AB 2402: Cannabis: personal information.
- Session Year: 2017-2018
- House: Assembly
- Latest Version Date: 2018-09-20
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, as specified, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. The bill would provide exceptions to the prohibitions on disclosure of a consumers personal information, identification cards, and information contained in a physicians recommendation for a contractor providing software services to a licensee, as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.06 of the Civil Code proposed by AB 2167 to be operative only if this bill and AB 2167 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, as specified, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. The bill would provide exceptions to the prohibitions on disclosure of a consumers personal information, identification cards, and information contained in a physicians recommendation for a contractor providing software services to a licensee, as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.06 of the Civil Code proposed by AB 2167 to be operative only if this bill and AB 2167 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, as specified, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. The bill would provide exceptions to the prohibitions on disclosure of a consumers personal information, identification cards, and information contained in a physicians recommendation for a contractor providing software services to a licensee, as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
This bill would incorporate additional changes to Section 56.06 of the Civil Code proposed by AB 2167 to be operative only if this bill and AB 2167 are enacted and this bill is enacted last.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, as specified, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. The bill would provide exceptions to the prohibitions on disclosure of a consumers personal information, identification cards, and information contained in a physicians recommendation for a contractor providing software services to a licensee, as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions.
Existing law, the California Uniform Controlled Substances Act, makes various acts involving marijuana a crime except as authorized by law. Existing law, the Medical Marijuana Program (MMP), requires counties to administer an identification card program for qualified patients and provides immunity from arrest to qualified patients with a valid identification card or designated primary caregivers, within prescribed limits.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
This bill would deem a business licensed under the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive identification cards issued pursuant to the MMP or information contained in a physicians recommendation to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions and prohibits a licensee from disclosing information contained in a physicians recommendation. transactions.
Existing law requires information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by the Bureau of Cannabis Control for the purposes of administering the act to be maintained in accordance with state law relating to patient access to his or her health records, the Confidentiality of Medical Information Act, and other state and federal laws relating to confidential patient information, and provides that this information is confidential and exempt from disclosure under the California Public Records Act, except as specified. Existing law deems information contained in a physicians recommendation to use cannabis for medical purposes to be medical information within the meaning of the Confidentiality of Medical Information Act, and prohibits a licensee from disclosing this information, except as specified.
Existing law, the Confidentiality of Medical Information Act, prohibits providers of health care, health care service plans, contractors, employers, and 3rd-party administrators, among others, from disclosing medical information, as defined, without the patients written authorization, subject to certain exceptions, as specified. A violation of the act resulting in economic loss or personal injury to a patient is a misdemeanor and subjects the violating party to liability for specified damages and administrative fines and penalties.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
The bill would further deem identification cards issued to qualified patients to be medical information within the meaning of the Confidentiality of Medical Information Act, and would prohibit a licensee from disclosing that information, except as specified. By expanding the scope of a crime, the bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The Medicinal and Adult-Use Cannabis Regulation and Safety Act, among other things, provides for the licensure and regulation of commercial cannabis activity, including cultivation, manufacturing, distribution, and retail sale. Existing law requires licensees to maintain specified records of commercial cannabis transactions and prohibits a licensee from disclosing information contained in a physicians recommendation.
This bill would prohibit a licensee from disclosing a consumers personal information, as defined, to a 3rd party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. The bill would prohibit a licensee from discriminating against a consumer or denying a consumer a product or service because he or she has not provided consent to authorize the licensee to disclose the consumers nonpublic personal information to a 3rd party not directly related to the transaction.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)For the purposes of this section, third party does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumers personal information for any other purpose or share a consumers personal information with any party other than the contracting licensee.
(e)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.5.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.Section 3.5 of this bill incorporates amendments to Section 56.06 of the Civil Code proposed by both this bill and Assembly Bill 2167. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 56.06 of the Civil Code, and (3) this bill is enacted after Assembly Bill 2167, in which case Section 3 of this bill shall not become operative.
SEC. 5.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)For the purposes of this section, third party does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumers personal information for any other purpose or share a consumers personal information with any party other than the contracting licensee.
(e)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.5.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (k) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.Section 3.5 of this bill incorporates amendments to Section 56.06 of the Civil Code proposed by both this bill and Assembly Bill 2167. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 56.06 of the Civil Code, and (3) this bill is enacted after Assembly Bill 2167, in which case Section 3 of this bill shall not become operative.
SEC. 5.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)For the purposes of this section, third party does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumers personal information for any other purpose or share a consumers personal information with any party other than the contracting licensee.
(e)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.5.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) (k) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) (k) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)(d)Any business described in subdivision (a) or (b) this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(d)(e)Any business described in subdivision (a) or (b) this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.Section 3.5 of this bill incorporates amendments to Section 56.06 of the Civil Code proposed by both this bill and Assembly Bill 2167. That section of this bill shall only become operative if (1) both bills are enacted and become effective on or before January 1, 2019, (2) each bill amends Section 56.06 of the Civil Code, and (3) this bill is enacted after Assembly Bill 2167, in which case Section 3 of this bill shall not become operative.
SEC. 4.SEC. 5.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)For the purposes of this section, third party does not include a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumers personal information for any other purpose or share a consumers personal information with any party other than the contracting licensee.
(d)(e)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance. ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as (1) necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance. ordinance, or (2) to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(d)Any business described in this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(e)Any business described in this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
SEC. 3.Section 56.06 of the Civil Code is amended to read:56.06.(a)Any business organized for the purpose of maintaining medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis and treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(b)Any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information, as defined in subdivision (j) of Section 56.05, in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual, shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)Any business that is licensed pursuant to Division 10 (commencing with Section 26000) of the Business and Professions Code that is authorized to receive identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 of the Business and Professions Code shall be deemed to be a provider of health care subject to the requirements of this part. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
(c)(d)Any business described in subdivision (a) or (b) this section shall maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business.
(d)(e)Any business described in subdivision (a) or (b) this section is subject to the penalties for improper use and disclosure of medical information prescribed in this part.
SEC. 3.SEC. 4.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
SEC. 2.Section 26162.5 of the Business and Professions Code is amended to read:26162.5.Information(a)Identification cards issued pursuant to Section 11362.71 of the Health and Safety Code are hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
(b)Information contained in a physicians recommendation issued in accordance with Article 25 (commencing with Section 2525) of Chapter 5 of Division 2 and received by a licensee, including, but not limited to, the name, address, or social security number of the patient, the patients medical condition, or the name of the patients primary caregiver is hereby deemed medical information within the meaning of the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code) and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
(a)A licensee shall not disclose a consumers personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensees disclosure of the personal information. This section does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
(b)A licensee shall not discriminate against a consumer, or deny a consumer a product or service, because the consumer has not provided consent, pursuant to subdivision (a), to authorize the licensee to disclose the consumers nonpublic personal information to a third party not directly related to the transaction.
(c)For purposes of this section, personal information has the same meaning as defined in subdivision (d) of Section 1798.81.5 of the Civil Code.
(d)This section provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code, which does not apply to licensees under this division pursuant to paragraph (5) of subdivision (e) of Section 1798.81.5 of the Civil Code.
|
Date
|
Status
|
|---|---|
| Sep 20, 2018 | Chaptered by Secretary of State - Chapter 583, Statutes of 2018. |
| Sep 20, 2018 | Approved by the Governor. |
| Sep 6, 2018 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 29, 2018 | Assembly Rule 77 suspended. |
| Aug 28, 2018 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after August 30 pursuant to Assembly Rule 77. |
| Aug 28, 2018 | Read third time. Passed. Ordered to the Assembly. |
| Aug 24, 2018 | Read second time. Ordered to third reading. |
| Aug 23, 2018 | Read third time and amended. Ordered to second reading. |
| Aug 21, 2018 | Read second time. Ordered to third reading. |
| Aug 20, 2018 | Read third time and amended. Ordered to second reading. |
| Aug 7, 2018 | Read second time. Ordered to third reading. |
| Aug 6, 2018 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8. |
| Jun 27, 2018 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 5. Noes 1.) (June 26). Re-referred to Com. on APPR. |
| Jun 20, 2018 | Read second time and amended. Re-referred to Com. on JUD. |
| Jun 19, 2018 | From committee: Amend, and do pass as amended and re-refer to Com. on JUD. (Ayes 8. Noes 1.) (June 18). |
| Jun 6, 2018 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on B., P. & E.D. |
| May 24, 2018 | Referred to Coms. on B., P. & E.D. and JUD. |
| May 15, 2018 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 14, 2018 | Read third time. Passed. Ordered to the Senate. |
| May 10, 2018 | Read second time. Ordered to third reading. |
| May 9, 2018 | From committee: Do pass. (Ayes 11. Noes 1.) (May 9). |
| Apr 18, 2018 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 9. Noes 0.) (April 17). Re-referred to Com. on APPR. |
| Apr 10, 2018 | From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 14. Noes 2.) (April 10). Re-referred to Com. on P. & C.P. |
| Apr 10, 2018 | Re-referred to Com. on B. & P. |
| Apr 9, 2018 | From committee chair, with author's amendments: Amend, and re-refer to Com. on B. & P. Read second time and amended. |
| Mar 22, 2018 | Referred to Coms. on B. & P. and P. & C.P. |
| Feb 15, 2018 | From printer. May be heard in committee March 17. |
| Feb 14, 2018 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 29, 2018 | AB 2402 LOW Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Aug 28, 2018 | Assembly 3rd Reading AB2402 Low By Hertzberg | Senate Floor |
Passed |
|
| Jun 26, 2018 | Do pass, but first be re-referred to the Committee on [Appropriations] | Senate Standing Committee on Judiciary |
Passed |
|
| Jun 18, 2018 | Do pass as amended, but first amend, and re-refer to the Committee on [Judiciary] | Senate Standing Committee on Business, Professions and Economic Development |
Passed |
|
| May 14, 2018 | AB 2402 LOW Assembly Third Reading | Assembly Floor |
Passed |
|
| May 9, 2018 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 17, 2018 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| Apr 10, 2018 | Do pass and be re-referred to the Committee on [Privacy and Consumer Protection] | Assembly Standing Committee on Business and Professions |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| American Civil Liberties Union of California | ** Support | Aug 24, 2018 |
| California Cannabis Industry Association | * Support | Apr 10, 2018 |
| California Growers Association | ** Support | Aug 24, 2018 |
| Caliva | ** Support | Aug 24, 2018 |
| CCIA | * Support | Jun 18, 2018 |
| City Of Los Angeles | ** Support | Aug 24, 2018 |
| Lovingly and Legally | * Support | May 9, 2018 |
| Lovingly and Legally | * Support | May 9, 2018 |
CONCURRENCE IN SENATE AMENDMENTS
CSA1 Bill Id:AB 2402
Author:(Low)
As Amended Ver:August 23, 2018
Majority vote
ASSEMBLY: | 61-5 | (May 14, 2018) | SENATE: | 29-9 | (August 28, 2018) |
Original Committee Reference: B. & P.
SUMMARY: prohibits cannabis licensees from disclosing a consumer's personal information to a third party, except to the extent necessary for payment to be made.
THE SENATE AMENDMENTS:
- Deem cannabis licensees that receive medical cannabis identification cards or physician's recommendations to be providers of health care for the purposes of protecting medical information.
- Exclude contractors providing software services to a licensee for the purpose of conducting transactions or verifying eligibility from the prohibition on disclosing a consumer's personal information to a third party.
- Make technical corrections.
- Add double-jointing language with AB 2167 (Chau) of the current legislative session to avoid chaptering out the changes made to Civil Code Section 56.06 by that bill.
THIS BILL:
- Prohibits a cannabis licensee from disclosing a consumer's personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee's disclosure of the personal information.
- Specifies that the bill does not prohibit the disclosure of nonpublic personal information to the State of California or to a city, county, or city and county to perform official duties pursuant to Business and Professions Code Division 10.
- Prohibits a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer's nonpublic personal information to a third party not directly related to the transaction.
- Deems identification cards issued pursuant to Health and Safety Code Section 11362.71 to be "medical information" within the meaning of the Confidentiality of Medical Information Act.
- Deems cannabis licensees that receive medical cannabis identification cards or physician's recommendations to be providers of health care for the purposes of protecting medical information.
FISCAL EFFECT: According to the Senate Appropriations Committee, pursuant to Senate Rule 28.8, negligible state costs.
COMMENTS: Current law and regulation require cannabis licensees retain certain records, including receipts, for seven years. The regulations do not explicitly require licensees to retain the personal information that they have collected as part of a sale for seven years, although some licensees may interpret the record retention requirement to apply to that information. In that case, personal information about cannabis consumers could be retained by retailers for seven years and could be sold at any time by the retailer to a third party.
ARGUMENTS IN SUPPORT: The California Growers Association states "this bill would protect the personal information of the consumer of cannabis products by prohibiting cannabis licensees from disclosing a consumer's personal information to a 3rd party…AB 2402 is carefully crafted to protect the integrity of payments and financial transactions required between licensees and consumers".
ARGUMENTS IN OPPOSITION: None on file.
Analysis Prepared by: Brendan McCarthy / B. & P. / (916) 319-3301 FN: 0004896
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 2402
:
SENATE BUS., PROF. & ECON. DEV. COMMITTEE: 8-1, 6/18/18
AYES: Hill, Allen, Dodd, Galgiani, Glazer, Hernandez, Pan, Wilk
NOES: Fuller
SENATE JUDICIARY COMMITTEE: 5-1, 6/26/18
AYES: Jackson, Hertzberg, Monning, Stern, Wieckowski
NOES: Anderson
NO VOTE RECORDED: Moorlach
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 61-5, 5/14/18 - See last page for vote
DIGEST:
This bill establishes privacy protections against the unauthorized disclosure of a cannabis consumer’s personal information by a cannabis licensee and prohibits a cannabis licensee from discriminating against a consumer because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the cannabis transaction.
Senate Floor Amendments of 8/23/18 contain double-jointing language to coordinate passage with AB 2167 (Chau).
Senate Floor Amendments of 8/20/18 define “third party” to exempt contractors who provide software services for the sole purposes of conducting a transaction or verifying eligibility, and allow medical information related to cannabis transactions to be provided to these contractors, as specified, and make technical changes.
Existing law:
- Establishes the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) to establish a comprehensive system to control and regulate the cultivation, distribution, transport, storage, manufacturing, processing, and sale of both medicinal and adult-use cannabis. (Business and Professions Code (BPC) § 26000)
- Authorizes a testing laboratory to receive and test samples of cannabis from a qualified patient with a valid physician’s recommendation. (BPC § 26104 (d))
- Establishes CUA, which ensures that seriously ill Californians have the right to obtain and use cannabis for medical purposes where that medical use is deemed appropriate and has been recommended by a physician who has determined that the person’s health would benefit from the use of cannabis. (Health and Safety Code § 11362.5)
- Exempts a business regulated by state or federal law that provides greater protection to personal information from the “reasonable security procedures and practices” required in 8) above. Compliance with that state or federal law shall be deemed compliance with regard to those subjects. (Civil Code (CC) § 1798.81.5 (e))
- Establishes the Confidentiality of Medical Information Act (Act), which governs the disclosure of medical records by providers, disclosure of genetic test results by a health care service plan, use and disclosure of medical information by employers, and other issues relating to the privacy of an individual’s medical information. (CC §§ 56 et seq.)
- Deems information contained in a physician’s cannabis recommendation, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver as “medical information” within the meaning of the Act. Prohibits this information from being disclosed by a cannabis licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to MAUCRSA, or a local ordinance. (BPC § 26162.5)
This bill:
- Prohibits a cannabis licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made, or if the consumer has consented to the licensee’s disclosure of the personal information.
- Allows the disclosure of nonpublic personal information to the State of California, a city, county, or city and county to perform official duties.
- Prohibits a licensee from discriminating against a consumer or denying a consumer a product or service because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- Defines “personal information” as either:
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Social security number.
- Driver’s license number or California ID number.
- Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
- Medical information.
- Health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- States that this bill provides greater protection to personal information than provided by existing statutory guidelines for customer records.
- Excludes from the definition of “third party” for the purpose of this bill to exclude a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee.
- Deems CUA IDs to be “medical information” within the meaning of the Act and prohibits disclosure by a licensee except as necessary for the State of California, any city, county, or city and county to perform official duties pursuant to this chapter or a local ordinance, or to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
- States that information contained in a physician’s recommendation and received by a licensee is considered “medical information” and shall not be disclosed by a licensee except as necessary for the State of California or any city, county, or city and county to perform official duties, or a local ordinance, or to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
- Deems a cannabis licensee authorized to receive or receives CUA IDs or information contained in a physician’s cannabis recommendation to be a “provider of health care” for purposes of the Act. Requires these licensees to maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business, and be subject to penalties for improper use and disclosure of the medical information.
Background
Existing Protections. The Department of Public Health is required to develop protocols to protect the confidentiality of information on CUA IDs, although these protocols are not in regulation and are unknown as of the writing of this analysis. Current law does, however, protect information related to a physician’s cannabis recommendation as “medical information” within the meaning of the Act. However, other personal information collected as a result of cannabis commerce is only protected under general business statutes requiring that an entity “implement and maintain reasonable security procedures and practices” appropriate to the situation. “Reasonable” is not defined.
Policy Considerations. Cannabis consumers may be unwittingly disclosing a great deal of personal information when purchasing either medicinal or adult-use cannabis. Some examples include: many dispensaries will not only visually check a consumer’s identification to prove age, but scan and store the information electronically; a consumer may purchase cannabis for medical use at an adult-use dispensary, and the dispensary keeps records of a customer’s medical conditions for purpose of future sales; cannabis delivery records are required to note exactly what someone bought, when, and where it was delivered -- all of this information is highly personal and has the potential to be abused.
Medicinal cannabis users currently lack employment protections, universal standards for impairment are still in development, and cannabis and cannabis products remain illegal at the federal level. However, California is currently allowing private businesses to collect potentially compromising information about cannabis users with little protection against its sale or use.
This bill requires certain commercial medical cannabis businesses to abide by the same confidentiality standards as traditional health care providers and limits the dissemination of other personal information by all cannabis licensees unless a consumer consents to share his or her information. This bill also prohibits a licensee from discriminating against a consumer who declines to share personal information.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
American Civil Liberties Union of California
California Growers Association
City of Los Angeles
CMG/Caliva
OPPOSITION: (Verified 8/24/18)
None received
ARGUMENTS IN SUPPORT: CMG/Caliva writes, “This bill seeks to extend basic consumer protection laws to cannabis consumers. In this era of increasingly profound public resentment at having personal information shared with others, people who are consumers of cannabis are particularly attuned to where their personal information goes and how it is used.
“A particular phenomenon arising out of the implementation of Proposition 64 is the gravitation of longstanding medical consumers to adult use purchasers. As a major retailer of cannabis products to the adult use and medical use markets, Caliva has witnessed a dramatic drop off in medical cannabis sales since January 1. The customers are still with us; however, they are simply choosing to abandon their medical recommendations and purchase the same product as an adult use consumer. We are learning first hand from our customers that a factor in their shift to adult use is their hesitation to have personal information collected and saved [by the state] under the medical use structure.”
ASSEMBLY FLOOR: 61-5, 5/14/18
AYES: Acosta, Arambula, Baker, Berman, Bloom, Bonta, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Frazier, Friedman, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Lackey, Levine, Limón, Low, Maienschein, McCarty, Medina, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Mark Stone, Thurmond, Ting, Waldron, Weber, Wood, Rendon
NOES: Travis Allen, Brough, Harper, Melendez, Voepel
NO VOTE RECORDED: Aguiar-Curry, Bigelow, Choi, Flora, Fong, Gallagher, Cristina Garcia, Kiley, Mathis, Mayes, Patterson, Steinorth
8/24/18 15:25:56
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 2402
:
SENATE BUS., PROF. & ECON. DEV. COMMITTEE: 8-1, 6/18/18
AYES: Hill, Allen, Dodd, Galgiani, Glazer, Hernandez, Pan, Wilk
NOES: Fuller
SENATE JUDICIARY COMMITTEE: 5-1, 6/26/18
AYES: Jackson, Hertzberg, Monning, Stern, Wieckowski
NOES: Anderson
NO VOTE RECORDED: Moorlach
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 61-5, 5/14/18 - See last page for vote
DIGEST:
This bill establishes privacy protections against the unauthorized disclosure of a cannabis consumer’s personal information by a cannabis licensee and prohibits a cannabis licensee from discriminating against a consumer because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the cannabis transaction.
Senate Floor Amendments of 8/20/18 define “third party” to exempt contractors who provide software services for the sole purposes of conducting a transaction or verifying eligibility, and allow medical information related to cannabis transactions to be provided to these contractors, as specified, and make technical changes.
Existing law:
- Establishes the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) to establish a comprehensive system to control and regulate the cultivation, distribution, transport, storage, manufacturing, processing, and sale of both medicinal and adult-use cannabis. (Business and Professions Code (BPC) § 26000)
- Authorizes a testing laboratory to receive and test samples of cannabis from a qualified patient with a valid physician’s recommendation. (BPC § 26104 (d))
- Establishes CUA, which ensures that seriously ill Californians have the right to obtain and use cannabis for medical purposes where that medical use is deemed appropriate and has been recommended by a physician who has determined that the person’s health would benefit from the use of cannabis. (Health and Safety Code (HSC) § 11362.5)
- Requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civil Code (CC) § 1798.81.5 (b))
- Exempts a business regulated by state or federal law that provides greater protection to personal information from the “reasonable security procedures and practices” required in 8) above. Compliance with that state or federal law shall be deemed compliance with regard to those subjects. (CC § 1798.81.5 (e))
- Establishes the Confidentiality of Medical Information Act (Act), which governs the disclosure of medical records by providers, disclosure of genetic test results by a health care service plan, use and disclosure of medical information by employers, and other issues relating to the privacy of an individual’s medical information. (CC §§ 56 et seq.)
- Deems information contained in a physician’s cannabis recommendation, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver as “medical information” within the meaning of the Act. Prohibits this information from being disclosed by a cannabis licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to MAUCRSA, or a local ordinance. (BPC § 26162.5)
- Requires a cannabis retailer to grant access to the retail area only after verifying that an individual is at least 21 years of age and has a valid proof of identification, or that an individual is at least 18 years of age and has valid proof of identification and a valid physician’s recommendation for himself or herself or for a person for whom he or she is a primary caregiver. Deems acceptable forms of identification to include the following:
- A document issued by a federal, state, county, or municipal government, or a political subdivision or agency thereof, including, but not limited to, a valid motor vehicle operator's license that contains the name, date of birth, physical description, and photo of the person.
- A valid ID issued to a member of the Armed Forces that includes a date of birth and a photo of the person.
- A valid passport issued by the United States or by a foreign government.
(Title 16, California Code of Regulations (CCR) § 5402)
This bill:
- Prohibits a cannabis licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made, or if the consumer has consented to the licensee’s disclosure of the personal information.
- Allows the disclosure of nonpublic personal information to the State of California, a city, county, or city and county to perform official duties.
- Prohibits a licensee from discriminating against a consumer or denying a consumer a product or service because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- Defines “personal information” as either:
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Social security number.
- Driver’s license number or California ID number.
- Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
- Medical information.
- Health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- States that this bill provides greater protection to personal information than provided by existing statutory guidelines for customer records.
- Excludes from the definition of “third party” for the purpose of this bill to exclude a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain a consumer’s personal information for any other purpose or share a consumer’s personal information with any party other than the contracting licensee.
- Deems CUA IDs to be “medical information” within the meaning of the Act and prohibits disclosure by a licensee except as necessary for the State of California, any city, county, or city and county to perform official duties pursuant to this chapter or a local ordinance, or to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
- States that information contained in a physician’s recommendation and received by a licensee is considered “medical information” and shall not be disclosed by a licensee except as necessary for the State of California or any city, county, or city and county to perform official duties, or a local ordinance, or to a contractor providing software services to a licensee for the purpose of conducting a transaction or verifying eligibility, provided that the contractor does not use or retain medical information for any other purpose or share information with any party other than the contracting licensee.
- Deems a cannabis licensee authorized to receive or receives CUA IDs or information contained in a physician’s cannabis recommendation to be a “provider of health care” for purposes of the Act. Requires these licensees to maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business, and be subject to penalties for improper use and disclosure of the medical information.
Background
Existing Protections. The Department of Public Health is required to develop protocols to protect the confidentiality of information on CUA IDs, although these protocols are not in regulation and are unknown as of the writing of this analysis. Current law does, however, protect information related to a physician’s cannabis recommendation as “medical information” within the meaning of the Act. However, other personal information collected as a result of cannabis commerce is only protected under general business statutes requiring that an entity “implement and maintain reasonable security procedures and practices” appropriate to the situation. “Reasonable” is not defined.
Policy Considerations. Cannabis consumers may be unwittingly disclosing a great deal of personal information when purchasing either medicinal or adult-use cannabis. Some examples include: many dispensaries will not only visually check a consumer’s identification to prove age, but scan and store the information electronically; a consumer may purchase cannabis for medical use at an adult-use dispensary, and the dispensary keeps records of a customer’s medical conditions for purpose of future sales; cannabis delivery records are required to note exactly what someone bought, when, and where it was delivered -- all of this information is highly personal and has the potential to be abused.
Medicinal cannabis users currently lack employment protections, universal standards for impairment are still in development, and cannabis and cannabis products remain illegal at the federal level. However, California is currently allowing private businesses to collect potentially compromising information about cannabis users with little protection against its sale or use.
This bill requires certain commercial medical cannabis businesses to abide by the same confidentiality standards as traditional health care providers and limits the dissemination of other personal information by all cannabis licensees unless a consumer consents to share his or her information. This bill also prohibits a licensee from discriminating against a consumer who declines to share personal information.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
American Civil Liberties Union of California
California Growers Association
City of Los Angeles
CMG/Caliva
OPPOSITION: (Verified 8/21/18)
None received
ARGUMENTS IN SUPPORT: CMG/Caliva writes, “This bill seeks to extend basic consumer protection laws to cannabis consumers. In this era of increasingly profound public resentment at having personal information shared with others, people who are consumers of cannabis are particularly attuned to where their personal information goes and how it is used.
“A particular phenomenon arising out of the implementation of Proposition 64 is the gravitation of longstanding medical consumers to adult use purchasers. As a major retailer of cannabis products to the adult use and medical use markets, Caliva has witnessed a dramatic drop off in medical cannabis sales since January 1. The customers are still with us; however, they are simply choosing to abandon their medical recommendations and purchase the same product as an adult use consumer. We are learning first hand from our customers that a factor in their shift to adult use is their hesitation to have personal information collected and saved [by the state] under the medical use structure.”
ASSEMBLY FLOOR: 61-5, 5/14/18
AYES: Acosta, Arambula, Baker, Berman, Bloom, Bonta, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Frazier, Friedman, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Lackey, Levine, Limón, Low, Maienschein, McCarty, Medina, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Mark Stone, Thurmond, Ting, Waldron, Weber, Wood, Rendon
NOES: Travis Allen, Brough, Harper, Melendez, Voepel
NO VOTE RECORDED: Aguiar-Curry, Bigelow, Choi, Flora, Fong, Gallagher, Cristina Garcia, Kiley, Mathis, Mayes, Patterson, Steinorth
8/21/18 18:45:50
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB |
THIRD READING
Bill No: AB 2402
:
SENATE BUS., PROF. & ECON. DEV. COMMITTEE: 8-1, 6/18/18
AYES: Hill, Allen, Dodd, Galgiani, Glazer, Hernandez, Pan, Wilk
NOES: Fuller
SENATE JUDICIARY COMMITTEE: 5-1, 6/26/18
AYES: Jackson, Hertzberg, Monning, Stern, Wieckowski
NOES: Anderson
NO VOTE RECORDED: Moorlach
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 61-5, 5/14/18 - See last page for vote
DIGEST:
This bill establishes privacy protections against the unauthorized disclosure of a cannabis consumer’s personal information by a cannabis licensee and prohibits a cannabis licensee from discriminating against a consumer because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the cannabis transaction.
Existing law:
- Establishes the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) to establish a comprehensive system to control and regulate the cultivation, distribution, transport, storage, manufacturing, processing, and sale of both medicinal and adult-use cannabis. (Business and Professions Code (BPC) § 26000)
- Defines the following: (BPC § 26001)
- “A-license” means a state license issued under MAUCRSA for cannabis or cannabis products that are intended for adults 21 years of age and over and who do not possess physician’s recommendations.
- “M-license” means a state license issued under MAUCRSA for commercial cannabis activity involving medicinal cannabis.
- “Medicinal cannabis” means cannabis or a cannabis product intended to be sold for use pursuant to the Compassionate Use Act of 1996 (CUA) by a medicinal cannabis patient in California who possesses a physician’s recommendation.
- Authorizes a testing laboratory to receive and test samples of cannabis from a qualified patient with a valid physician’s recommendation. (BPC § 26104 (d))
- Establishes CUA, which ensures that seriously ill Californians have the right to obtain and use cannabis for medical purposes where that medical use is deemed appropriate and has been recommended by a physician who has determined that the person’s health would benefit from the use of cannabis. (Health and Safety Code (HSC) § 11362.5)
- Requires the Department of Public Health (DPH) to establish and maintain a voluntary program for the issuance of CUA identification cards (ID) for qualified patients. (HSC § 11362.71)
- Requires DPH to develop protocols to protect the confidentiality of CUA program records. (HSC § 11362.71(d))
- Defines “personal information” as either: (Civil Code (CC) § 1798.81.5 (d))
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Social security number.
- Driver’s license number or California ID number.
- Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
- Medical information.
- Health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (CC § 1798.81.5 (b))
- Exempts a business regulated by state or federal law that provides greater protection to personal information from the “reasonable security procedures and practices” required in 8) above. Compliance with that state or federal law shall be deemed compliance with regard to those subjects. (CC § 1798.81.5 (e))
- Establishes the Confidentiality of Medical Information Act (Act), which governs the disclosure of medical records by providers, disclosure of genetic test results by a health care service plan, use and disclosure of medical information by employers, and other issues relating to the privacy of an individual’s medical information. (CC §§ 56 et seq.)
- Deems information contained in a physician’s cannabis recommendation, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver as “medical information” within the meaning of the Act. Prohibits this information from being disclosed by a cannabis licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to MAUCRSA, or a local ordinance. (BPC § 26162.5)
- Prohibits an A-licensee from selling or transferring cannabis or cannabis products to a person unless the person presents documentation which reasonably appears to be a valid government-issued ID identifying the person as 21 years of age or older. (BPC § 26140 (a)(4))
- Authorizes a M-licensee to sell cannabis, cannabis products, and cannabis accessories to a person 18 years of age or older who possesses a valid government-issued ID and either a valid county-issued CUA ID or a valid physician’s recommendation for himself or herself or for a person for whom he or she is a primary caregiver. (BPC § 26140 (c)(3))
- Requires a cannabis retailer to grant access to the retail area only after verifying that an individual is at least 21 years of age and has a valid proof of identification, or that an individual is at least 18 years of age and has valid proof of identification and a valid physician’s recommendation for himself or herself or for a person for whom he or she is a primary caregiver. Deems acceptable forms of identification to include the following:
- A document issued by a federal, state, county, or municipal government, or a political subdivision or agency thereof, including, but not limited to, a valid motor vehicle operator's license that contains the name, date of birth, physical description, and photo of the person.
- A valid ID issued to a member of the Armed Forces that includes a date of birth and a photo of the person.
- A valid passport issued by the United States or by a foreign government.
(Title 16, California Code of Regulations (CCR) § 5402)
- Requires a cannabis retailer to prepare a receipt for each cannabis delivery that contains, among other requirements: (16 CCR § 5402)
- The first name of the customer and a retailer-assigned customer number for the person who requested the delivery;
- The date and time the delivery request was made;
- The delivery address;
- A detailed description of all cannabis goods requested for delivery.
- The date and time the delivery was made, and the signature of the customer who received the delivery.
This bill:
- Prohibits a cannabis licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made, or if the consumer has consented to the licensee’s disclosure of the personal information.
- Allows the disclosure of nonpublic personal information to authorized employees of the State of California, a city, county, or city and county to perform official duties.
- Prohibits a licensee from discriminating against a consumer or denying a consumer a product or service because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- States that this bill provides greater protection to personal information than provided by existing statutory guidelines for customer records.
- Deems CUA IDs to be “medical information” within the meaning of the Act and prohibits disclosure by a licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to this chapter or a local ordinance.
- Deems a cannabis licensee authorized to receive or receives CUA IDs or information contained in a physician’s cannabis recommendation to be a “provider of health care” for purposes of the Act. Requires these licensees to maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business, and be subject to penalties for improper use and disclosure of the medical information.
Background
Existing Protections. DPH is required to develop protocols to protect the confidentiality of information on CUA IDs, although these protocols are not in regulation and are unknown as of the writing of this analysis. Current law does, however, protect information related to a physician’s cannabis recommendation as “medical information” within the meaning of the Act. However, other personal information collected as a result of cannabis commerce is only protected under general business statutes requiring that an entity “implement and maintain reasonable security procedures and practices” appropriate to the situation. “Reasonable” is not defined.
Policy Considerations. Cannabis consumers may be unwittingly disclosing a great deal of personal information when purchasing either medicinal or adult-use cannabis. Some examples include: many dispensaries will not only visually check a consumer’s identification to prove age, but scan and store the information electronically; a consumer may purchase cannabis for medical use at an adult-use dispensary, and the dispensary keeps records of a customer’s medical conditions for purpose of future sales; cannabis delivery records are required to note exactly what someone bought, when, and where it was delivered -- all of this information is highly personal and has the potential to be abused.
Medicinal cannabis users currently lack employment protections, universal standards for impairment are still in development, and cannabis and cannabis products remain illegal at the federal level. However, California is currently allowing private businesses to collect potentially compromising information about cannabis users with little protection against its sale or use.
This bill requires certain commercial medical cannabis businesses to abide by the same confidentiality standards as traditional health care providers and limits the dissemination of other personal information by all cannabis licensees unless a consumer consents to share his or her information. This bill also prohibits a licensee from discriminating against a consumer who declines to share personal information.
FISCAL EFFECT: Appropriation: Fiscal Com.: Local:
American Civil Liberties Union of California
California Growers Association
CMG/Caliva
None received
ARGUMENTS IN SUPPORT: CMG/Caliva writes, “This bill seeks to extend basic consumer protection laws to cannabis consumers. In this era of increasingly profound public resentment at having personal information shared with others, people who are consumers of cannabis are particularly attuned to where their personal information goes and how it is used.
“A particular phenomenon arising out of the implementation of Proposition 64 is the gravitation of longstanding medical consumers to adult use purchasers. As a major retailer of cannabis products to the adult use and medical use markets, Caliva has witnessed a dramatic drop off in medical cannabis sales since January 1. The customers are still with us; however, they are simply choosing to abandon their medical recommendations and purchase the same product as an adult use consumer. We are learning first hand from our customers that a factor in their shift to adult use is their hesitation to have personal information collected and saved [by the state] under the medical use structure.”
ASSEMBLY FLOOR: 61-5, 5/14/18
AYES: Acosta, Arambula, Baker, Berman, Bloom, Bonta, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Frazier, Friedman, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Lackey, Levine, Limón, Low, Maienschein, McCarty, Medina, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Mark Stone, Thurmond, Ting, Waldron, Weber, Wood, Rendon
NOES: Travis Allen, Brough, Harper, Melendez, Voepel
NO VOTE RECORDED: Aguiar-Curry, Bigelow, Choi, Flora, Fong, Gallagher, Cristina Garcia, Kiley, Mathis, Mayes, Patterson, Steinorth
8/8/18 15:33:34
Senator Hannah-Beth Jackson, Chair
2017-2018 Regular Session
Bill No: AB 2402 (Author:Low)
Version: June 20, 2018
Hearing Date: June 26, 2018
Fiscal: Yes
Urgency: No
Consultant: MEC
SUBJECT
Cannabis: personal information
DESCRIPTION
This bill would prohibit a licensee under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) from disclosing a consumer’s personal information to a third party without the consumer’s consent.
BACKGROUND
Cannabis, also known as marijuana, is a plant that has been used for medicinal purposes for thousands of years.[1] In 1996, California voters passed Proposition 215, the Compassionate Use Act, “to ensure that seriously ill Californians have the right to obtain and use marijuana for medical purposes.” In 2015, the Legislature passed bills to establish the regulatory framework for medicinal marijuana.[2] Although California and other states approved the use of medicinal marijuana, and subsequently the recreational use of marijuana, the federal government continues to treat marijuana as a dangerous drug. Physicians in California can recommend the use of medicinal marijuana by an adult or child. The voters of California passed Proposition 64 in 2016 to legalize the recreational use of cannabis in the state by 2018. In June 2017, the 2015 statutes and provisions of Proposition 64 were combined during the budget process to form one system for the regulation of Cannabis, referred to as the MAUCRSA.
Current law requires adult-users of marijuana to provide their identification to retail marijuana licensees in order to verify their age, and regulations limit the amount of adult-use or medical marijuana that a consumer may purchase per day. To accurately track daily sales to consumers, retail licensees will need to keep records of each sale to each customer. Marijuana licensees are also required to retain certain records, including receipts, for seven years. Personal information about marijuana consumers could be retained by retailers for seven years.
Existing law provides particular protections for personal information of medical marijuana users. In contrast there are no similar protections for adult-use consumers of marijuana. Accordingly, this bill seeks to prevent the personal information of adult-use consumers of marijuana from being shared or sold by licensees without the consent of the consumers.
This bill passed out of the Senate Committee on Business, Professions and Economic Development on June 18, 2018 with an 8 to 1 vote.
CHANGES TO EXISTING LAW
Existing state law, Proposition 215 of 1996, the Compassionate Use Act, confers on a person the right to obtain and use marijuana for medical purposes where medical use is deemed appropriate and has been recommended by a physician who has determined that the person’s health would benefit from the use of marijuana in treatment of cancer, anorexia, AIDS, chronic pain, spasticity, glaucoma, arthritis, migraine, or any other illness for which marijuana provides relief. (Health & Saf. Code Sec. 11362.5(b)(1).)
Existing state law removes the criminal penalties for cultivation and possession of marijuana by qualified patients, who are persons with a physician’s written or oral recommendation or approval to use marijuana for medical use, or by their primary caregivers, and protects physicians from punishment for recommending marijuana to a patient for medical purposes. (Health & Saf. Code Sec. 11362.5(b), (c) and (d).)
Existing federal law classifies marijuana as a Schedule I drug. (Title 21 U.S.C. Sec. 812(b)(1).)
Existing state law under the Confidentiality of Medical Information Act, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining authorization from the patient or enrollee. (Civ. Code Sec. 56.10 et seq.)
Existing state law establishes the Bureau of Cannabis Control (Bureau) under the Department of Consumer Affairs (DCA), to establish a comprehensive system to control and regulate the distribution, transport, storage, and sale of cannabis products. (Bus. & Prof. Code Sec. 26000 et seq..)
Existing state law requires cannabis licensees to keep accurate records of commercial cannabis activity and requires licensees to retain records of commercial cannabis activity, as defined by the licensing authority, for a minimum of seven years. (Bus. & Prof. Code Sec. 26160.)
Existing state law deems information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by licensing authorities to be confidential information, and not be disclosed pursuant to the California Public Records Act. (Bus. & Prof. Code Sec. 26162.)
Existing state law provides that information contained in a physician’s recommendation for medical cannabis, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver to be “medical information” within the meaning of the Confidentiality of Medical Information Act and prohibits disclosure of that information by a licensee, except as necessary to authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to state law or a local ordinance. (Bus. & Prof. Code Sec. 26162.5)
Existing regulations require each licensed cannabis retail premises to maintain an accurate record for every sale made to a customer, with specified information retained for the sale of medical cannabis. (CCR Sec. 5425.)
Existing state law requires the Department of Public Health to establish and maintain a program for the issuance of identification cards to qualified medical cannabis patients to meet the requirements specified in law and requires county health departments to issue identification cards developed by the Department. (Health & Saf. Code Sec. 11362.71.)
Existing state law, pursuant to the California Constitution, provides that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, Sec. 1.)
Existing state law requires, under the State’s Information Security law, a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civ. Code Sec. 1798.81.5(b).)
Existing state law requires a business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party that is not subject to the restriction above to require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civ. Code Sec. 1798.81.5(c).)
Existing state law defines “personal information” for the purposes of this law to mean either of the following:
- an individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: (1) social security number; (2) driver’s license number or California identification card number; (3) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; (4) medical information; (5) health insurance information; or
- A username or email address in combination with a password or security question and answer that would permit access to an online account. (Civ. Code Sec. 1798.81.5(d).)
Existing state law states that “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Sec. 1798.81.5(d).)
This bill would prohibit a licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information.
This bill would specify that the bill does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or to a city, county, or city and county to perform official duties pursuant to Division 10 of the Business and Professions Code.
This bill would prohibit a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
This bill would define personal information, for the purposes of the bill, to have the same meaning as defined in Section 1798.81.5(d) of the Civil Code.
This bill would provide that Section 26161.5, created by the bill, provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code.
This bill would deem identification cards issued pursuant to Section 11362.71 of the Health and Safety Code to be “medical information” within the meaning of the Confidentiality of Medical Information Act and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties, as specified or a local ordinance.
This bill would provide that any business that is licensed pursuant to the Medicinal and Adult-Use Cannabis Regulation and Safety Act that is authorized to receive or receives identification cards issued pursuant to Section 11362.71 of the Health and Safety Code or information contained in a physician’s recommendation for medical marijuana shall be deemed to be a provider of health care, as specified. However, this section shall not be construed to make a business specified in this subdivision a provider of health care for purposes of any law other than this part, including laws that specifically incorporate by reference the definitions of this part.
COMMENT
1. Stated need for the bill
According to the author:
Under current law, cannabis licensees are required to collect certain information from their customers to validate they are over 21 years of age. Licensees could sell their customers’ personal information to third parties. Given the newness of legal cannabis in the state, evolving social acceptance of adult cannabis use, and questions about enforcement of federal law against individuals, it is prudent to prohibit licensees from sharing information about cannabis consumers with third parties. AB 2402 extends critical privacy protections that exist for medical cannabis users to adult-use cannabis users, therefore creating conformity in the law.
In support, CMG/Caliva writes:
This bill seeks to extend basic consumer protection laws to cannabis consumers. In this era of increasingly profound public resentment at having personal information shared with others, people who are consumers of cannabis are particularly attuned to where their personal information goes and how it is used.
A particular phenomenon arising out of the implementation of Proposition 64, is the gravitation of longstanding medical consumers to adult use purchasers. As a major retailer of cannabis products to the adult use and medical use markets, Caliva has witnessed a dramatic drop off in medical cannabis sales since January 1. The customers are still with us; however, they are simply choosing to abandon their medical recommendations and purchase the same product as an adult use consumer. We are learning first hand from our customers that a factor in their shift to adult use is their hesitation to have personal information collected and saved under their medical use structure.
2. Federal law is still in tension with California law regarding medicinal marijuana
California voters enacted the Compassionate Use Act in 1996 in order to permit the use of marijuana for medical purposes by persons deemed qualified by their physicians. In 1996, marijuana was an illegal drug under federal and state law, and its use, possession, distribution, cultivation, or sale carried significant penalties. Twenty years later, California voters approved the recreational use of marijuana for adults through Proposition 64, the Adult Use of Marijuana Act. However, under federal law, marijuana is classified as a Schedule I drug. Under federal law, Schedule I drugs: have a high potential for abuse; have no currently accepted medical use in treatment in the United States; and lack accepted safety for use of the drug or other substance under medical supervision. Possession of marijuana, even by medical users, continues to be a federal crime under the Controlled Substances Act. Under the Controlled Substances Act, it is unlawful for any person knowingly or intentionally…to manufacture, distribute, or dispense, or possess with intent to manufacture, distribute, or dispense a controlled substance. (21 U.S.C. §841(a).) The federal government may be moving towards approving the use of marijuana derived prescription drugs for the treatment of certain health issues, as specified in a recent bulletin put out by the National Center for Complementary and Integrative Health, one of the National Institutes of Health. (National Center for Complementary and Integrative Health, one of the National Institutes of Health: Component of Marijuana Reduces Seizures in Some Children With Epilepsy <http://nccih.nih.gov/news/cannabidiol> [as of May 2, 2018].) There is no indication, however, that the Federal Government is going to authorize the recreational use of marijuana.
3. Protecting the privacy of those who purchase marijuana
Under state law, if the marijuana was purchased through the medicinal marijuana statutes, the personal information of the purchaser would be protected. However, if the marijuana is purchased for adult-use, the privacy provisions would not protect consumers. It is unclear what policy justification exists to protect the medicinal consumer as opposed to the adult-use consumer. The consequences of disclosure in both instances are the same. For example, if a licensee of adult use or medicinal use were to share information with employers, or insurers, general internet sites, or the federal government, the consequences would be the same for both populations. A person could lose their job and could get arrested. This bill would make it clear that a licensee could not share information about a customer without the consent of the customer. Moreover, this bill would also prohibit a licensee from requiring a potential customer to agree to consent to the sharing of their information as a condition of purchasing the marijuana from the licensee. This requirement will ensure that customers are not coerced into providing consent to the sharing of their personal information.
In support, the American Civil Liberties Union of California writes:
Since the legalization of medical and recreational cannabis in California, the cannabis industry has embarked on a significant expansion that has been accompanied by increasing privacy concerns over the use of the private data of lawful patients and customers. Although some reporting is required by law, many dispensaries collect extraneous data to profit off the personal information of their patients and customers.
Allowing medical and other private data to be released without consent or sold to the highest bidder intrudes upon personal privacy and opens the door to discrimination against lawful cannabis consumers in housing, hiring, credit, and benefits. Additionally, allowing release of private data raises concerns that patient or customer information that is communicated to third parties may end up in the hands of federal drug enforcers. California voters expressed their disapproval of the decades-long war on drugs that has had a particularly devastating effect on communities of color. By allowing federal agents access to private customer and patient data, current law invites a continuation of the war on drugs and its negative impacts on our communities.
Support: American Civil Liberties Union of California; California Growers Association; CMG/Caliva
Opposition: None Known
HISTORY
Source: Author
Related Pending Legislation: None Known
Prior Legislation:
SB 94 (Committee on Budget and Fiscal Review, Ch. 27, Stats. 2017) combined the Adult Use of Marijuana Act and the Medical Cannabis Regulation and Safety Act into one system for the regulation of cannabis, resulting in the MAUCRSA.
Proposition 215 (The Adult Use of Marijuana Act, November 8, 2016), legalized the recreational use of marijuana.
Proposition 64 (The Compassionate Use Act, November 5, 1996), legalized the use of medicinal marijuana.
Prior Vote:
Senate Business, Professions and Economic Development (Ayes 8, Noes 1)
Assembly Floor (Ayes 61, Noes 5)
Assembly Appropriations Committee (Ayes 11, Noes 1)
Assembly Privacy and Consumer Protection Committee (Ayes 9, Noes 0)
Assembly Business and Professions Committee (Ayes 14, Noes 2)
**************
“People have used marijuana, also called cannabis, for a variety of health conditions for at least 3,000 years.” National Center for Complementary and Integrative Health, one of the National Institutes of Health, Medical Marijuana <http://nccih.nih.gov/health/marijuana> [as of May 2, 2018] ↑
See SB 643 (McGuire, Ch. 719, Stats. 2015); AB 243 (Wood, Ch. 688, Stats. 2015); and AB 266 (Bonta, Ch. 689, Stats. 2015). ↑
SENATE COMMITTEE ON
BUSINESS, PROFESSIONS AND ECONOMIC DEVELOPMENT
Senator Jerry Hill, Chair
2017 - 2018 Regular
Bill No: AB 2402 Hearing Date: June 18, 2018
Author: | Low | ||
Version: |
| ||
Urgency: | Fiscal: | ||
Consultant: | |||
Subject: Cannabis: personal information
SUMMARY:
Establishes privacy protections against the unauthorized disclosure of a cannabis consumer’s personal information by a cannabis licensee and prohibits a cannabis licensee from discriminating against a consumer because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the cannabis transaction.
Existing law:
- Establishes the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) to establish a comprehensive system to control and regulate the cultivation, distribution, transport, storage, manufacturing, processing, and sale of both medicinal and adult-use cannabis. (Business and Professions Code (BPC) § 26000)
- Defines the following:
- “A-license” means a state license issued under MAUCRSA for cannabis or cannabis products that are intended for adults 21 years of age and over and who do not possess physician’s recommendations.
- “M-license” means a state license issued under MAUCRSA for commercial cannabis activity involving medicinal cannabis.
- “Medicinal cannabis” means cannabis or a cannabis product intended to be sold for use pursuant to the Compassionate Use Act of 1996 (CUA) by a medicinal cannabis patient in California who possesses a physician’s recommendation. (BPC § 26001)
- Authorizes a testing laboratory to receive and test samples of cannabis from a qualified patient with a valid physician’s recommendation. (BPC § 26104 (d))
- Establishes CUA, which ensures that seriously ill Californians have the right to obtain and use cannabis for medical purposes where that medical use is deemed appropriate and has been recommended by a physician who has determined that the person’s health would benefit from the use of cannabis. (Health and Safety Code (HSC) § 11362.5)
- Requires the Department of Public Health (DPH) to establish and maintain a voluntary program for the issuance of CUA identification cards (ID) for qualified patients. (HSC § 11362.71)
- Requires DPH to develop protocols to protect the confidentiality of CUA program records. (HSC § 11362.71(d))
- Defines “personal information” as either: (Civil Code (CC) § 1798.81.5 (d))
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Social security number.
- Driver’s license number or California ID number.
- Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
- Medical information.
- Health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
- Requires a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (CC § 1798.81.5 (b))
- Exempts a business regulated by state or federal law that provides greater protection to personal information from the “reasonable security procedures and practices” required in 8) above. Compliance with that state or federal law shall be deemed compliance with regard to those subjects. (CC § 1798.81.5 (e))
- Establishes the Confidentiality of Medical Information Act (Act), which governs the disclosure of medical records by providers, disclosure of genetic test results by a health care service plan, use and disclosure of medical information by employers, and other issues relating to the privacy of an individual’s medical information.
(CC §§ 56 et seq.) - Deems information contained in a physician’s cannabis recommendation, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patient’s primary caregiver as “medical information” within the meaning of the Act. Prohibits this information from being disclosed by a cannabis licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to MAUCRSA, or a local ordinance. (BPC § 26162.5)
- Prohibits an A-licensee from selling or transferring cannabis or cannabis products to a person unless the person presents documentation which reasonably appears to be a valid government-issued ID identifying the person as 21 years of age or older. (BPC § 26140 (a)(4))
- Authorizes a M-licensee to sell cannabis, cannabis products, and cannabis accessories to a person 18 years of age or older who possesses a valid government-issued ID and either a valid county-issued CUA ID or a valid physician’s recommendation for himself or herself or for a person for whom he or she is a primary caregiver. (BPC § 26140 (c)(3))
- Requires a cannabis retailer to grant access to the retail area only after verifying that an individual is at least 21 years of age and has a valid proof of identification, or that an individual is at least 18 years of age and has valid proof of identification and a valid physician’s recommendation for himself or herself or for a person for whom he or she is a primary caregiver. Deems acceptable forms of identification to include the following:
- A document issued by a federal, state, county, or municipal government, or a political subdivision or agency thereof, including, but not limited to, a valid motor vehicle operator's license that contains the name, date of birth, physical description, and photo of the person.
- A valid ID issued to a member of the Armed Forces that includes a date of birth and a photo of the person.
- A valid passport issued by the United States or by a foreign government.
(Title 16, California Code of Regulations (CCR) § 5402)
- Requires a cannabis retailer to prepare a receipt for each cannabis delivery that contains, among other requirements: (16 CCR § 5402)
- The first name of the customer and a retailer-assigned customer number for the person who requested the delivery;
- The date and time the delivery request was made;
- The delivery address;
- A detailed description of all cannabis goods requested for delivery.
- The date and time the delivery was made, and the signature of the customer who received the delivery.
This bill:
- Prohibits a cannabis licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made, or if the consumer has consented to the licensee’s disclosure of the personal information.
- Allows the disclosure of nonpublic personal information to authorized employees of the State of California, a city, county, or city and county to perform official duties.
- Prohibits a licensee from discriminating against a consumer or denying a consumer a product or service because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- States that this bill provides greater protection to personal information than provided by existing statutory guidelines for customer records.
- Deems CUA IDs to be “medical information” within the meaning of the Act and prohibits disclosure by a licensee except as necessary for authorized employees of the State of California, any city, county, or city and county to perform official duties pursuant to this chapter or a local ordinance.
- Deems a cannabis licensee authorized to receive CUA IDs or information contained in a physician’s cannabis recommendation to be a “provider of heath care” for purposes of the Act. Requires these licensees to maintain the same standards of confidentiality required of a provider of health care with respect to medical information disclosed to the business, and be subject to penalties for improper use and disclosure of the medical information.
FISCAL EFFECT:
According to the Assembly Appropriations Committee analysis dated May 9, 2018, this bill has minor additional regulatory, enforcement, and information technology costs to the Bureau (Cannabis Control Fund).
COMMENTS:
- Purpose. This bill is Author sponsored. According to the Author’s office, “Under current law, cannabis licensees are required to collect certain information from their customers to validate they are over 21 years of age. Licensees could sell their customers’ personal information to third parties. Given the newness of legal cannabis in the state, evolving social acceptance of adult cannabis use, and questions about enforcement of federal law against individuals, it is prudent to prohibit licensees from sharing information about cannabis consumers with third parties.”
- Existing Protections. DPH is required to develop protocols to protect the confidentiality of information on CUA IDs, although these protocols are not in regulation and are unknown as of the writing of this analysis. Current law does, however, protect information related to a physician’s cannabis recommendation as “medical information” within the meaning of the Act. However, other personal information collected as a result of cannabis commerce is only protected under general business statutes requiring that an entity “implement and maintain reasonable security procedures and practices” appropriate to the situation. “Reasonable” is not defined.
- Related Legislation This Session. AB 2721 (Quirk) Authorizes cannabis testing laboratories to receive and test samples for cannabis or cannabis products from a person over 21 years of age when the cannabis has been grown by that person and will be used solely for his or her personal use. (Status: This bill is pending in the Senate Appropriations Committee.)
- Prior Related Legislation. SB 94 (Committee on Budget and Fiscal Review, Chapter 27, Statutes of 2017) combined the Adult Use of Marijuana Act and the Medical Cannabis Regulation and Safety Act into one system for the regulation of cannabis, resulting in MAUCRSA.
AB 133 (Committee on Budget, Chapter 253, Statutes of 2017) made technical changes on cannabis related issues necessary to implement the 2017 Budget Act, including allowing testing laboratories to test MUA ID patients’ cannabis for personal use.
- Arguments in Support. CMG/Caliva writes, “This bill seeks to extend basic consumer protection laws to cannabis consumers. In this era of increasingly profound public resentment at having personal information shared with others, people who are consumers of cannabis are particularly attuned to where their personal information goes and how it is used.
“A particular phenomenon arising out of the implementation of Proposition 64 is the gravitation of longstanding medical consumers to adult use purchasers. As a major retailer of cannabis products to the adult use and medical use markets, Caliva has witnessed a dramatic drop off in medical cannabis sales since January 1. The customers are still with us; however, they are simply choosing to abandon their medical recommendations and purchase the same product as an adult use consumer. We are learning first hand from our customers that a factor in their shift to adult use is their hesitation to have personal information collected and saved [by the state] under the medical use structure.”
- Policy Considerations. Cannabis consumers may be unwittingly disclosing a great deal of personal information when purchasing either medicinal or adult-use cannabis. Some examples include: many dispensaries will not only visually check a consumer’s identification to prove age, but scan and store the information electronically; a consumer may purchase cannabis for medical use at an adult-use dispensary, and the dispensary keeps records of a customer’s medical conditions for purpose of future sales; cannabis delivery records are required to note exactly what someone bought, when, and where it was delivered -- all of this information is highly personal and has the potential to be abused.
Medicinal cannabis users currently lack employment protections, universal standards for impairment are still in development, and cannabis and cannabis products remain illegal at the federal level. However, California is currently allowing private businesses to collect potentially compromising information about cannabis users with little protection against its sale or use.
This bill requires certain commercial medical cannabis businesses to abide by the same confidentiality standards as traditional health care providers and limits the dissemination of other personal information by all cannabis licensees unless a consumer consents to share his or her information. This bill also prohibits a licensee from discriminating against a consumer who declines to share personal information.
- Author’s Amendment. This bill seeks to establish parity with traditional medical information protections by deeming a cannabis licensee “authorized to receive” CUA IDs or physician’s recommendations as a “provider of health care” under the Act. However, the only licensees explicitly authorized to receive such information are a M-licensee or testing laboratory. This subjects individuals who choose not to obtain a MUA ID and purchase cannabis from an A-licensee to a lesser privacy standard if the consumer elects to share a physician’s recommendation with the licensee for purposes of cannabis selection.
The Author would like to instead identify any cannabis licensee who receives information from a MUA ID or information contained in a physician’s recommendation as a provider of health care.
On page 5, line 5, after “is authorized to receive” add “or receives”
NOTE:
Double-referral to Senate Judiciary Committee, second.
SUPPORT AND OPPOSITION:
Support:
American Civil Liberties Union of California
California Growers Association
CMG/Caliva
Opposition:
None on file as of June 13, 2018.
-- END --
ASSEMBLY THIRD READING
ATR Bill Id:AB 2402
Author:(Low)
As Amended Ver:April 9, 2018
Majority vote
Committee | Votes | Ayes | Noes |
Business & Professions | 14-2 | Low, Arambula, Baker, Bloom, Chen, Chiu, Cunningham, Eggman, Gipson, Grayson, Holden, Irwin, Mullin, Ting | Brough, Fong |
Privacy | 9-0 | Chau, Baker, Berman, Calderon, Irwin, Mullin, Obernolte, Reyes, Ting | |
Appropriations | 11-1 | Gonzalez Fletcher, Bloom, Bonta, Calderon, Carrillo, Chau, Friedman, Eduardo Garcia, Nazarian, Quirk, Reyes | Brough |
SUMMARY: This bill prohibits adult-use cannabis licensees from disclosing a consumer's personal information to a third party, except to the extent necessary for payment to be made.
Specifically, this bill:
- Prohibits a licensee from disclosing a consumer's personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee's disclosure of the personal information.
- Specifies that the bill does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or to a city, county, or city and county to perform official duties pursuant to Business and Professions Code Division 10.
- Prohibits a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer's nonpublic personal information to a third party not directly related to the transaction.
- Deems identification cards issued pursuant to Health and Safety Code Section 11362.71 to be 'medical information' within the meaning of the Confidentiality of Medical Information Act.
FISCAL EFFECT: According to the Assembly Appropriations Committee, minor additional regulatory, enforcement, and information technology costs to the Bureau of Cannabis Control.
COMMENTS: Current law and regulation require cannabis licensees retain certain records, including receipts, for seven years. The regulations do not explicitly require licensees to retain the personal information that they have collected as part of a sale for seven years, although some licensees may interpret the record retention requirement to apply to that information. In that case, personal information about cannabis consumers could be retained by retailers for seven years and could be sold at any time by the retailer to a third party.
ARGUMENTS IN SUPPORT: The California Growers Association states "this bill would protect the personal information of the consumer of cannabis products by prohibiting cannabis licensees from disclosing a consumer's personal information to a 3rd party… AB 2402 is carefully crafted to protect the integrity of payments and financial transactions required between licensees and consumers."
ARGUMENTS IN OPPOSITION: None on file.
Analysis Prepared by: Brendan McCarthy / B. & P. / (916) 319-3301 FN: 0002908
Date of Hearing: May 9, 2018
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Lorena Gonzalez Fletcher, Chair
ABPCA Bill Id:AB 2402
Author:(Low) – As Amended Ver:April 9, 2018
Policy Committee: | Business and Professions | Vote: | 14 - 2 |
Privacy and Consumer Protection | 9 - 0 |
Urgency: No State Mandated Local Program: Yes Reimbursable: No
SUMMARY:
This bill establishes privacy protections for cannabis consumers. Specifically, this bill:
- Prohibits a cannabis licensee from disclosing a consumer's personal information, with some exceptions.
- Prohibits licensees from discriminating against a consumer or denying a consumer a product or service because the consumer has not consented to third-party disclosure of their information.
- Deems medical cannabis identification cards "medical information" protected under the state's Confidentiality of Medical Information Act.
FISCAL EFFECT:
Minor additional regulatory, enforcement, and information technology costs to the Bureau of Cannabis Control (Cannabis Control Fund).
COMMENTS:
- Purpose. This author-sponsored bill seeks to prohibit cannabis licensees from disclosing a consumer’s personal information to a third party, except to the extent necessary for payment to be made or pursuant to the consumer’s consent. It would prohibit licensees from selling their customers’ personal information to third parties without consent.
- Background. Although voters approved Proposition 64 in 2016 to allow the recreational use of cannabis in the state and medicinal use of cannabis has been legal in the state since 1996, cannabis is still considered an illegal Schedule I drug under federal law. Current law does not prohibit the sharing of a cannabis consumer's personal information with third parties.
CDPH is authorized to issue medical marijuana identification cards. Because someone's medicinal use of cannabis can be argued to be medical information, this bill protects it under existing state law governing medical information privacy.
Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081
Date of Hearing: April 17, 2018
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Ed Chau, Chair
ABPCA Bill Id:AB 2402 (
Author:Low) – As Amended Ver:April 9, 2018
SUBJECT: Cannabis: personal information
SUMMARY: Among other things, this bill would generally prohibit a licensee, under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA), from disclosing a consumer’s personal information, as defined, to a third party. Specifically, this bill would:
- Prohibit a licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information. This prohibition would not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or a city, county, or city and county to perform official duties pursuant to this division or a local ordinance.
- Prohibit that a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- Define, for purposes of this bill, “personal information” to have the same meaning as defined under the State’s existing Information Security law, as specified. Specifically, “personal information means either of the following:
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: (1) social security number; (2) driver’s license number or California identification card number; (3) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; (4) medical information; (5) health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account.
- “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
- Establishes that this bill provides greater protection to personal information than that provided by Section 1798.81.5 of the Civil Code (the State’s Information Security law), which does not apply to licensees under this division, as specified.
- Provide that medical marijuana cards are deemed “medical information” within the meaning of the Confidentiality of Medical Information Act, and shall not be disclosed by a licensee except as necessary for authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to this chapter, or a local ordinance.
EXISTING LAW:
- Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const, art. I, Sec. 1.)
- Requires, under the State’s Information Security law, a business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civ. Code Sec. 1798.81.5(b).)
- Requires a business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party that is not subject to the restriction above to require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. (Civ. Code Sec. 1798.81.5(c).)
- Defines “personal information” for the purposes of this law to mean either of the following:
- An individual’s first name or first initial and his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted: (1) social security number; (2) driver’s license number or California identification card number; (3) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; (4) medical information; (5) health insurance information.
- A username or email address in combination with a password or security question and answer that would permit access to an online account. (Civ. Code Sec. 1798.81.5(d).)
- States that “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. (Civ. Code Sec. 1798.81.5(d).)
- Establishes a uniform licensing framework for both medical and adult-use cannabis under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA) (Bus. & Prof. Code Sec. 26000 et seq.)
FISCAL EFFECT: Unknown
COMMENTS:
- Purpose of the bill: This bill seeks to prohibit adult-use cannabis licensees from disclosing a consumer’s personal information to a third party, except to the extent necessary for payment to be made or pursuant to the consumer’s consent. This bill is author-sponsored.
- Author’s statement: According to the author, “Under current law, cannabis licensees are required to collect certain information from their customers to validate they are over 21 years of age. Licensees could sell their customers’ personal information to third parties. The bill prohibits adult-use cannabis licensees from disclosing a consumer’s personal information to a third party, except to the extent necessary for payment to be made.”
- Bill would limit the disclosure of consumers’ personal information consistent with existing law: The bill would cross reference an existing definition of personal information found within the State’s Information Security law at Section 1798.81.5 in the Civil Code, which was intended to “encourage businesses that own, license, or maintain personal information about Californians to provide reasonable security for that information.”
Specifically, that provision requires businesses that own, license, or maintain personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Additionally, that provision requires businesses to require, by contract, that same level of protection from third parties with whom the business shares a consumer’s personal information. This provision does not, however, prohibit a business from disclosing a consumer’s information.
With regard to the personal consumer information obtained by a MAUCRSA licensee, this bill would instead prohibit the licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and made (i.e., insurance purposes), or if the consumer has consented to the disclosure. This is similar to the level of protection granted to “medical information” under the Confidentiality of Medical Information Act (CMIA), which generally prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.) In addition to prohibiting the disclosure of medical information, the CMIA allows individuals to seek damages for the negligent release of their information, and further provides that any person or entity who knowingly and willfully obtains, discloses, or uses medical information in violation of CMIA shall be liable for an administrative fine not to exceed $2,500 per violation. These penalties and damages operate to ensure that health care providers carefully guard the privacy of patients’ information.
While the information collected by MAUCRSA licensees is might not appear as sensitive as medical information, to ensure that licensee information is similarly safeguarded, as this bill moves through the legislative process, the author may wish to consider how to incorporate provisions which would further deter the unauthorized disclosure of consumers’ information.
- Bill would prohibit discrimination: This bill would prohibit a licensee from discriminating against a consumer, or denying a consumer a product or service because the consumer has not provided consent to disclose the consumer’s nonpublic personal information. The definition of “personal information” under this bill, limits the sharing of a person’s name in combination with another piece of data, such as a social security number, driver’s license number, etc. Personal information also means a username or email address in combination with a password or security question and answer that would permit access to an online account.
Given this provision, a dispensary or other licensee under MAUCRSA would not be able to deny a product or service to a customer with a medical cannabis card simply because he or she did not consent to have his or her information shared with an unaffiliated third party. This provision is consistent with the concept of consent, which must be given freely and without threat of coercion. Indeed, true consent is undermined when a product or service an individual needs is conditioned on his or her agreeing to share his or her personal information.
To this end, the author writes, that “given the newness of legal cannabis in the state, evolving social acceptance of adult cannabis use, and questions about enforcement of federal law against individuals, it is prudent to prohibit licensees from sharing information about cannabis consumers with third parties.”
- Double-referral: This bill was double-referred to the Assembly Business and Professions Committee where it was heard on April 10, 2018, and passed out on a 14-2 vote.
REGISTERED SUPPORT / OPPOSITION:
Support
California Growers Association
Opposition
None on file
Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200
Date of Hearing: April 10, 2018
ASSEMBLY COMMITTEE ON BUSINESS AND PROFESSIONS
Evan Low, Chair
ABPCA Bill Id:AB 2402
Author:(Low) – As Amended Ver:April 9, 2018
SUBJECT: Cannabis: personal information.
NOTE: This bill is double-referred and if passed by this committee will be referred to the Assembly Committee on Privacy and Consumer Protection.
SUMMARY: This bill prohibits adult-use cannabis licensees from disclosing a consumer’s personal information to a third party, except to the extent necessary for payment to be made. The bill would deem identification cards issued to qualified patients seeking medical cannabis to be “medical information” within the meaning of the Confidentiality of Medical Information Act, therefore limiting the disclosure of that information.
EXISTING LAW:
- Under the Confidentiality of Medical Information Act, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining authorization from the patient or enrollee. (Civil Code Section 56.10 et seq)
- Establishes the Bureau of Cannabis Control (Bureau) under the Department of Consumer Affairs (DCA), to establish a comprehensive system to control and regulate the distribution, transport, storage, and sale of cannabis products. (Business and Professions Code (BPC) Section 26000 et seq.)
- Requires cannabis licensees to keep accurate records of commercial cannabis activity. Requires licensees to retain records of commercial cannabis activity, as defined by the licensing authority, for a minimum of seven years. (BPC Section 26160)
- Deems information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by licensing authorities to be confidential information, not be disclosed pursuant to the California Public Records Act. (BPC Section 26162)
- Deems information contained in a physician’s recommendation for medical cannabis, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patients primary caregiver to be “medical information” within the meaning of the Confidentiality of Medical Information Act and prohibits disclosure of that information by a licensee, except as necessary to authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to state law or a local ordinance. (BPC Section 26162.5)
- Requires licensees to retain specified records for seven years, including sales receipts. (California Code of Regulations (CCR) Section 5037) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires each licensed cannabis retail premises to have a digital video surveillance system that is in operation at all times and provides coverage for specified areas, including point-of-sale areas. (CCR Section 5044) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires each licensed cannabis retail premises to maintain an accurate record for every sale made to a customer, with specified information retained for sale of medical cannabis. (CCR Section 5425) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Prohibits a retailer from selling more than 28.5 grams of non-concentrated cannabis, 8 grams of concentrated cannabis, or 6 immature cannabis plants to a single adult-use cannabis customer in a single day. (CCR Section 5409) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Prohibits a retailer from selling more than 8 grams of medicinal cannabis or 12 immature cannabis plants to a single medicinal cannabis patient or a patient’s primary care giver in a single day. (CCR Section 5409) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires the Department of Public Health to establish and maintain a program for the issuance of identification cards to qualified medical cannabis patients to meet the requirements specified in law and requires county health departments to issue identification cards developed by the Department. (Health and Safety Code Section 11362.71)
THIS BILL:
- Prohibits a licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information.
- Specifies that the bill does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or to a city, county, or city and county to perform official duties pursuant to Division 10 of the Business and Professions Code.
- Prohibits a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- Defines personal information, for the purposes of the bill, to have the same meaning as defined in Section 1798.81.5(d) of the Civil Code.
- Provides that Section 26161.5 created by the bill provides greater protection to personal information that provided by Section 1798.81.5 of the Civil Code.
- Deems identification cards issued pursuant to Section 11362.71 of the Health and Safety Code to be “medical information” within the meaning of the Confidentiality of Medical Information Act. (Note: this provision of the bill was added in the recent amendments.)
FISCAL EFFECT: Unknown. This bill is keyed fiscal by Legislative Counsel.
COMMENTS:
Purpose. This bill is sponsored by the author. According to the author, “AB 2402 extends critical privacy protections that exist for medical cannabis users to adult-use cannabis users, thereby creating conformity in the law”.
Background. History of Legal Cannabis in California. In 1996, California voters passed Proposition 215, legalizing the use of medical cannabis in the state. In October 2015, nearly 20 years after the authorization of the use of medical cannabis, Governor Jerry Brown signed into law a trio of bills [AB 243 (Wood), Chapter 688, Statutes of 2015, AB 266 (Bonta, Cooley, Jones-Sawyer, Lackey, and Wood), Chapter 689, Statutes of 2015, and SB 643 (McGuire), Chapter 719, Statutes of 2015] collectively known as MCRSA. MCRSA established the state's first regulatory framework for medical cannabis. In 2016, the voters of California passed Proposition 64, the AUMA, to legalize the recreational use of cannabis in the state by 2018. In June 2017, AUMA and MCRSA were combined via the budget process to form one system for the regulation of Cannabis, MAUCRSA.
Current law requires adult-users of cannabis to provide their identification to retail cannabis licensees in order to verify their age. In addition, current regulation limits the amount of adult-use or medical cannabis that a consumer may purchase per day. In order for retail licensees to comply with this requirement, they will have to keep records of each sale to each customer on a daily basis.
Current law and regulation require cannabis licensees retain certain records, including receipts, for seven years. The regulations do not explicitly require licensees to retain the personal information that they have collected as part of a sale for seven years, although some licensees may interpret the record retention requirement to apply to that information. In that case, personal information about cannabis consumers could be retained by retailers for seven years and could be sold at any time by the retailer to a third party.
While there are existing protections in law for personal information of medical cannabis users, there are no similar protections for adult-use consumers. Under current law, retail licensees could use information gathered from consumers for their own marketing purposes or sell that information to third parties without the consent of the consumer.
Prior Related Legislation. SB 94 (Committee on Budget and Fiscal Review, Chapter 27, Statutes of 2017) of the current legislative session combined AUMA and MCRSA into one system for the regulation of cannabis, resulting in MAUCRSA.
ARGUMENTS IN SUPPORT:
The California Growers Association states “this bill would protect the personal information of the consumer of cannabis products by prohibiting cannabis licensees from disclosing a consumer’s personal information to a 3rd party…AB 2402 is carefully crafted to protect the integrity of payments and financial transactions required between licensees and consumers”.
ARGUMENTS IN OPPOSITION:
None on file
REGISTERED SUPPORT:
California Growers Association
REGISTERED OPPOSITION:
None on file
Analysis Prepared by: Brendan McCarthy / B. & P. / (916) 319-3301
Date of Hearing:
ASSEMBLY COMMITTEE ON BUSINESS AND PROFESSIONS
Evan Low, Chair
ABPCA Bill Id:AB 2402
Author:(Low) – As Amended Ver:April 6, 2018
SUBJECT: Cannabis: personal information.
NOTE: This bill is double-referred and if passed by this committee will be referred to the Assembly Committee on Privacy and Consumer Protection.
SUMMARY: This bill prohibits adult-use cannabis licensees from disclosing a consumer’s personal information to a third party, except to the extent necessary for payment to be made. The bill would deem identification cards issued to qualified patients seeking medical cannabis to be “medical information” within the meaning of the Confidentiality of Medical Information Act, therefore limiting the disclosure of that information.
EXISTING LAW:
- Under the Confidentiality of Medical Information Act, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining authorization from the patient or enrollee. (Civil Code Section 56.10 et seq)
- Establishes the Bureau of Cannabis Control (Bureau) under the Department of Consumer Affairs (DCA), to establish a comprehensive system to control and regulate the distribution, transport, storage, and sale of cannabis products. (Business and Professions Code (BPC) Section 26000 et seq.)
- Requires cannabis licensees to keep accurate records of commercial cannabis activity. Requires licensees to retain records of commercial cannabis activity, as defined by the licensing authority, for a minimum of seven years. (BPC Section 26160)
- Deems information identifying the names of patients, their medical conditions, or the names of their primary caregivers received and contained in records kept by licensing authorities to be confidential information, not be disclosed pursuant to the California Public Records Act. (BPC Section 26162)
- Deems information contained in a physician’s recommendation for medical cannabis, including but not limited to, the name, address, or social security number of the patient, the patient’s medical condition, or the name of the patients primary caregiver to be “medical information” within the meaning of the Confidentiality of Medical Information Act and prohibits disclosure of that information by a licensee, except as necessary to authorized employees of the State of California or any city, county, or city and county to perform official duties pursuant to state law or a local ordinance. (BPC Section 26162.5)
- Requires licensees to retain specified records for seven years, including sales receipts. (California Code of Regulations (CCR) Section 5037) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires each licensed cannabis retail premises to have a digital video surveillance system that is in operation at all times and provides coverage for specified areas, including point-of-sale areas. (CCR Section 5044) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires each licensed cannabis retail premises to maintain an accurate record for every sale made to a customer, with specified information retained for sale of medical cannabis. (CCR Section 5425) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Prohibits a retailer from selling more than 28.5 grams of non-concentrated cannabis, 8 grams of concentrated cannabis, or 6 immature cannabis plants to a single adult-use cannabis customer in a single day. (CCR Section 5409) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Prohibits a retailer from selling more than 8 grams of medicinal cannabis or 12 immature cannabis plants to a single medicinal cannabis patient or a patient’s primary care giver in a single day. (CCR Section 5409) (Note this is an emergency regulation adopted by the Bureau of Cannabis Control; final regulations have not yet been adopted.)
- Requires the Department of Public Health to establish and maintain a program for the issuance of identification cards to qualified medical cannabis patients to meet the requirements specified in law and requires county health departments to issue identification cards developed by the Department. (Health and Safety Code Section 11362.71)
THIS BILL:
- Prohibits a licensee from disclosing a consumer’s personal information to a third party, except to the extent necessary to allow responsibility for payment to be determined and payment to be made or if the consumer has consented to the licensee’s disclosure of the personal information.
- Specifies that the bill does not prohibit the disclosure of nonpublic personal information to authorized employees of the State of California or to a city, county, or city and county to perform official duties pursuant to Division 10 of the Business and Professions Code.
- Prohibits a licensee from discriminating against a consumer, or denying a consumer a product or service, because the consumer has not provided consent to authorize the licensee to disclose the consumer’s nonpublic personal information to a third party not directly related to the transaction.
- Defines personal information, for the purposes of the bill, to have the same meaning as defined in Section 1798.81.5(d) of the Civil Code.
- Provides that Section 26161.5 created by the bill provides greater protection to personal information that provided by Section 1798.81.5 of the Civil Code.
- Deems identification cards issued pursuant to Section 11362.71 of the Health and Safety Code to be “medical information” within the meaning of the Confidentiality of Medical Information Act. (Note: this provision of the bill was added in the recent amendments.)
FISCAL EFFECT: Unknown. This bill is keyed fiscal by Legislative Counsel.
COMMENTS:
Purpose. This bill is sponsored by the author. According to the author, “AB 2402 extends critical privacy protections that exist for medical cannabis users to adult-use cannabis users, thereby creating conformity in the law”.
Background. History of Legal Cannabis in California. In 1996, California voters passed Proposition 215, legalizing the use of medical cannabis in the state. In October 2015, nearly 20 years after the authorization of the use of medical cannabis, Governor Jerry Brown signed into law a trio of bills [AB 243 (Wood), Chapter 688, Statutes of 2015, AB 266 (Bonta, Cooley, Jones-Sawyer, Lackey, and Wood), Chapter 689, Statutes of 2015, and SB 643 (McGuire), Chapter 719, Statutes of 2015] collectively known as MCRSA. MCRSA established the state's first regulatory framework for medical cannabis. In 2016, the voters of California passed Proposition 64, the AUMA, to legalize the recreational use of cannabis in the state by 2018. In June 2017, AUMA and MCRSA were combined via the budget process to form one system for the regulation of Cannabis, MAUCRSA.
Current law requires adult-users of cannabis to provide their identification to retail cannabis licensees in order to verify their age. In addition, current regulation limits the amount of adult-use or medical cannabis that a consumer may purchase per day. In order for retail licensees to comply with this requirement, they will have to keep records of each sale to each customer on a daily basis.
Current law and regulation require cannabis licensees retain certain records, including receipts, for seven years. The regulations do not explicitly require licensees to retain the personal information that they have collected as part of a sale for seven years, although some licensees may interpret the record retention requirement to apply to that information. In that case, personal information about cannabis consumers could be retained by retailers for seven years and could be sold at any time by the retailer to a third party.
While there are existing protections in law for personal information of medical cannabis users, there are no similar protections for adult-use consumers. Under current law, retail licensees could use information gathered from consumers for their own marketing purposes or sell that information to third parties without the consent of the consumer.
Prior Related Legislation. SB 94 (Committee on Budget and Fiscal Review, Chapter 27, Statutes of 2017) of the current legislative session combined AUMA and MCRSA into one system for the regulation of cannabis, resulting in MAUCRSA.
ARGUMENTS IN SUPPORT:
The California Growers Association states “this bill would protect the personal information of the consumer of cannabis products by prohibiting cannabis licensees from disclosing a consumer’s personal information to a 3rd party…AB 2402 is carefully crafted to protect the integrity of payments and financial transactions required between licensees and consumers”.
ARGUMENTS IN OPPOSITION:
None on file
REGISTERED SUPPORT:
California Growers Association
REGISTERED OPPOSITION:
None on file
Analysis Prepared by: Brendan McCarthy / B. & P. / (916) 319-3301
Discussed in Hearing
43SEC
Assembly Floor
2MIN
Senate Floor
1MIN
Senate Standing Committee on Business, Professions and Economic Development
43SEC
Assembly Floor
1MIN
Assembly Standing Committee on Appropriations
7MIN
Assembly Standing Committee on Privacy and Consumer Protection
2MIN
Assembly Standing Committee on Business and Professions
Bill Author
Bill Co-Author(s):