Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.

This bill would prohibit an operator of a commercial health monitoring program from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a 3rd party without first providing clear and conspicuous notice and obtaining the consumers affirmative consent, except as provided. The bill would require an operator of a commercial health monitoring program, upon request, to delete a consumers individually identifiable health monitoring information, and to maintain or delete individually identifiable health monitoring information in a manner that preserves security and confidentiality. The bill would define terms for its purposes and exempt entities and individuals subject to HIPAA or the Confidentiality of Medical Information Act from these requirements.

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: AB 2935 (Author:Chau)

Version: February 16, 2018

Hearing Date: July 3, 2018

Fiscal: No

Urgency: No

Consultant: JDT

SUBJECT

Health information privacy: digital commercial health monitoring

DESCRIPTION

This bill would prohibit an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in its possession or derived from a CHMP without first obtaining the consumer’s consent.

BACKGROUND

In July 2013, the Privacy Rights Clearinghouse released a report entitled “Mobile Health and Fitness Applications and Information Privacy.” The report examined a total of 43 free and paid mobile phone applications, or “apps,” on more than 150 separate data points related to privacy and security.

The report stated “our research brought us to the conclusion that, from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them.” The report also found that, as of 2013, 39 percent of free apps and 30 percent of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13 percent of free apps and 10 percent of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (March 8, 2016) did an analysis of privacy practices of diabetes management applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81 percent lacked privacy policies, and among those that did, 49 percent included permissions to share data with partners and third parties and 39 percent authorized use of data for advertising purposes.

The JAMA report noted, “this study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps.”

Partially in response, the Legislature passed AB 658 (Calderon, Ch. 296, Stats. 2013), which applied the prohibitions of the Confidentiality of Medical Information Act to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.

Subsequently, the Legislature considered AB 2688 (Gordon, 2016), which sought to regulate the disclosure of information in possession of or derived from a CHMP to a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent. However, that bill ultimately died because privacy advocates who opposed the bill asserted that it did not create sufficiently robust consumer protections. Additionally, a coalition of technology companies were in opposition, alleging that the bill would result in “unintended consequences, logistical difficulties, and consumer harm.”

This bill, essentially a resurrection of AB 2688, would again seek to regulate the disclosure of information in the possession of or derived from a CHMP.

CHANGES TO EXISTING LAW

Existing law, the California Constitution, provides that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)

Existing federal law, the Health Insurance Portability and Accountability Act (HIPAA), specifies privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)

Existing law prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)

Existing law defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Existing law defines “individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(g).)

Existing law provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)

Existing law provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

Existing law, AB 375 (Chau, Ch. 55, Stats. 2018), the California Consumer Privacy Act of 2018, which will become effective January 1, 2019, and operative January 1, 2020, provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price. AB 375 prohibits a third party from selling personal information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt out. AB 375 also provides consumers the right, at any time, to direct a business that sells personal information about the consumer to third parties to cease selling that information. AB 375 also provides that minors must consent to the sale of their personal information before a business can sell it.

This bill would prohibit an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information (personal health data) to or with a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent that fulfills all of the following requirements:

• the request for consent is separate from all other authorizations or agreements;
• the request for consent includes the name or nature of the third party and the purpose for the request; and
• the consumer’s refusal to consent to third-party sharing, sale, or disclosure of health information does not limit the consumer’s ability to use the CHMP, unless the primary function of the CHMP program is the sharing, sale, or disclosure of health information to third parties, and the consumer is notified of this function at the time of the request for consent.

This bill would enable a consumer to request that the operator of a CHMP delete their personal health data, for which the CHMP may charge a reasonable administrative fee.

This bill would provide that a waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent request is unenforceable and void as a matter of law.

This bill would require an operator of a CHMP who manages personal health data to do so in a manner that preserves the security and confidentiality of the information contained therein.

This bill would provide that it does not limit the required disclosure of personal health data under other laws.

This bill would provide that it does not limit other laws that protect privacy.

This bill would provide that personal health data may be disclosed to health care providers or government officials in specified circumstances, if the disclosing entity, as soon as practicable, discloses this fact to the consumer whose personal health data was disclosed.

This bill would prohibit a recipient of personal health data that is not a CHMP from further disclosing the information.

This bill would specify that its provisions do not apply to a covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code).

COMMENT

1. Stated need for the bill

The author writes:

Modern technology has empowered consumers to take control of their health outside of the medical setting through the use of health monitoring programs. These programs are capable of tracking substantial private health information including but not limited to a consumer’s heart rate, blood glucose, sleeping habits, and sexual activity. While some consumers may be fine with their personal health information being shared to third parties, legislation is needed to ensure that consumers who don’t wish to have their personal health information shared have the opportunity to opt out – or consent to the sharing of their personal health data.

In support, the California School Employees Association, AFL-CIO, states that this bill brings medical privacy to the digital age by prohibiting CHMPs from selling or sharing personal health data, without first obtaining consent from the user.

In further support, the California Association for Health Services at Home states that with the advances in cyber technology and perpetrators finding more ways to capture an individual’s important personal data, it is important that we work together to pass legislation that will ensure the protection of an individual’s personal health information.

2. Did AB 375 swallow this bill?

AB 375 (Chau, Ch. 55, Stats. 2018), the California Consumer Privacy Act of 2018, which will become effective January 1, 2019, and operative January 1, 2020, provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price. AB 375 prohibits a third party from selling personal information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt out. AB 375 also provides consumers the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell that information. AB 375 also provides that minors must consent to the sale of their personal information before a business can sell it.

This bill would prohibit an operator of a CHMP from intentionally sharing, selling, or disclosing personal health data to or with a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent in a manner that fulfills all of the following requirements:

• the request for consent is separate from all other authorizations or agreements;
• the request for consent includes the name or nature of the third party and the purpose for the request; and
• the consumer’s refusal to consent to third-party sharing, sale, or disclosure of personal health data must not limit the consumer’s ability to use the CHMP, unless the primary function of the CHMP program is the sharing, sale, or disclosure of personal health data to third parties, and the consumer is notified of this function at the time of the request for consent.

Thus, whereas AB 375 provides that minors must consent to the sale of their personal health data before a business can sell it, this bill provides stronger protections by establishing a similar requirement for all consumers—namely, that a CHMP must obtain the affirmative consent of any consumer before selling or sharing their personal health data.

3. Interaction with the Federal Arbitration Act

Arbitration is an alternative method for resolving legal disputes. Instead of going through the formal, public court process, the parties to the dispute submit their evidence and legal arguments to a private arbitrator (or a panel of arbitrators) who decides the case. Critics of arbitration point out that it can be one-sided, especially when forced upon parties with less bargaining power, and that it lacks the transparency of the public court system, among other things.

The Civil Justice Association of California (CJAC) asserts that this provision “would void any arbitration agreement even when it has been entered into willing by both parties,” and states that “[a]rbitration is good for consumers and businesses, because it reduces the cost of litigation, and promotes fairer and more significant remedies for consumers.” CJAC further asserts that this provision is likely preempted under the Federal Arbitration Act, which provides that agreements to arbitrate are valid, irrevocable, and enforceable, except on such grounds as exist at law or in equity for the revocation of any contract. (9 U.S.C. Sec. 2.)

The concept of preemption derives from the “supremacy clause” of the federal Constitution, which provides that the laws of the United States “shall be the supreme Law of the Land.” (U.S. Const., art. VI, cl. 2.) Courts have typically identified three circumstances in which federal preemption of state law occurs:

(1) express preemption, where Congress explicitly defines the extent to which its enactments preempt state law; (2) field preemption, where state law attempts to regulate conduct in a field that Congress intended the federal law exclusively to occupy; and (3) conflict preemption, where it is impossible to comply with both state and federal requirements, or where state law stands as an obstacle to the accomplishment and execution of the full purpose and objectives of Congress. (English v. Gen. Elec. Co. (1990) 496 U.S. 72, 78-80.)

Recently, the U.S. Supreme Court ruled in a suite of cases that arbitration agreements that have the effect of preventing class actions must nonetheless be enforced, even though class actions might be considered “concerted action” protected under the National Labor Relations Act. (Epic Systems Corp. v. Lewis (May 21, 2018, No. 16–285) 584 U.S. ___; 2018 WL 2292444; decided together with Ernst & Young LLP et al. v. Morris et al. (No. 16–300); and National Labor Relations Board v. Murphy Oil USA, Inc., et al. (No. 16–307).) Though the context of that case is different from the circumstances that have prompted this bill, the Epic Systems holding nonetheless indicates that the judiciary remains strongly supportive of arbitration.

In assessing whether a state law is preempted, three key aspects of the law surrounding arbitration and preemption are especially relevant. First, the federal courts have ruled that the Federal Arbitration Act was intended to promote arbitration. (Epic Systems Corp., supra (May 21, 2018, No. 16–285) 584 U.S. ___ at p. 5.) Second, state laws or rules that interfere with the enforcement of arbitration agreements are preempted, except on such grounds as exist at law or in equity for the revocation of any contract. (9 U.S.C. Sec. 2; AT&T Mobility LLC v. Concepcion (2011) 563 U.S. 333, 339.) Third, state laws that explicitly or covertly discriminate against arbitration agreements as compared to other contracts are also preempted. (Epic Systems Corp., supra (May 21, 2018, No. 16–285) 584 U.S. ___ at p. 7.)

Author’s amendment

To address concerns regarding possible preemption under the Federal Arbitration Act, the author has agreed to clarify that an arbitration clause cannot be included in a request for consent; rather, it must be included in separate authorizations or agreements. Consequently, this provision, as proposed to be amended, would regulate the content of the request for consent but would not purport to render an arbitration agreement unenforceable. This change obviates the preemption concern, and would be made as follows:

(4) A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law. (A) A request for consent under this section shall not include any other terms of agreement, including a waiver of any legal right, remedy, forum, or enforcement procedure.

(B) Subparagraph (A) does not affect the scope of permissible content in separate authorizations and agreements that do not contain the consent request required under this section.

4. Concerns that the bill does too much

A coalition of organizations that includes the California Chamber of Commerce, CompTIA, and TechNet opposes this bill unless amended to address a variety of policy and practical concerns. The coalition argues:

Requiring separate consent for health monitoring information elevates that broad category of information over other types of important information – going down this path, it is not hard to envision multiple categories of information competing for their own separate consent. This could run counter to the author’s stated intent, because too many separate consent requirements can lead to user fatigue, causing people to just click through various notifications.

5. Concerns that the bill doesn’t do enough

The American Civil Liberties Union of California (ACLU) argues that the definitions in the bill need to be refined to eliminate any loopholes which could undermine the author’s intent. The ACLU writes:

The request for consent to authorize sharing of individually identifiable health monitoring information requires that the request be separate from other authorizations and include either the name or the nature of the third party. Instead, the bill should require that the request for consent be clear and conspicuous, in addition to being separate from other authorizations, so that the requests must be written in a way that consumers understand rather than be as incomprehensible to the average consumer as most terms and conditions currently are. […]

[Additionally,] AB 2935 addresses only the sharing or selling of “individually identifiable” health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic because of the role of de-anonymization.

Support: California Association for Health Services at Home; California School Employees Association, AFL-CIO

Opposition: Advanced Medical Technology Association; American Civil Liberties Union of California; California Chamber of Commerce; Civil Justice Association of California; CompTIA; TechNet

HISTORY

Source: Author

Related Pending Legislation:

SB 1121 (Dodd, 2018) would replace the term “customer” as used in Sections 1798.80 through 1798.84 of the Civil Code, the California Customer Records Act, with the term “consumer.” It would also provide any consumer whose personal information has been breached or has not been properly notified of a breach with the right to institute a civil action for the recovery of statutory damages, injunctive or declaratory relief, and any other relief the court deems proper. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1859 (Chau, 2018) would require a consumer credit reporting agency that knows of a vulnerability that could compromise the security of personal information for which there is an update to address, to apply that update or be held liable for any resulting damages. This bill is currently in the Senate Appropriations Committee.

Prior Legislation:

AB 375 (Chau, Ch. 55, Stats. 2018) grants consumers specified rights related to their personal information that is collected, shared, or maintained by a business. That law takes effect January 1, 2019, and becomes operative January 1, 2020.

AB 2747 (Assembly Committee on Judiciary, Ch. 913, Stats. 2014) extends CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.

AB 658 (Calderon, Ch. 296, Stats. 2013) applies the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.

AB 1298 (Snyder, Ch. 699, Stats. 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the Confidentiality of Medical Information Act (CMIA).

AB 336 (Snyder, Ch. 1004, Stats. 1993) deemed certain corporations to be providers of health care under the CMIA.

Prior Vote:

Assembly Floor (Ayes 57, Noes 15)

Assembly Privacy and Consumer Protection Committee (Ayes 7, Noes 3)

Assembly Health Committee (Ayes 12, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 2935

Author:(Chau)

As Introduced Ver:February 16, 2018

Majority vote

SUMMARY: This bill prohibits an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in its possession or derived from a CHMP without first obtaining the consumer's consent. Specifically, this bill:

1. Prohibits a CHMP operator from intentionally sharing, selling, or disclosing individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumer's affirmative consent that fulfills the following requirements:
   1. The request for consent must be separate from all other authorizations or agreements; and
   2. The request for consent must include the name or nature of the third party and the purpose of the request;
   3. The consumer's refusal to consent, as specified, must not limit the consumer's ability to use the CHMP even if features and services provided by the specific third party are inoperable.
   4. A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer, as specified, is unenforceable and void as a matter of law.
2. Requires a CHMP operator to make available and provide notice of a process whereby a consumer may withdraw consent, as specified, and would require the consent withdrawal to be prospective and not impact valid disclosures and consent prior to the operative withdrawal date.
3. Requires the CHMP operator, upon request by the consumer, to delete or provide the consumer his or her individually identifiable health monitoring information, as specified, and would allow the CHMP to assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information.
4. Requires a CHMP operator that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information to do so in a manner that preserves the security and confidentiality of the individually identifiable health monitoring information.
5. States that this chapter governing digital commercial health monitoring is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to any other law.
6. Provides that this chapter governing digital commercial health monitoring is not to be construed to limit or otherwise reduce existing privacy protections in state or federal law.
7. Authorizes individually identifiable health monitoring information to be disclosed to the following persons without satisfying the consent requirements, as specified, if the disclosing entity provides notice of the disclosure as soon as practicable to the consumer whose individually identifiable health monitoring information was disclosed:
   1. To a health care provider to aid in the diagnosis or treatment of the consumer, as specified; or,
   2. To a government official if necessary, as specified.
8. Prohibits a recipient of individually identifiable health monitoring information that is not a CHMP from disclosing that health information, and would provide that responsibility for a violation is not with the commercial health monitoring agency but with the disclosing entity.
9. Defines a "CHMP" as a commercial internet website, online service, or product used by consumers whose primary purpose is to collect the consumer's individually identifiable health monitoring information.
10. Defines "health monitoring information" as information, in electronic or physical form, about a consumer's mental or physical condition that is collected by a CHMP, as specified.
11. Defines "individually identifiable information" as information that includes or contains an element of personal identifying information to allow identification of the consumer, as specified.
12. Defines "service provider" as an entity that does not further use or disclose individually identifiable health information except at the direction of the CHMP to other services of the CHMP and does either of the following:
    1. provides services to the operator, or on behalf of the operator, of the CHMP that solely support the functionality or operation of the CHMP; or,
    2. controls, or is controlled by, or is under common control with the provider of the CHMP when both of the following apply:
       1. The entity maintains third party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the CHMP; and,
       2. The operator of the CHMP disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.
13. Defines third party as an entity that is not a service provider, as specified.

FISCAL EFFECT: Unknown

COMMENTS: In July 2013, the Privacy Rights Clearinghouse (PRC) released a report entitled "Mobile Health and Fitness Applications and Information Privacy." The report examined a total of 43 free and paid mobile phone applications on more than 150 separate data points related to privacy and security.

PRC's report concluded that, "from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users' privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them." The PRC report also found that, as of 2013, 39% of free apps and 30% of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13% of free apps and 10% of paid apps used encryption for all data connections and transmissions.

This bill would close a gap in existing law by prohibiting operators from intentionally sharing, selling, or disclosing health monitoring information to a third party without explicit authorization from the consumer. The requirement that operators get the explicit opt-in authorization before sharing or selling information has a number of additional provisions intended to ensure that the consumer is adequately informed about the decision. For example: the request must be clear, conspicuous and separate; the request must specify the name or nature of the third party and the reason for the request; the request must be limited to a single third party; and refusal cannot limit the consumer's ability to use the program. These protections are not waivable, and a consumer has the right to revoke an authorization without penalty at any time. In support, the California School Employees Association writes that "AB 2935 brings medical privacy to the digital age by prohibiting digital monitoring programs from selling or sharing personal health data, without first obtaining the consent of the user."

Arguments in support: In support, the California School Employees Association writes that "AB 2935 brings medical privacy to the digital age by prohibiting digital monitoring programs from selling or sharing personal health data, without first obtaining the consent of the user."

Arguments in opposition: A coalition of organizations including the California Chamber of Commerce, CompTIA, and TechNet (coalition) opposes this bill unless amended to address a variety of policy and practical concerns. Specifically, the coalition argues that, "[r]equiring separate consent for health monitoring information elevates that broad category of information over other types of important information – going down this path, it is not hard to envision multiple categories of information competing for their own separate consent. This could run counter to the author's stated intent, because too many separate consent requirements can lead to user fatigue, causing people to just click through various notifications."

Also opposing this bill unless amended to address a variety of concerns, including incorporating a private right of action as an enforcement mechanism and expressly including mobile applications under the bill, the American Civil Liberties Union of California (ACLU) argues that the definitions in the bill need to be tightened up to eliminate any loopholes which could undermine the author's intent. The ACLU writes:

The request for consent to authorize sharing of individually identifiable health monitoring information requires that the request be separate from other authorizations and include either the name or the nature of the third party. Instead, the bill should require that the request for consent be clear and conspicuous, in addition to being separate from other authorizations, so that the requests must be written in a way that consumers understand rather than be as incomprehensible to the average consumer as most terms and conditions currently are. […]

[Additionally,] AB 2935 addresses only the sharing or selling of "individually identifiable" health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic because of the role of de-anonymization.

In addition, the Civil Justice Association of California (CJAC) opposes this bill unless amended to eliminate a provision that provides "[a] waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law." CJAC argues:

This section is unnecessary, bad for consumers and potentially costly for small and emerging businesses. As written, it would void any arbitration agreement even when it has been entered into willingly by both parties. Arbitration is good for consumers and businesses, because it reduces the cost of litigation, and promotes fairer and more significant remedies for consumers. In order to be valid, an arbitration agreement must provide the same substantive rights as the Courts, and regularly compensate harmed claimants at much greater levels then comparable class action suits.

Arbitration clauses are helpful to small and emerging business in the health IT [information technology] space because it cuts down on the legal costs associated with traditional civil litigation. Voiding them as a matter of law, without a comparative analysis of consumer benefits versus civil litigation is bad public policy.

With regard to the requirement that consumers need to be informed as to the third parties with whom their information is shared, the coalition argues in opposition that if a CHMP "shares data with numerous third parties in order to function properly, this could result in a lengthy and ever-changing list of entities that would not be meaningful to a consumer. As written, this bill appears to require consent from a consumer for any future sharing of third party data, regardless of purpose. This presents practical challenges for certain types of technology – it could also result in user fatigue."

The ACLU additionally argues that the bill does not go far enough in protecting anonymized data. ACLU writes, "AB 2935 addresses only the sharing or selling of 'individually identifiable' health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic because of the role of de-anonymization. In March 2016, a legal scholar testified to Congress that 'wearable device data is prone to re-identification.' The disclosure of individualized records should require consent whether or not the individual is identified because of the risk that an interested party could re-identify the records using other, non-public data."

The coalition further argues that limitations on functionality based on a consumer's failure to share his or her identifiable information is problematic because "[a]lthough data sharing may not be the 'primary function' of a program, data sharing is frequently integral to the functioning of a program. Technology dependent upon the sharing of information should not be required to continue to function after a consumer refuses consent. Additionally, there are practical concerns with ensuring that a consumer understands in advance that their decision not to share may result in the technology not working properly or at all."

This bill would prohibit third parties that receive individually identifiable health monitoring information from further disclosing that information in order to ensure that a consumer's data cannot be shared and sold time and time again without the consumer's knowledge or consent. In opposition, the coalition argues that "the practical challenge with this requirement is ensuring that a recipient of such broadly defined 'health monitoring information' will know that the information they have received is regulated by this law. […] Finally, the definition of 'service provider' appears to exclude many types of affiliate sharing. Affiliate sharing is a common practice that does not present the kinds of privacy concerns the bill intends to address."

Countering this argument, the ACLU, argues that the definitions are under the bill are actually too broad. The ACLU writes, "the definition of service provider permits a CHMP to share health information with other entities under common control if they have the same level of privacy protections as the CHMP and are principally engaged in the same line of business. Thus, for example, the bill would permit the health monitoring information of a consumer using one Google commercial health monitoring program to be shared with all other Google commercial health monitoring programs even if the consumer refused to consent to the sharing of their health monitoring information."

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200 FN: 0002794

Date of Hearing: May 1, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2935 (

Author:Chau) – As Introduced Ver:February 16, 2018

SUBJECT: Health information privacy: digital commercial health monitoring

SUMMARY: This bill would prohibit an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in its possession or derived from a CHMP without first obtaining the consumer’s consent. Specifically, this bill would:

1. Prohibit a CHMP operator from intentionally sharing, selling, or disclosing individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent that fulfills the following requirements:
   • the request for consent must be separate from all other authorizations or agreements; and
   • the request for consent must include the name or nature of the third party and the purpose of the request;
   • the consumer’s refusal to consent, as specified, must not limit the consumer’s ability to use the CHMP even if features and services provided by the specific third party are inoperable.
   • a waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer, as specified, is unenforceable and void as a matter of law.
2. Require a CHMP operator to make available and provide notice of a process whereby a consumer may withdraw consent, as specified, and would require the consent withdrawal to be prospective and not impact valid disclosures and consent prior to the operative withdrawal date.
3. Require the CHMP operator, upon request by the consumer, to delete or provide the consumer his or her individually identifiable health monitoring information, as specified, and would allow the CHMP to assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information.
4. Require a CHMP operator that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information to do so in a manner that preserves the security and confidentiality of the individually identifiable health monitoring information.
5. State that this chapter governing digital commercial health monitoring is not intended to limit the required disclosure of individually identifiable health monitoring information pursuant to any other law.
6. Provide that this chapter governing digital commercial health monitoring is not to be construed to limit or otherwise reduce existing privacy protections in state or federal law.
7. Authorize individually identifiable health monitoring information to be disclosed to the following persons without satisfying the consent requirements, as specified, if the disclosing entity provides notice of the disclosure as soon as practicable to the consumer whose individually identifiable health monitoring information was disclosed:
   • to a health care provider to aid in the diagnosis or treatment of the consumer, as specified; or,
   • to a government official if necessary, as specified.
8. Prohibit a recipient of individually identifiable health monitoring information that is not a CHMP from disclosing that health information, and would provide that responsibility for a violation is not with the commercial health monitoring agency but with the disclosing entity.
9. Define a “CHMP” as a commercial internet website, online service, or product used by consumers whose primary purpose is to collect the consumer’s individually identifiable health monitoring information.
10. Define “health monitoring information” as information, in electronic or physical form, about a consumer’s mental or physical condition that is collected by a CHMP, as specified.
11. Define “individually identifiable information” as information that includes or contains an element of personal identifying information to allow identification of the consumer, as specified.
12. Define “service provider” as an entity that does not further use or disclose individually identifiable health information except at the direction of the CHMP to other services of the CHMP and does either of the following:

• provides services to the operator, or on behalf of the operator, of the CHMP that solely support the functionality or operation of the CHMP; or,
• controls, or is controlled by, or is under common control with the provider of the CHMP when both of the following apply:
  • • • • the entity maintains third party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the CHMP; and,
        • the operator of the CHMP disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.

1. Define third party as an entity that is not a service provider, as specified.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const. art. I, Sec. 1.)
2. Specifies, pursuant to the federal Health Insurance Portability and Accountability Act (HIPAA), privacy protections for patients’ protected health information and generally provides that a covered entity, as defined (health plan, health care provider, and health care clearing house), may not use or disclose protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. Sec. 164.500 et seq.)
3. Prohibits, under the State Confidentiality of Medical Information Act (CMIA), providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code Sec. 56 et seq.)
4. Defines “medical information” to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Further defines “individually identifiable” to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity. (Civ. Code Sec. 56.05(g).)
5. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage his or her information, or for the diagnosis of treatment of the individual, shall be deemed to be a provider of health care subject to the requirements of the CMIA. (Civ. Code Sec. 56.06(a).)
6. Provides that any provider of health care, health care service plan, pharmaceutical company, or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of written or electronic medical records shall be subject to damages in a civil action or an administrative fine, as specified. (Civ. Code Sec. 56.36.)

FISCAL EFFECT: None. This bill has been keyed nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill: This bill seeks to regulate the disclosure and selling of individually identifiable information collected on or by CHMPs, such as the FitBit. This is an author-sponsored bill.
2. Author’s statement: According to the author, “Protection of medical health information is an established right within our country. At the federal level, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) places strict requirements on the sharing of protected health information, and also provides protection to consumers by giving them the right to know who has access to their personal health data.

California has additionally established the Confidentiality of Medical Information Act (CMIA) in order to protect an individual’s medical information from unauthorized disclosure. To some, CMIA is seen as providing stronger protections than HIPAA because it allows an individual to recover damages if his or her medical information was negligently released. CMIA also and expands protections of medical information to businesses that offer software that is designed to maintain medical information.

While HIPAA and CMIA provide strong protections for medical health information, there is not a similarly robust framework of protections for health data. In this void, operators of commercial health monitoring programs are generally able to share and/or sell consumers’ personally identifiable health data to third parties.

Health monitoring programs, typically associated with wearable devices like the FitBit, are rising in popularity. These devices are most commonly worn on a consumer’s wrist, and are capable of performing considerable health monitoring.

According to a USA Today article discussing wearable technologies, ‘Health-monitoring devices are among the hottest new wearables, capable of tracking blood glucose in diabetics, measuring heart rates and mapping sleeping habits. Some invite users to also self-track their moods, their toilet use and their sexual activity.’

While some consumers may be fine with their personal health information being shared to third parties, legislation is needed to ensure that consumers who don’t wish to have their personal health information shared have the opportunity to consent to the sharing of their personal health data.”

1. Mobile health applications have raised privacy concerns: In July 2013, the Privacy Rights Clearinghouse (PRC) released a report entitled “Mobile Health and Fitness Applications and Information Privacy.” The report examined a total of 43 free and paid mobile phone applications on more than 150 separate data points related to privacy and security.

PRC’s report concluded that, “from a privacy perspective, mobile health and fitness applications are not particularly safe when it comes to protecting users’ privacy. Consumers who have no hesitation about sharing personal information will probably find value in sharing the details of their pregnancies by linking their app with Facebook, participating in app-based chat groups and posting photographs of themselves as their pregnancies progress. Others will find that socializing their diet or exercise regimes provides support or competition that helps motivate them.” The PRC report also found that, as of 2013, 39 percent of free apps and 30 percent of paid apps sent data to someone not disclosed by the developer either in the app or any privacy policy. Additionally, only 13 percent of free apps and 10 percent of paid apps used encryption for all data connections and transmissions.

More recently, another study excerpted in the Journal of the American Medical Association (JAMA) (Blenner et al, JAMA, Privacy Policies of Android Diabetes Apps and Sharing of Health Information (Mar. 8, 2016) <https://jamanetwork.com/journals/jama/fullarticle /2499265> [as of April 23, 2018]) analyzed privacy practices of diabetes management applications on Android smartphones and found widespread problems. The study examined 211 separate apps and found that 81 percent lacked privacy policies, and among those that did, 49 percent included permissions to share data with partners and third parties and 39 percent authorized use of data for advertising purposes.

The JAMA report noted, “this study demonstrated that diabetes apps shared information with third parties, posing privacy risks because there are no federal legal protections against the sale or disclosure of data from medical apps to third parties. The sharing of sensitive health information by apps is generally not prohibited by the Health Insurance Portability and Accountability Act. Patients might mistakenly believe that health information entered into an app is private (particularly if the app has a privacy policy), but that generally is not the case. Medical professionals should consider privacy implications prior to encouraging patients to use health apps.”

Partially in response to concern over the privacy of patients’ medical information in a time when consumers increasingly rely on mobile applications, the Legislature passed AB 658 (Calderon, Ch. 296, Stats. 2013), which applied the prohibitions of CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual. Subsequently, the Legislature considered AB 2688 (Gordon, 2016) which sought to regulate the disclosure of information in possession of or derived from a CHMP to a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent. The introduced version of that bill would have expanded CMIA to cover CHMPs, but was amended on March 28, 2016, to separate its provisions from CMIA and shift those requirements to a separate chapter in the Business and Professions Code. When AB 2688 ultimately died on the Senate floor, privacy advocates were in opposition because they alleged the bill did not create strong enough consumer protections, and a coalition of technology companies were also in opposition, alleging that the bill would result in “unintended consequences, logistical difficulties, and consumer harm.” This bill, in large part a reincarnation of AB 2688, would again seek to regulate the disclosure of information in the possession of or derived from a CHMP.

1. Health information collected by mobile applications not expressly protected under existing law: This bill would close a gap in existing law by prohibiting operators from intentionally sharing, selling, or disclosing health monitoring information to a third party without explicit authorization from the consumer. The requirement that operators get the explicit opt-in authorization before sharing or selling information has a number of additional provisions intended to ensure that the consumer is adequately informed about the decision. For example: the request must be clear, conspicuous and separate; the request must specify the name or nature of the third party and the reason for the request; the request must be limited to a single third party; and refusal cannot limit the consumer’s ability to use the program. These protections are not waivable, and a consumer has the right to revoke an authorization without penalty at any time. In support, the California School Employees Association writes that “AB 2935 brings medical privacy to the digital age by prohibiting digital monitoring programs from selling or sharing personal health data, without first obtaining the consent of the user.”
2. Ensuring the consumer receives separate request and is afforded an opportunity for clear and conspicuous consent: This bill would require that request and consent to share individually identifiable health information with third parties be separate from all other agreements. This requirement is designed to ensure that the request to share or sell a consumer’s information to a third party is not included in other, boilerplate language like the terms and conditions, or, in other words, to ensure that the request is clear and conspicuous. Having this request be separate from all other agreements should arguably help ensure that the consumer is aware if what he or she is consenting to.

A coalition of organizations including the California Chamber of Commerce, CompTIA, and TechNet (coalition) opposes this bill unless amended to address a variety of policy and practical concerns. Specifically, the coalition argues that, “[r]equiring separate consent for health monitoring information elevates that broad category of information over other types of important information – going down this path, it is not hard to envision multiple categories of information competing for their own separate consent. This could run counter to the author’s stated intent, because too many separate consent requirements can lead to user fatigue, causing people to just click through various notifications.”

Also opposing this bill unless amended to address a variety of concerns, including incorporating a private right of action as an enforcement mechanism and expressly including mobile applications under the bill, the American Civil Liberties Union of California (ACLU) argues that the definitions in the bill need to be tightened up to eliminate any loopholes which could undermine the author’s intent. The ACLU writes:

The request for consent to authorize sharing of individually identifiable health monitoring information requires that the request be separate from other authorizations and include either the name or the nature of the third party. Instead, the bill should require that the request for consent be clear and conspicuous, in addition to being separate from other authorizations, so that the requests must be written in a way that consumers understand rather than be as incomprehensible to the average consumer as most terms and conditions currently are. […]

[Additionally,] AB 2935 addresses only the sharing or selling of “individually identifiable” health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic because of the role of de-anonymization.

The author responds that “[i]t is not by accident that this bill treats ‘health data’ as different or more important than other data.  Commercial health monitoring apps do not just collect aggregate or otherwise impersonal data, within the collected information are patterns of behavior and intimate details which create a full picture of an individual. These apps track more than steps and heartrate; they can track moods, sexually intimate activity with one’s partner, menstrual and ovulation cycles for women, what and when individuals eat, and combine all of this data with GPS.  This information is incredibly valuable for marketing, research, and insurance purposes, and consumers should know how and when it is used. This bill is a work in progress, and I am appreciative that both industry the ACLU have taken a close look at the bill and are identifying their specific concerns. It is only through carefully balancing the competing interests of all stakeholders that we are going to be able to craft a bill that is truly protective of Californians and workable for industry.”  To the extent that the current draft of the bill would create confusion for operators and/or consumers by requiring that the request to share information with third parties be separate from all other agreements, the author has expressed a willingness amend the bill to make the opt-in provision more workable, but also does not wish to hastily amend the bill in a manner that would diminish the protection that this very personal data should receive.

In addition, the Civil Justice Association of California (CJAC) opposes this bill unless amended to eliminate a provision that provides “[a] waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer in the consent described by this section is unenforceable and void as a matter of law.” CJAC argues:

This section is unnecessary, bad for consumers and potentially costly for small and emerging businesses. As written, it would void any arbitration agreement even when it has been entered into willingly by both parties. Arbitration is good for consumers and businesses, because it reduces the cost of litigation, and promotes fairer and more significant remedies for consumers. In order to be valid, an arbitration agreement must provide the same substantive rights as the Courts, and regularly compensate harmed claimants at much greater levels then comparable class action suits.

Arbitration clauses are helpful to small and emerging business in the health IT [information technology] space because it cuts down on the legal costs associated with traditional civil litigation. Voiding them as a matter of law, without a comparative analysis of consumer benefits versus civil litigation is bad public policy.

Staff notes, as drafted, this provision is connected to the requirement that the request to share a consumer’s health information be separate from all other agreements, and does not appear to serve as a ban on all waivers as suggested by CJAC.

1. Informed consent is a critical consumer protection: This bill would require that consumers be provided with the name or nature of a third party, and the purpose for the sharing of individually identifiable health information. This provision was designed to ensure that consumers are informed about how their information may be used. Many consumers may be fine with their information being shared for one purpose, but not for another. For example, a consumer may be willing to share her information to aid in cancer research, but not wish to have her information sold to an organization that supports the National Rifle Association (NRA). Conversely, a different consumer could be entirely fine with her information being shared with the NRA, but opposed to sharing any information that would aid in research supporting prenatal genetic testing.

The author’s stated intent behind this bill is to ensure that consumers have meaningful control over how and when their personally identifiable health information is being used. This intent is particularly salient as the world continues to grapple with the news surrounding Cambridge Analytica in which the personal information of at least 87 million Facebook users was harvested and used in an effort to influence the 2016 U.S. presidential election. (Langone, Time Facebook’s Cambridge Analytica Controversy Could Be Big Trouble for the Social Network. Here’s What to Know (Apr. 4, 2018) <http://time.com/ 5205314/facebook-cambridge-analytica-breach/> [as of Apr. 20, 2018].)

With regard to the requirement that consumers need to be informed as to the third parties with whom their information is shared, the coalition argues in opposition that if a CHMP “shares data with numerous third parties in order to function properly, this could result in a lengthy and ever-changing list of entities that would not be meaningful to a consumer. As written, this bill appears to require consent from a consumer for any future sharing of third party data, regardless of purpose. This presents practical challenges for certain types of technology – it could also result in user fatigue.”

Staff notes that this bill does not, in any way, limit the sharing of non-individually identifiable data. Meaning, commercial health monitoring applications can share and sell de-identified information and data in the aggregate without restriction. To this point, the ACLU argues that the bill does not go far enough in protecting anonymized data. ACLU writes, “AB 2935 addresses only the sharing or selling of ‘individually identifiable’ health information from these devices. The selling or sharing of anonymized health information from these devices is common and problematic because of the role of de-anonymization. In March 2016, a legal scholar testified to Congress that ‘wearable device data is prone to re-identification.’ The disclosure of individualized records should require consent whether or not the individual is identified because of the risk that an interested party could re-identify the records using other, non-public data.” Staff notes that the sharing of personally identifiable information under California’s medical privacy laws is expressly prohibited, but the law is silent as to the sharing of de-identified or aggregate data. The author’s intent with this bill was to model the treatment of health information according to some of the same parameters that govern medical information. To the extent that this bill would allow for individual’s health information to be re-identified, the author is willing to work with stakeholders to ensure that the definitions under this bill are tightened to ensure consumers’ privacy.

In addition, to address the logistical concerns noted by the coalition, the author is considering amendments to the bill that would require CMHPs to publicly and conspicuously post the third parties with whom they share or sell individually identifiable information, and for what purpose, and allow consumers to opt-in to sharing information with those parties on a case-by-case basis. This arguably will strike an appropriate balance between ensuring that consumers have access to adequate information to make informed choices, while also ensuring that CMHPs are not overly burdened with the requirement to communicate specified information and update consumers when those business arrangements change.

1. Requirement that failure to provide consent to share information cannot limit functionality of a commercial health monitoring program: This bill would provide that a consumer’s refusal to consent to third-party sharing, sale, or disclosure of individually identifiable health monitoring information shall not limit the consumer’s ability to use the commercial health monitoring program even if features and services provided by the specific third party are inoperable. The coalition, in opposition, argues that this provision is problematic because “[a]lthough data sharing may not be the ‘primary function’ of a program, data sharing is frequently integral to the functioning of a program. Technology dependent upon the sharing of information should not be required to continue to function after a consumer refuses consent. Additionally, there are practical concerns with ensuring that a consumer understands in advance that their decision not to share may result in the technology not working properly or at all.”

Staff notes that the concerns raised by the coalition are largely already addressed by the bill in print which, as indicated above, allows for a CHMP to be somewhat limited in its functionality, if a third party requires shared information in order to make certain functions operable. For example, if one of the functions of an application is to compare a user’s caloric intake against the caloric intake of a group, the sharing of the information is required in order to compare results. Accordingly, if a user did not consent to that type of information sharing, that particular function would clearly not work. However, if the entire functionality of an application is based on information sharing, the bill in print also provides that the provision above “does not apply if the primary function of the commercial health monitoring program is the sharing, sale, or disclosure of individually identifiable health monitoring information to third parties and the consumer is notified of this function at the time of the request for consent.”

1. Prohibition of affiliate sharing of consumers’ health information: This bill would prohibit third parties that receive individually identifiable health monitoring information from further disclosing that information. This provision is intended to ensure that a consumer’s data cannot be shared and sold time and time again without the consumer’s knowledge or consent. As with the other provisions discussed in Comment 6 above, this bill would only limit the disclosure of a consumer’s individually identifiable health information. Accordingly, third parties would be able to sell and share de-identified information and information in the aggregate without violating the provisions of this bill. In opposition, the coalition argues that “the practical challenge with this requirement is ensuring that a recipient of such broadly defined ‘health monitoring information’ will know that the information they have received is regulated by this law. […] Finally, the definition of ‘service provider’ appears to exclude many types of affiliate sharing. Affiliate sharing is a common practice that does not present the kinds of privacy concerns the bill intends to address.”

Countering this argument, the ACLU, argues that the definitions are under the bill are actually too broad. The ACLU writes, “the definition of service provider permits a CHMP to share health information with other entities under common control if they have the same level of privacy protections as the CHMP and are principally engaged in the same line of business. Thus, for example, the bill would permit the health monitoring information of a consumer using one Google commercial health monitoring program to be shared with all other Google commercial health monitoring programs even if the consumer refused to consent to the sharing of their health monitoring information.”

Staff notes that while there appear to be guidelines for affiliate sharing of financial information, and also rules governing the sharing of medical information among health care providers and other covered entities, there are arguably no such statutory rules for the sharing of health data among third parties. Accordingly, this bill would require a consumer’s consent before a CHMP could share health data with a third party, and would prohibit that third party from selling or sharing a consumer’s identified data any further. The bill additionally places responsibility for impermissible sharing on the third party, and not on the CHMP, thereby appropriately ensuring that the sharing party is liable in the event of a violation. To the extent that the definition of service provider under the bill would facilitate wide sharing of information without a consumer’s consent, as noted by the ACLU, the author is interested in engaging with stakeholders on a workable solution that would ensure that consumers have a clear understanding and actual control over how their sensitive health data is being used.

1. Prior legislation: AB 2688 (Gordon, 2016) see Comment 3.

AB 2747 (Assembly Committee on Judiciary, Ch. 913, Stats. 2014) extends CMIA provisions to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care.

AB 658 (Calderon, Ch. 296, Stats. 2013) see Comment 3.

AB 1298 (Snyder, Ch. 699, Stats. 2007) subjected any business organized to maintain medical information for purposes of making that information available to an individual or to a health care provider, as specified, to the provisions of the Confidentiality of Medical Information Act (CMIA).

AB 336 (Snyder, Ch. 1004, Stats. 1993) deemed certain corporations to be providers of health care under the CMIA.

1. Double-referral: This bill was double-referred to the Assembly Health Committee where it was heard on April 10, 2018, and passed out on a 12-0 vote.

REGISTERED SUPPORT / OPPOSITION:

Support

California School Employees Association, AFL-CIO

Opposition

American Civil Liberties Union of California (unless amended)

California Chamber of Commerce (unless amended)

Civil Justice Association of California (unless amended)

CompTIA (unless amended)

TechNet (unless amended)

Analysis Prepared by: Nichole Rapier / P. & C.P. / (916) 319-2200

Date of Hearing: April 10, 2018

ASSEMBLY COMMITTEE ON HEALTH

Jim Wood, Chair

ABPCA Bill Id:AB 2935

Author:(Chau) – As Introduced Ver:February 16, 2018

SUBJECT: Health information privacy: digital commercial health monitoring.

SUMMARY: Establishes the Digital Commercial Health Monitoring and prohibits an operator of a commercial health monitoring program (CHMP) from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in its possession or derived from a CHMP. Specifically, this bill:

1. Prohibits a CHMP operator from intentionally sharing, selling, or disclosing individually identifiable health monitoring information to or with a third party without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent that fulfills all of the following requirements:
   1. The request for consent to be separate from all other authorizations or agreements;
   2. The request for consent to include the name or nature of the third party and the purpose of the request;
   3. A consumer’s refusal to consent, as specified, does not limit the consumer’s ability to use the CHMP even if features and services provided by the specific third party are inoperable. Excludes from this bill a CHMP whose primary function is the sharing, sale, or disclosure of specified information and the consumer is notified at the time of the consent request; and,
   4. A waiver of any legal right, penalty, remedy, forum, or enforcement procedure presented to the consumer, as specified, is unenforceable and void as a matter of law.
2. Requires a CHMP operator to make available and provide notice of a process whereby a consumer may withdraw consent pursuant to 1) above, as specified. Requires the consent withdrawal to be prospective and not impact valid disclosures and consent prior to the operative withdrawal date.
3. Requires the CHMP operator, upon request by the consumer, to delete or provide the consumer his or her individually identifiable health monitoring information, as specified. Allows the CHMP to assess a reasonable administrative charge for the cost of accessing, copying, or deleting individually identifiable health monitoring information.
4. Requires a CHMP operator that creates, maintains, preserves, stores, abandons, deletes, destroys, or disposes of health monitoring information to do so in a manner that preserves the security and confidentiality of the individually identifiable health monitoring information.
5. States that this bill is not intended to limit the required disclosure of individually identifiable health monitoring information, as specified.
6. Provides that this bill is not to be construed to limit or otherwise reduce existing privacy protections in state or federal law.
7. Allows individually identifiable health monitoring information to be disclosed to the following persons without satisfying the consent requirements, as specified, if the disclosing entity provides notice of the disclosure to the consumer whose individually identifiable health monitoring information was disclosed as soon as practicable:
   1. To a health care provider to aid in the diagnosis or treatment of the consumer, as specified; or,
   2. To a government official if necessary, as specified;
8. Prohibits a recipient of individually identifiable health monitoring information that is not a CHMP from disclosing that health information. Provides that responsibility for a violation is not with the commercial health monitoring agency but with the disclosing entity.
9. Provides that a defined entity subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the Confidentiality of Medical Information Act (CMIA) is not subject to this bill with respect to any activity or exemption regulated, as specified. Provides that the definitions described in HIPAA and CMIA as of January 1, 2018 apply to this bill.
10. Defines the following terms:
    1. CHMP as a commercial Internet Website, online service, or product used by consumers whose primary purpose is to collect the consumer’s individually identifiable health monitoring information.
    2. A health care provider consistent with definition in HIPAA.
    3. Health monitoring information as information, in electronic or physical form, about a consumer’s mental or physical condition that is collected by a CHMP, as specified.
    4. Individually identifiable as information that includes or contains an element of personal identifying information to allow identification of the consumer, as specified.
    5. Service provider as an entity that does not further use or disclose individually identifiable health information except at the direction of the CHMP to other services of the CHMP and does either of the following:
       1. Provides services to the operator, or on behalf of the operator, of the CHMP that solely support the functionality or operation of the CHMP; or,
       2. Controls, or is controlled by, or is under common control with the provider of the CHMP when both of the following apply:
          1. The entity maintains third party data sharing practices, with respect to individually identifiable health monitoring information, that are at least as protective of privacy as those of the CHMP; and,
          2. The operator of the CHMP disclosing the individually identifiable health monitoring information and the entity receiving the individually identifiable health monitoring information are both principally engaged in the same line of business.
    6. Third party as an entity that is not a service provider, as specified.

EXISTING LAW:

1. Establishes under HIPAA standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if its provisions conflict with a provision of state law, the provision that is most protective of patient privacy prevails.
2. Prohibits, pursuant to the state CMIA, a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States a violation of the provisions of CMIA that results in economic loss or personal injury to a patient is a crime.
3. Defines medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. Defines individually identifiable to mean that the medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.

FISCAL EFFECT: None

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, modern technology has empowered consumers to take control of their health outside of the medical setting through the use of health monitoring programs. These programs are capable of tracking substantial private health information including, but not limited to, a consumers heart rate, blood glucose, sleeping habits, and sexual activity. While some consumers may be fine with their personal health information being shared to third parties, legislation is needed to ensure that consumers who do not wish to have their personal health information shared have the opportunity to opt out or consent to the sharing of their personal health data.
2. BACKGROUND. An article titled, “The Emerging Field of Mobile Health,” describes how engineers have designed and developed a wide variety of wearable biometric sensors, such as bracelets, watches, skin patches, headbands, earphones, and clothing. Although these sensors have many forms and functions, their unifying design focus is to allow for unobtrusive, passive, and, when appropriate, continuous monitoring. Another key characteristic is their ability to seamlessly track and transfer all biometric data into an actionable and informative user interface that can be shared with health care providers, researchers, family members, or one’s social network. The article goes on to note that consumers, providers, and health care systems must be able to trust the reliability, privacy, and security of their data as well as the devices that collect and share it. Although regulatory oversight is often considered to be an impediment to the rapid dissemination of innovative technologies, the existence of modern-day potential scams mandates some level of oversight. The article cited to a recent investigative report found that out of 1500 health apps studied, one of five claimed either to treat or to cure a wide range of medical problems by just using the light, sound, or vibrations of the phone.

Another recent article contending that “HIPAA guidelines should evolve with wearable technology” states that wearable devices on the market offer an excess of tracking capabilities, that include measuring the heart rate, number of steps taken, and glucose and activity levels. However, due to health data security concerns, patient data that is collected by wearables and shared with physicians will create an additional burden on health-care organizations. According to the article, any third party that conducts business with a HIPAA-covered entity must have a contract in place that details their responsibilities and requires HIPAA compliance. Regarding wearables, HIPAA does not apply if the tech company does not share the health data with health-care providers. But the patient data collected by a doctor-provided wearable device will be covered under HIPAA.

A 2015 article published by the American Bar Association, titled “Privacy, Security, and Wearable Technology” states that HIPAA generally sets national standards for the protection of health information, which includes elec­tronic and other forms of mediums containing identifiable demographic and other information relating to an individual’s past, present, or future physical or mental health or condition, or information con­cerning the provision of health care to an individual that is created or received by a healthcare provider, health plans, employer, or healthcare clearinghouse. Under HIPAA, covered entities are required to implement standards to protect individually identifiable health information. The HIPAA privacy rule defines and limits the circumstances under which an individual’s protected health information may be used or disclosed by covered entities. While HIPAA standards provide some safeguards for healthcare information, HIPAA applies only to covered entities, as defined, which are essentially medical providers and their related business associates. Thus, with a lot of wearables where information is collected, used, or processed by individuals and entities outside the definition of a covered entity, HIPAA obligations and regulations do not apply. The article cites to a study that found that most data flows from mobile health apps are not covered by HIPAA. According to the article, in the absence of appropriate controls over user-generated health information, companies have greater leeway to collect and use this sensitive data from consumers outside the context in which consumers provide such information.

1. SUPPORT. The California School Employees Association, AFL-CIO, states that this bill brings medical privacy to the digital age by prohibiting digital monitoring programs from selling or sharing personal health data, without first obtaining consent from the user. The California Association for Health Services at Home state that with the advances in cyber technology and perpetrators finding more ways to capture an individual’s important personal data, it is important that we work together to pass legislation that will ensure the protection of an individual’s personal health information.
2. OPPOSE UNLESS AMENDED. The Civil Justice Association of California is oppose unless amended, and is concerned with the language related to “a waiver of any legal right…” as it would void any arbitration agreement entered willingly by both parties and may also be preempted by the Federal Arbitration Act.
3. RELATED LEGISLATION. AB 2167 (Chau) defines medical information to include any information, regardless of whether individually identifiable, in possession or derived from a digital health feedback system, as defined. AB 2167 is pending in Assembly Health Committee.
4. PREVIOUS LEGISLATION.
   1. AB 2688 (Gordon) of 2016 would have prohibited an operator of a CHMP from intentionally sharing, selling, or disclosing individually identifiable health monitoring information in possession of or derived from a commercial health monitoring program to a third party, as defined, without first providing clear and conspicuous notice and obtaining the consumer’s affirmative consent, as provided, and would have provided that individually identifiable information may be disclosed to specified entities without consent under specified circumstances. AB 2688 would have also required an employer that receives health monitoring information in possession of or derived from a commercial health monitoring program to establish procedures to preserve the confidentiality and security of that information, as provided. AB 2688 died on the Senate third reading file.
   2. SB 138 (Ed Hernandez), Chapter 444, Statutes of 2014, specifies the manner in which a health care service plan or health insurer is required to maintain confidentiality of medical information regarding the treatment of an insured, subscriber, or enrollee.
   3. AB 658 (Calderon), Chapter 296, Statutes of 2013, applies the prohibitions of the CMIA to any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information to allow an individual to manage his or her information, or for the diagnosis, treatment, or management of a medical condition of the individual.
   4. AB 1298 (Jones), Chapter 699, Statutes of 2007, applies the prohibitions of the CMIA to any business organized for the purpose of maintaining medical information to allow an individual to manage his or her information, or for the treatment or diagnosis of the individual.
5. DOUBLE REFERRAL. This bill has been double-referred; upon passage of this Committee, it will be referred to the Assembly Privacy and Consumer Protection Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

California Association for Health Services at Home

California School Employees Association, AFL-CIO

Opposition

None on file.

Analysis Prepared by: Kristene Mapile / HEALTH / (916) 319-2097