After being ingested the chip will interact with digestive juices to produce a voltage that can be read from the surface of the skin through a detector patch, which then sends a signal via mobile phone to inform the doctor that the pill has been taken.” (Murray, Forbes, No More Skipping Your Medicine—FDA Approves First Digital Pill (Aug. 9, 2012).) They argue instead, that the security features can only be implemented on the corresponding components, such as the software and devices which collect and disseminate the information generated by the digital sensor. Staff notes that while Proteus is the only digital pill that has been approved by the FDA, many more are in the trial phase. These pills operate in different ways, and so legislating around the only one that has been approved may prove to be premature. However, insomuch that the ingestible part of any digital health feedback system only sends information to a device or software application and does not collect it, requiring that the entity that produces the ingestible component to equip its portion with “reasonable security features” may be infeasible. Accordingly, the author agrees to the following amendment to require reasonable security features to only be required of the parts of the system that are vulnerable to actual data breach. This amendment would require of any device or software application which receives information from a digital sensor to take appropriate security measures:

Author’s amendment:

On page 7, line 33, after “manufacturer” insert “of a device, or operator of software”

On page 7, line 33, after “sell a” insert “device or software application that may be used with a”

1. Related legislation: AB 2935 (Chau, 2018) would prohibit the operator of a commercial health monitoring program from intentionally sharing or disclosing a consumers individually identifiable health monitoring information to or with a third party without first obtaining the consumers consent.
2. Prior legislation: AB 2688 (Gordon, 2016) see Comment 4.

AB 2747 (Assembly Committee on Judiciary, Ch. 913, Stats. 2014) extends CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.

AB 658 (Calderon, Ch. 296, Stats. 2013) see Comment 4.

AB 1298 (Snyder, Ch. 699, Stats. 2007) subjects any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of CMIA.

1. Double-referral: This bill was double-referred to the Assembly Committee on Health, where it was heard on April 10, 2018, and passed on a 15-0 vote.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200

Date of Hearing: April 10, 2018

ASSEMBLY COMMITTEE ON HEALTH

Jim Wood, Chair

ABPCA Bill Id:AB 2167

Author:(Chau) – As Amended Ver:March 23, 2018

SUBJECT: Information privacy: digital health feedback systems.

SUMMARY: Revises the Confidentiality of Medical Information Act (CMIA), to expand the definition of medical information to include any information, regardless of whether individually identifiable, in possession or derived from a digital health feedback system, as defined. Requires a manufacturer that sells or offers to sell a digital health feedback system to a consumer in California to equip the system with reasonable security features appropriate to the nature of the system and the information it may collect, contain, or transmit, that protect the system and any information from unauthorized access, destruction, use, modification, or disclosure. Specifically, this bill:

1. Defines digital health feedback system as an ingestible sensor that collects and sends information about an individual that may be used in conjunction with either of the following:
   1. A sensor or device placed inside or worn on the body that collects and sends information about an individual; or,
   2. A software platform that is connected to the Internet, directly or indirectly, or to another device that receives and displays information collected or sent from a sensor or device in 1) a) above.
2. Expands the definition of medical information to also mean any information in electronic or physical form, regardless of whether individually identifiable, in possession of or derived from a digital health feedback system.
3. Requires a manufacturer that sells or offers to sell a digital health feedback system to a consumer in California to equip the system with reasonable security features appropriate to the nature of the system and the information it may collect, contain, or transmit that protect the system and any information contained therein from unauthorized access, destruction, use, modification, or disclosure.
4. Defines unauthorized access, destruction, use, modification, or disclosure as access, destruction, use, modification, or disclosure that is not authorized by the person about whom the information pertains unless authorized or required by law.
5. Makes other technical, clarifying changes.

EXISTING LAW:

1. Establishes under federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) which sets standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails.
2. Prohibits, pursuant to the state CMIA, a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States a violation of the provisions of CMIA that results in economic loss or personal injury to a patient is a crime.
3. Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Defines individually identifiable to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.

FISCAL EFFECT: This bill has not yet been analyzed by a fiscal committee.

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, while technology stands to improve how healthcare is delivered, these advancements do not come without risk. Health and medical information is, by its very nature, deeply personal and sensitive. New technology makes medical information easily and quickly accessible via apps and websites, and California has ensured that medical information held by mobile devices is protected under our privacy laws. However, in order to be considered “medical information,” this information generally needs to be generated by a healthcare provider. Information that is generated by a digital health feedback system, meaning at the patient level and outside of a medical facility, will not necessarily be captured under the existing definition of medical information. But information about whether a patient took his or her medication and how that medication interacted in his or her body is unquestionably of a medical nature. Therefore it is imperative that the information generated by digital health feedback systems is classified as medical information, and developers and operators of hardware, software, and applications are prohibited from sharing this information and data without the patient’s informed consent.
2. BACKGROUND. A recent New York Times article described that for the first time, the federal Food and Drug Administration has approved a digital pill, specifically, a medication embedded with a sensor that can tell doctors whether, and when, patients take their medicine. This approval marks a significant advance in the growing field of digital devices designed to monitor medicine-taking and to address the issue of patients not taking drugs as prescribed. The article notes that experts estimate that so-called nonadherence or noncompliance to medication costs about $100 billion a year because patients get sicker and need additional treatment or hospitalization. Patients who agree to take the digital medication can sign consent forms allowing their doctors and up to four other people, including family members, to receive electronic data showing the date and time pills are ingested. A smartphone app will allow patients to block recipients anytime they change their mind. Although voluntary, the technology is still likely to prompt questions about privacy and whether patients might feel pressured to take medication in a form their doctors can monitor. The article also notes that companies are developing digital medication technologies, including another ingestible sensor and visual recognition technology capable of confirming whether a patient has placed a pill on the tongue and has swallowed it and not all will need regulatory clearance, and some are already being used or tested in patients with heart problems, stroke, HIV, diabetes and other conditions.

A 2016 Vanderbilt Journal of Entertainment and Technology Law article, titled “Just What the Doctor Ordered: Protecting Privacy Without Impeding Development of Digital Pills,” analyzed digital pills in the context of the privacy and data security implications that could put consumers at risk. Digital pills that send information from places like the human digestive tract or bloodstream are being developed, with a few already in use. These pills could stand to provide information that could drastically improve the lives of many people, but they also have privacy and data security implications that could put consumers at great risk. The article notes that ingestible sensors have great potential to provide financial and health related benefits. The risks of the digital pill with regard to privacy and data security, however, may lead some to call for preemptive regulation. The article contends that rather than immediately limiting information use, policymakers should focus on improving the methods by which consumers can be educated and give consent. The article also states that it is not clear which privacy laws will actually apply to digital pills as HIPAA applies only to individually identifiable health information that is stored or transmitted by "covered entities" and their "business associates." Covered entities are usually health care providers, health insurers, or health care clearinghouses that process billing information, not pharmaceutical companies. Pharmaceutical companies can be considered "business associates" if they perform "functions or activities on behalf of, or certain services for, a covered entity that involve the use or disclosure of protected health information."

1. RELATED LEGISLATION. AB 2935 (Chau) establishes the Digital Commercial Health Monitoring and prohibits an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a CHMP. AB 2935 is double-referred to the Assembly Health and Privacy and Consumer Protection Committees.
2. PREVIOUS LEGISLATION.
   1. AB 2688 (Gordon) of 2016 would have prohibited an operator of a CHMP from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a third party, as defined, without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent, as provided, and would have provided that individually identifiable information may be disclosed to specified entities without consent under specified circumstances, including to a government official if necessary to prevent an emergency involving the danger of death or serious physical injury to a person, if the disclosing entity provides notice of the disclosure as soon as practicable. AB 2688 would have also required an employer that receives health monitoring information in possession of or derived from a commercial health monitoring program to establish procedures to preserve the confidentiality and security of that information, as provided. AB 2688 died on the Senate third reading file.
   2. SB 138 (Ed Hernandez), Chapter 444, Statutes of 2014, specifies the manner in which a health care service plan or health insurer is required to maintain confidentiality of medical information regarding the treatment of an insured, subscriber, or enrollee.
   3. AB 658 (Calderon), Chapter 296, Statutes of 2013, applies the prohibitions of the CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.
   4. AB 1298 (Jones), Chapter 699, Statutes of 2007, applies the prohibitions of the CMIA to any business organized for the purpose of maintaining medical information to allow an individual to manage his or her information, or for the treatment or diagnosis of the individual.
3. DOUBLE REFERRAL. This bill has been double-referred; upon passage of this committee, it will be referred to the Assembly Privacy and Consumer Protection Committee.
4. POLICY COMMENT. This bill as defined may be too narrow and does not appear to capture future technologies. As this bill moves forward, the author may wish to clarify the definition of digital health feedback system.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Kristene Mapile / HEALTH / (916) 319-2097