(Without Reference to File)

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 713

Author:(Mullin)

As Amended Ver:August 28, 2020

2/3 vote. Urgency

SUMMARY:

This urgency measure would establish new exemptions from the California Consumer Privacy Act (CCPA) with regard to certain types of medical information, including medical information collected as part of regulated research activities, and for business associates of covered entities subject to the Health Insurance Portability and Accountability Act (HIPAA).

The Senate Amendments:

Removed the prior contents of the bill related to the Early Psychosis and Mood Disorder Detection and Intervention Fund, and inserted the provisions amending the CCPA described above.

COMMENTS:

1. New exemptions to the CCPA: Despite existing exemptions that apply specifically to their industries, the health care and medical research industries have expressed concern that the exemptions contained in the CCPA do not adequately permit their respective activities or would otherwise subject their industries to duplicative or unduly burdensome regulation. In support of AB 713, a coalition of health care, research, and commercial organizations write that this bill is necessary to "protect vital medical research and streamline health care operations, reducing waste in our health care system[.]"

Business Associates: The CCPA currently exempts both medical information/PHI and health care providers from its provisions. This bill would additionally exempt business associates of health care providers, so long as they treat any PI in question in the same manner as medical information or PHI under CMIA and HIPAA, respectively.

Staff notes that any medical information or PHI handled by business associates is already exempt from the CCPA. (See Civ. Code Sec. 1798.145(c)(1)(A).) Nonetheless, proponents of this bill seek a broader exemption for business associates more generally, arguing that "HIPAA-regulated Business Associates provide services to Covered Entities (doctors, nurses and other providers) and are extensively regulated under HIPAA and under Business Associate Agreement contracts. Subjecting Business Associates to CCPA regulation is another recipe for waste in our health care system and millions lost to compliance and litigation costs that will be passed on to taxpayers. Business Associates are heavily regulated today and do not require additional privacy obligations, especially during the ongoing crisis."

From a public policy perspective, the business associates exemption in the bill is narrow and ensures that consumers' PI is treated in a privacy protective manner, either under medical privacy laws (HIPAA and CMIA) or under the CCPA. Both the medical privacy schemes and the CCPA offer consumers remedies in the event of data breach and require strict data security. While a business associate might not be subject to medical privacy laws in every situation, the bill in print ensures that a consumer's PI must be handled as though it was governed by those laws in order for the exemption from the CCPA to apply. As a practical matter, this ensures that in the event the PI is mishandled or a data breach occurs, a robust privacy scheme with remedies should always apply, be it HIPAA, CMIA, or the CCPA.

Medical Research subject to the Common Rule: As noted above, the CCPA already exempts information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule. This bill would include a similar exemption in a new code section, and expand it to exclude any information collected, used, or disclosed in research, including but not limited to a clinical trial, conducted in accordance with applicable ethics, confidentiality, privacy, and security rules of the Common Rule. (Emphasis added.)

While a clear expansion of the original research exemption, this provision recognizes that research is not confined to clinical trials and that there are multiple ways that researchers can obtain, use, and disclose the information that is the subject of their studies without compromising patient or individual privacy.

Patient information deidentified pursuant to HIPAA: The CCPA already excludes from the definition of PI "deidentified" information, defined as "information that cannot reasonably identify, relate to, describe, or be linked, directly or indirectly, to a particular consumer," and requires a business that uses deidentified information to implement technical safeguards that prohibit reidentification, implement business processes that specifically prohibit reidentification, and implement business processes to prevent inadvertent release of deidentified information. (Civ. Code Sec. 1798.140 (h).

Similarly, under HIPAA, health information that "does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual" is not individually identifiable health information. HIPAA permits a covered entity to determine that health information is not individually identifiable only if one of the following two deidentification methods are used: the expert determination method, or the safe harbor method.

The expert determination method requires a person with appropriate knowledge of and experience with generally accepted statistical principles and methods for rendering information not individually identifiable to determine that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify the individual. The expert is required to document the methods and results of the analysis that justify such a determination. Under the safe harbor method, a long list of identifiers of the individual, relatives, employers, and household members of the individual are removed, including all geographic subdivisions smaller than a state except for the initial three digits of a zip code, all elements of dates directly related to an individual, device identifiers and serial numbers, and health plan beneficiary numbers, among others.

HIPAA and the CCPA thus have arguably compatible standards for deidentification, but because the specific language in the CCPA is different than the deidentification language in HIPAA, proponents of this bill are concerned that PI deidentified under HIPAA might not meet the standard under the CCPA. Such a discrepancy could subject deidentified patient information to various obligations and liabilities under the CCPA. Accordingly, this bill would expressly exempt patient information that has been deidentified under HIPAA. However, as an additional safeguard, discussed more in Comment 5 below, the bill would also require any business that discloses or sells deidentified patient information to disclose on its online privacy policy its practice of disclosing deidentified patient information and which of the two relevant HIPAA deidentification methods it used.

1. Prohibition on reidentification of deindentified patient information: This bill would prohibit a person from reidentifying, or attempting to reidentify, deidentified patient information, subject to limited exceptions. Notably, the bill would provide that any patient information that is reidentified, including for the purposes above, be subject to applicable federal and state data privacy and security laws including, but not limited to, the HIPAA, CMIA, and the CCPA. Proponents of this bill argue that this provision is "a first-in-the-nation prohibition on reidentifying patient records outside of a medical context, significantly advancing privacy."

Staff notes, however, that the CCPA already exempts deidentified information from its provisions, and subjects any business that attempts to reidentify information once again to the CCPA. (See Civ. Code Sec. 1798.140(h).) The CCPA also limits remedies for violations of its provisions. With the exception of data breaches of consumers' nonencypted and nonredacted PI resulting from failure to follow specified provisions of the Act, the CCPA is exclusively enforced by the Attorney General, who is required to give businesses 30 days to cure any violations prior to bringing a law suit. (See Civ. Code Secs. 1798.150 and 1798.155.) In other words, while this bill's prohibition on the reidentification of patient information is, on its face, an arguably more robust protection of privacy than what is included in the CCPA, violations of this prohibition would be subject to the limited enforcement.

1. Interaction with Proposition 24 on this November's ballot: The proponents of this measure have posited in conversations with staff that its urgency is largely based on the prospect of Proposition 24, a ballot initiative amending the CCPA, being approved by the voters this November. Of relevance to this bill, that initiative would amend various provisions of the CCPA, including the provisions containing the existing exemptions, discussed in the comments above. If passed, Proposition 24 would completely replace the language of those various code sections, nullifying any bills amending language in those sections that may be signed into law this year. Notably, the Proposition would also provide that the California Privacy Rights and Enforcement Act (CPRA) (which would replace the CCPA, should the ballot initiative pass) may only be amended by the Legislature "to enhance privacy and [that] are consistent with and further the purposes and intent of this Act." This particular provision has generated concern amongst various industries that any expansion of exemptions within the CPRA would generally be impermissible. Seeking to ensure that various research permitted by federal law continues to be legal in California regardless of the outcome of Proposition 24 in November, the author of AB 713 elected to create a new section in the CCPA that would include nearly duplicative exemptions as those found in the CCPA along with the new exemptions discussed above.

While this approach may help assure that the new exemptions provided by this bill are not eliminated should Proposition 24 pass, it creates a statutory scheme that is at best confusing and likely unworkable for the courts. Specifically, this bill would create two exemptions in the CCPA for providers of healthcare that are nearly identical, save several words. It would also create two identical exemptions, in different code sections, for medical information or PHI, and an additional duplicative exemption for research. It would be difficult, to say the least, to determine which of these exemptions to apply and if they should be interpreted differently. Accordingly, the Author and Committee should take note that cleanup legislation will be necessary in 2021. Any such legislation could harmonize these provisions and eliminate duplicity where necessary, ensuring that the protections of the CCPA are applied without confusion.

According to the Author:

This bill is an important measure to protect patient care in the health care system and limit unintended consequences for health care research and operations related to implementation of the CCPA. California is currently home to the largest, most innovative and productive life sciences ecosystem in the world. California's life sciences now include over 3,000 companies that directly and indirectly employ almost 900,000 people and generate $147.7 billion in revenue. The innovations produced in California are saving lives and transforming health care through earlier disease detection, less invasive procedures and more effective treatments. This bill would provide an important clarification to the law by harmonizing the law with certain areas of health care information already covered under existing medical privacy and confidentiality regulations. Additional clarification is needed for the de-identification standards under HIPAA for the purpose of biomedical research, business associates that handle protected health information, human subject research that falls outside of the area clinical trials, and FDA product and patient safety standards. This bill will provide the necessary clarification in these areas to ensure that California's life science industry and biomedical research are not adversely affected by the rollout of new privacy standards established by the CCPA.

Arguments in Support:

In support of AB 713, a coalition of health care, research, and commercial organizations write that they have "identified important areas for cleanup in the CCPA that will protect vital medical research and streamline health care operations, reducing waste in our health care system during this critical moment as we respond to the COVID-19 epidemic. The amendments below clarify existing provisions in the CCPA and will save our health care system and the State of California millions in avoided, duplicative compliance costs while protecting critical medical research from legal uncertainty during this important stage of our response. […] The amendments in AB 713 are ultimately about avoiding waste and promoting efficiency in our health care system and in medical research. We have rules that have worked for over a decade and it is unreasonable to subject these hard-working professionals to an additional layer of duplicative regulation."

Arguments in Opposition:

None on file.

FISCAL COMMENTS:

The Senate Appropriations Committee found, pursuant to Senate Rule 28.8, that any additional state costs are not significant, and do not and will not require the appropriation of additional state funds, and that the bill will cause no significant reduction in revenues.

VOTES:

ASM HEALTH: 15-0-0

YES: Wood, Mayes, Aguiar-Curry, Bigelow, Bonta, Burke, Carrillo, Flora, Limón, McCarty, Nazarian, Ramos, Rodriguez, Santiago, Waldron

ASM APPROPRIATIONS: 18-0-0

YES: Gonzalez, Bigelow, Bloom, Bonta, Brough, Calderon, Carrillo, Chau, Diep, Eggman, Fong, Gabriel, Eduardo Garcia, Maienschein, Obernolte, Petrie-Norris, Quirk, Robert Rivas

ASSEMBLY FLOOR: 74-0-6

YES: Aguiar-Curry, Arambula, Bauer-Kahan, Berman, Bigelow, Bloom, Boerner Horvath, Bonta, Brough, Burke, Calderon, Carrillo, Cervantes, Chau, Chen, Chiu, Choi, Chu, Cooper, Cunningham, Dahle, Daly, Diep, Flora, Fong, Frazier, Friedman, Gabriel, Gallagher, Cristina Garcia, Gipson, Gloria, Gonzalez, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, O'Donnell, Obernolte, Patterson, Petrie-Norris, Quirk, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Salas, Santiago, Smith, Mark Stone, Voepel, Waldron, Weber, Wicks, Wood, Rendon

ABS, ABST OR NV: Cooley, Eggman, Eduardo Garcia, Gray, Blanca Rubio, Ting

UPDATED:

VERSION: August 28, 2020

CONSULTANT: Nichole Rocha / P. & C.P. / (916) 319-2200 FN: 0003690

 THIRD READING  

Bill No: AB 713

Author: Mullin (D)

Amended: 8/28/20 in Senate

Vote: 27 - Urgency

SENATE HEALTH COMMITTEE: 8-0, 1/8/20

AYES: Pan, Lena Gonzalez, Grove, Hurtado, Leyva, Mitchell, Monning, Rubio

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/20/20

AYES: Portantino, Bates, Bradford, Hill, Jones, Leyva, Wieckowski

ASSEMBLY FLOOR: 74-0, 5/28/19 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018

SOURCE: Author

DIGEST:

This bill establishes new exemptions from the California Consumer Privacy Act regarding certain types of medical information, including exemptions for information that has been deidentified under specified federal requirements, and medical information collected as part of regulated research activities.

Senate Floor Amendments of 8/28/20 clarify that the requirement in this bill for a business to disclose whether it sells or discloses deidentified information is in regards to all types of protected information; clarify that if information is reidentified pursuant to an exemption in this bill permitting reidentification, that this information is subject to applicable federal and state data privacy and security laws; and make other technical and clarifying changes.

ANALYSIS:

Existing law:

1. Establishes the Confidentiality of Medical Information Act (CMIA), which among other things, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining an authorization.
2. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights regarding the collection of personal information by businesses, including the right to request that a business disclose the categories and specific pieces of personal information it has collected, the right to request a business delete any personal information, and the right to direct a business not to sell their information. [CIV §1798.100, et seq.]
3. Defines “personal information,” for purposes of the CCPA, to include a long list of information that identifies, relates to, describes, or could reasonably be linked with a particular consumer or household. [CIV §1798.140 (o)(1)]
4. Excludes “deidentified” information from the definition of “personal information,” and defines “deidentified” as information that cannot reasonably identify, relate to, describe, or be linked, directly or indirectly, to a particular consumer, and requires a business that uses deidentified information to implement technical safeguards that prohibit reidentification, implement business processes that specifically prohibit reidentification, and implement business processes to prevent inadvertent release of deidentified information. [CIV §1798.140 (h)]
5. Provides other specific exemptions from the provisions of the CCPA, including the following as it relates to health care:
   1. Medical information governed by the CMIA or protected health information (PHI) that is collected by a “covered entity” or “business associate,” as defined and governed by the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) [CIV §1798.145(c)(1)(A)];
   2. A provider of health governed by the CMIA or a covered entity governed by HIPAA [CIV §1798.145(c)(1)(B)]; and,
   3. Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects (Common Rule), good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the United States Food and Drug Administration (FDA). [CIV §1798.145 (c)(1)(C)]

This bill:

1. Exempts from the CCPA information that is deidentified in accordance with the requirements for deidentification set forth under specified provisions of HIPAA, and that is derived from patient information that was originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the CMIA, or the Common Rule, as specified.
2. Requires a business that sells or discloses information that is exempted from the CCPA pursuant to 1) above to disclose on its online privacy policy whether the business sells or discloses deidentified patient information derived from patient information, and if so, whether that patient information was deidentified pursuant to one or more of the following: the deidentification methodology commonly known as the “HIPAA expert determination method,” as specified; or the deidentification methodology commonly known as the “HIPAA safe harbor method,” as specified.
3. Exempts from the CCPA a business associate of a covered entity governed by HIPAA, to the extent the business associate maintains, uses, and discloses patient information only in accordance with the legal requirements of the privacy, security, and breach notification rules applicable to PHI under HIPAA.
4. Exempts from the CCPA information that is collected, used, or disclosed in research, as defined, including, but not limited to, a clinical trial, and that is conducted in accordance with applicable ethics, confidentiality, privacy, and security rules of HIPAA, the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the FDA.
5. Defines “patient information” as meaning identifiable private information, protected health information, individually identifiable health information, or medical information, as each of those terms are defined.
6. Prohibits a business or other person from reidentifying information that has met the requirements of 1) above, except for one or more of the following purposes:
   1. Treatment, payment, or health care operations conducted by a covered entity or business associate acting on behalf of the covered entity;
   2. Public health activities or purposes, as specified in federal law;
   3. Research, as defined;
   4. Pursuant to a contract that expressly engages a person or entity to attempt to reidentify the information in order to conduct testing, analysis, or validation of deidentification, or related statistical techniques, if the contract bans any other use of the reidentified information and requires the destruction of the information upon completion of the contract; and,
   5. If otherwise required by law.
7. Requires information that has been reidentified pursuant to 6) above to be subject to applicable federal and state data privacy and security laws, including, but not limited to, HIPAA, the CMIA, and the CCPA.
8. Requires any contract for the sale or license of deidentified information, where one of the parties is a person residing or doing business in the state, to include the following, or substantially similar, provisions:
   1. A statement that the deidentified information being sold or licensed includes deidentified patient information;
   2. A statement that reidentification of the deidentified information by the purchaser or licensee of that information is prohibited; and,
   3. A requirement that, unless otherwise required by law, the purchaser or licensee of the deidentified information may not further disclose the deidentified information to any third party unless the third party is contractually bound by the same or stricter restrictions and conditions.
9. Contains an urgency clause that will make this bill effective upon enactment.

Comments

1. Author’s statement. According to the author, this bill is an important measure to protect patient care in the health care system and limit unintended consequences for health care research and operations related to implementation of the CCPA. California is currently home to the largest, most innovative and productive life sciences ecosystem in the world. The innovations produced in California are saving lives and transforming health care through earlier disease detection, less invasive procedures and more effective treatments. This bill would provide an important clarification by harmonizing the law with certain areas of health care information already covered under existing medical privacy regulations. Additional clarification is needed for the de-identification standards under HIPAA for the purpose of medical research, business associates that handle PHI, human subject research that falls outside of the area clinical trials, and FDA product and patient safety standards. This bill will provide the necessary clarification in these areas to ensure that California’s life science industry is not adversely affected by the rollout of new privacy standards of the CCPA.
2. Creation of the CCPA. Californians for Consumer Privacy is an organization that was founded and chaired by Alastair Mactaggart to protect and expand privacy rights for Californians. Californians for Consumer Privacy sponsored a ballot referendum that qualified for the November 2018 ballot to enact the CCPA. After the initiative qualified, the Legislature passed AB 375 (Chau, Chapter 55, Statutes of 2018), which enacted a version of the CCPA into law, and Californians for Consumer Privacy withdrew the ballot initiative. The CCPA grants a set of rights to consumers with regard to their personal information, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to delete certain information, the right to restrict the sale of information, and protection from discrimination for exercising these rights.
3. CCPA deidentification vs. HIPAA deidentification. Under the existing CCPA, personal information that is deidentified is exempt from the definition of personal information, and therefore exempt from the CCPA. Similarly, under HIPAA, information can be deidentified, and would therefore remove it from the privacy requirements applicable to PHI. However, the two laws define deidentification differently. Under CCPA, “deidentified” means “information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.” Additionally, CCPA goes on to require that a business that uses deidentified information comply with the following: a) implement technical safeguards that prohibit reidentification of the consumer to whom the information may pertain; b) implement business processes that specifically prohibit reidentification of the information; c) implement business processes to prevent the inadvertent release of deidentified information; and, d) make no attempt to reidentify the information. Under HIPAA, on the other hand, health information that “does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual” is not individually identifiable health information. HIPAA permits a covered entity to determine that health information is not individually identifiable only if one of the following two deidentification methods are used:
   1. Expert determination. Under this method, a person with appropriate knowledge of generally accepted statistical principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The expert is required to document the methods and results of the analysis that justify such a determination; or,
   2. Safe harbor. Under this method, a long list of identifiers of the individual or of relatives, employers, or household members of the individual, are removed, including: all geographic subdivisions smaller than a State except for the initial three digits of a zip code; all elements of dates directly related to an individual, including admission or discharge date or dates of birth; device identifiers and serial numbers; health plan numbers; and so on.

HIPAA also provides for a mechanism for reidentification by permitting a covered entity to assign a code or other means of record identification to allow information deidentified to be reidentified by the covered entity, provided that the code or other means of record identification is not derived from or related to information about the individual, and the covered entity does not use or disclose the code or other means of record identification for any other purpose and does not disclose the mechanism for reidentification.

1. HIPAA and CMIA definitions. This bill, as well as parts of the existing CCPA, cross-reference a number of terms defined elsewhere in federal or state law, including the following:
   1. Individually identifiable health information is defined under HIPAA as information that is a subset of health information, including demographic information collected from an individual, and that meets all of the following conditions: (1) it is created or received by a health care provider, health plan, employer, or health care clearinghouse; (2) it relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (3) there is a reasonable basis to believe the information can be used to identify the individual.
   2. PHI is defined under HIPAA as individually identifiable health information that is transmitted by electronic media; maintained in electronic media; or is transmitted or maintained in any other form or medium. The definition of PHI excludes individually identifiable health information that is (1) in records covered by the Family Educational Rights and Privacy Act; (2) is in employment records held by a covered entity in its role as employer; or (3) is in regards to a person who has been deceased for more than 50 years.
   3. Medical information is defined under the CMIA as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” is defined as medical information that includes or contains any element of personal identifying information to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, in combination with other publicly available information, reveals the individual’s identity.
   4. Identifiable private information is defined under the Common Rule as private information, which is information provided for specific purposes by an individual that the individual can reasonably expect will not be made public, such as a medical record, for which the identity of the subject may readily be ascertained by the investigator or associated with the information.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Department of Justice (DOJ). Staff estimates $317,000 General Fund (GF) in FY 2020-21, $360,000 GF in FY 2021-22 and FY 2022-23, and ongoing, for 2.0 positions (1.0 Deputy Attorney General and a the legal component of 1.0 Legal Secretary) for workload due to an anticipated increase in litigation in potential legal challenges. The positions would be authorized beginning September 1, 2020, and through June 30, 2023.
• Courts. Unknown, potentially-significant cost pressures to the court to adjudicate lawsuits filed by or on behalf of consumers against businesses who are alleged to have violated provisions of the CCPA. While the superior courts are not funded on a workload basis, an increased workload could result in delayed court services and place pressure on the General Fund to fund additional staff and resources.
• Department of Health Care Services (DHCS). Staff notes DHCS’s existing agreements contain similar language as the bill’s provisions, however to the extent DHCS may need to review existing contracts and templates, there may be one-time, workload pressures in the low thousands (GF).

SUPPORT: (Verified 8/21/20)

Advanced Medical Technology Association

Association of Clinical Research Organizations

Association of Regional Center Agencies

Biocom

Biotechnology Innovation Organization

California Association of Health Plans

California Biomedical Research Association

California Dental Association

California Hospital Association

California Life Sciences Association

California Retailers Association

Consumer Healthcare Products Association

International Pharmaceutical & Medical Device Privacy Consortium

Medical Imaging and Technology Alliance

National Association of Chain Drug Stores

Pharmaceutical Research and Manufacturers of America

OPPOSITION: (Verified 8/21/20)

None received

ARGUMENTS IN SUPPORT: This bill is supported by a coalition of organizations that include Advanced Medical Technology Association (AdvaMed), the California Hospital Association, the California Life Sciences Association, the International Pharmaceutical & Medical Device Privacy Consortium, and the Association of Clinical Research Organizations (collectively, the Coalition). According to the Coalition, it supports this bill to incorporate additional technical but critical cleanup amendments to the CCPA. The Coalition states that the organizations that make up California’s world class health care system have been working since the law was last clarified in 2018 to identify areas for additional improvement for the health care system that are already regulated under complex existing federal and state medical privacy and confidentiality laws. The Coalition states that each of the amendments in this bill clarify existing provisions in the CCPA and are intended to reduce difficulties for health care and medical research entities in comply with federal and state laws.

ASSEMBLY FLOOR: 74-0, 5/28/19

AYES: Aguiar-Curry, Arambula, Bauer-Kahan, Berman, Bigelow, Bloom, Boerner Horvath, Bonta, Brough, Burke, Calderon, Carrillo, Cervantes, Chau, Chen, Chiu, Choi, Chu, Cooper, Cunningham, Dahle, Daly, Diep, Flora, Fong, Frazier, Friedman, Gabriel, Gallagher, Cristina Garcia, Gipson, Gloria, Gonzalez, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Petrie-Norris, Quirk, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Salas, Santiago, Smith, Mark Stone, Voepel, Waldron, Weber, Wicks, Wood, Rendon

NO VOTE RECORDED: Cooley, Eggman, Eduardo Garcia, Gray, Blanca Rubio, Ting

Prepared by: Vincent D. Marchand / HEALTH / (916) 651-4111

8/29/20 13:52:14

 THIRD READING  

Bill No: AB 713

Author: Mullin (D)

Amended: 8/20/20 in Senate

Vote: 27 - Urgency

SENATE HEALTH COMMITTEE: 8-0, 1/8/20

AYES: Pan, Lena Gonzalez, Grove, Hurtado, Leyva, Mitchell, Monning, Rubio

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/20/20

AYES: Portantino, Bates, Bradford, Hill, Jones, Leyva, Wieckowski

ASSEMBLY FLOOR: 74-0, 5/28/19 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018

SOURCE: Author

DIGEST:

This bill establishes new exemptions from the California Consumer Privacy Act with regard to certain types of medical information, including exemptions for information that has been deidentified under specified federal requirements, and medical information collected as part of regulated research activities.

ANALYSIS:

Existing law:

1. Establishes the Confidentiality of Medical Information Act (CMIA), which among other things, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining an authorization.
2. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to the collection of personal information by businesses, including, among other rights, the right to request that a business disclose the categories and specific pieces of personal information it has collected, the right to request that a business delete any personal information that it has collected, and the right to direct a business not to sell their personal information. [CIV §1798.100, et seq.]
3. Defines “personal information,” for purposes of the CCPA, to include a long list of information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household. [CIV §1798.140 (o)(1)]
4. Excludes “deidentified” information from the definition of “personal information,” and defines “deidentified” as information that cannot reasonably identify, relate to, describe, or be linked, directly or indirectly, to a particular consumer, and requires a business that uses deidentified information to implement technical safeguards that prohibit reidentification, implement business processes that specifically prohibit reidentification, and implement business processes to prevent inadvertent release of deidentified information. [CIV §1798.140 (h)]
5. Provides other specific exemptions from the provisions of the CCPA, including the following as it relates to health care:
   1. Medical information governed by the CMIA or protected health information (PHI) that is collected by a “covered entity” or “business associate,” as defined and governed by the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) [CIV §1798.145(c)(1)(A)];
   2. A provider of health governed by the CMIA or a covered entity governed by HIPAA [CIV §1798.145(c)(1)(B)]; and,
   3. Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects (Common Rule), good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the United States Food and Drug Administration (FDA). [CIV §1798.145 (c)(1)(C)]

This bill:

1. Exempts from the CCPA information that meets both of the following:
   1. It is deidentified in accordance with the requirements for deidentification set forth under specified provisions of HIPAA; and,
   2. It is derived from patient information that was originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the CMIA, or the Common Rule, as specified.
2. Requires a business that sells or discloses information that is exempted from the CCPA pursuant to 1) above to disclose on its online privacy policy whether the business discloses deidentified health information derived from personal information, and if so, whether that deidentified health information was deidentified pursuant to one or more of the following: the deidentification methodology commonly known as the “HIPAA expert determination method,” as specified; or the deidentification methodology commonly known as the “HIPAA safe harbor method,” as specified.
3. Exempts from the CCPA a business associate of a covered entity governed by HIPAA, to the extent the business associate maintains, uses, and discloses patient information only in accordance with the legal requirements of the privacy, security, and breach notification rules applicable to PHI under HIPAA.
4. Exempts from the CCPA information that is collected, used, or disclosed in research, as defined, including, but not limited to, a clinical trial, and that is conducted in accordance with applicable ethics, confidentiality, privacy, and security rules of HIPAA, the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the FDA.
5. Defines “patient information” as meaning identifiable private information, protected health information, individually identifiable health information, or medical information, as each of those terms are defined.
6. Prohibits a business or other person from reidentifying information that has met the requirements of 1) above, except for one or more of the following purposes:
   1. Treatment, payment, or health care operations conducted by a covered entity or business associate acting on behalf of the covered entity;
   2. Public health activities or purposes, as specified in federal law;
   3. Research, as defined;
   4. Pursuant to a contract that expressly engages a person or entity to attempt to reidentify the information in order to conduct testing, analysis, or validation of deidentification, or related statistical techniques, if the contract bans any other use of the reidentified information and requires the destruction of the information upon completion of the contract; and,
   5. If otherwise required by law.
7. Requires any contract for the sale or license of deidentified information, where one of the parties is a person residing or doing business in the state, to include the following, or substantially similar, provisions:
   1. A statement that the deidentified information being sold or licensed includes deidentified patient information;
   2. A statement that reidentification of the deidentified information by the purchaser or licensee of that information is prohibited; and,
   3. A requirement that, unless otherwise required by law, the purchaser or licensee of the deidentified information may not further disclose the deidentified information to any third party unless the third party is contractually bound by the same or stricter restrictions and conditions.
8. Contains an urgency clause that will make this bill effective upon enactment.

Comments

1. Author’s statement. According to the author, this bill is an important measure to protect patient care in the health care system and limit unintended consequences for health care research and operations related to implementation of the CCPA. California is currently home to the largest, most innovative and productive life sciences ecosystem in the world. The innovations produced in California are saving lives and transforming health care through earlier disease detection, less invasive procedures and more effective treatments. This bill would provide an important clarification by harmonizing the law with certain areas of health care information already covered under existing medical privacy regulations. Additional clarification is needed for the de-identification standards under HIPAA for the purpose of medical research, business associates that handle PHI, human subject research that falls outside of the area clinical trials, and FDA product and patient safety standards. This bill will provide the necessary clarification in these areas to ensure that California’s life science industry is not adversely affected by the rollout of new privacy standards of the CCPA.
2. Creation of the CCPA. Californians for Consumer Privacy is an organization that was founded and chaired by Alastair Mactaggart to protect and expand privacy rights for Californians. Californians for Consumer Privacy sponsored a ballot referendum that qualified for the November 2018 ballot to enact the CCPA. After the initiative qualified, the Legislature passed AB 375 (Chau, Chapter 55, Statutes of 2018), which enacted a version of the CCPA into law, and Californians for Consumer Privacy withdrew the ballot initiative. The CCPA grants a set of rights to consumers with regard to their personal information, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to delete certain information, the right to restrict the sale of information, and protection from discrimination for exercising these rights.
3. CCPA deidentification vs. HIPAA deidentification. Under the existing CCPA, personal information that is deidentified is exempt from the definition of personal information, and therefore exempt from the CCPA. Similarly, under HIPAA, information can be deidentified, and would therefore remove it from the privacy requirements applicable to PHI. However, the two laws define deidentification differently. Under CCPA, “deidentified” means “information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.” Additionally, CCPA goes on to require that a business that uses deidentified information comply with the following: a) implement technical safeguards that prohibit reidentification of the consumer to whom the information may pertain; b) implement business processes that specifically prohibit reidentification of the information; c) implement business processes to prevent the inadvertent release of deidentified information; and, d) make no attempt to reidentify the information. Under HIPAA, on the other hand, health information that “does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual” is not individually identifiable health information. HIPAA permits a covered entity to determine that health information is not individually identifiable only if one of the following two deidentification methods are used:
   1. Expert determination. Under this method, a person with appropriate knowledge of generally accepted statistical principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The expert is required to document the methods and results of the analysis that justify such a determination; or,
   2. Safe harbor. Under this method, a long list of identifiers of the individual or of relatives, employers, or household members of the individual, are removed, including: all geographic subdivisions smaller than a State except for the initial three digits of a zip code; all elements of dates directly related to an individual, including admission or discharge date or dates of birth; device identifiers and serial numbers; health plan numbers; and so on.

HIPAA also provides for a mechanism for reidentification by permitting a covered entity to assign a code or other means of record identification to allow information deidentified to be reidentified by the covered entity, provided that the code or other means of record identification is not derived from or related to information about the individual, and the covered entity does not use or disclose the code or other means of record identification for any other purpose and does not disclose the mechanism for reidentification.

1. HIPAA and CMIA definitions. This bill, as well as parts of the existing CCPA, cross-reference a number of terms defined elsewhere in federal or state law, including the following:
   1. Individually identifiable health information is defined under HIPAA as information that is a subset of health information, including demographic information collected from an individual, and that meets all of the following conditions: (1) it is created or received by a health care provider, health plan, employer, or health care clearinghouse; (2) it relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (3) there is a reasonable basis to believe the information can be used to identify the individual.
   2. PHI is defined under HIPAA as individually identifiable health information that is transmitted by electronic media; maintained in electronic media; or is transmitted or maintained in any other form or medium. The definition of PHI excludes individually identifiable health information that is (1) in records covered by the Family Educational Rights and Privacy Act; (2) is in employment records held by a covered entity in its role as employer; or (3) is in regards to a person who has been deceased for more than 50 years.
   3. Medical information is defined under the CMIA as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” is defined as medical information that includes or contains any element of personal identifying information to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, in combination with other publicly available information, reveals the individual’s identity.
   4. Identifiable private information is defined under the Common Rule as private information, which is information provided for specific purposes by an individual that the individual can reasonably expect will not be made public, such as a medical record, for which the identity of the subject may readily be ascertained by the investigator or associated with the information.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Department of Justice (DOJ). Staff estimates $317,000 General Fund (GF) in FY 2020-21, $360,000 GF in FY 2021-22 and FY 2022-23, and ongoing, for 2.0 positions (1.0 Deputy Attorney General and a the legal component of 1.0 Legal Secretary) for workload due to an anticipated increase in litigation in potential legal challenges. The positions would be authorized beginning September 1, 2020, and through June 30, 2023.
• Courts. Unknown, potentially-significant cost pressures to the court to adjudicate lawsuits filed by or on behalf of consumers against businesses who are alleged to have violated provisions of the CCPA. While the superior courts are not funded on a workload basis, an increased workload could result in delayed court services and place pressure on the General Fund to fund additional staff and resources.
• Department of Health Care Services (DHCS). Staff notes DHCS’s existing agreements contain similar language as the bill’s provisions, however to the extent DHCS may need to review existing contracts and templates, there may be one-time, workload pressures in the low thousands (GF).

SUPPORT: (Verified 8/21/20)

Advanced Medical Technology Association

Association of Clinical Research Organizations

Association of Regional Center Agencies

Biocom

Biotechnology Innovation Organization

California Association of Health Plans

California Biomedical Research Association

California Hospital Association

California Life Sciences Association

California Retailers Association

Consumer Healthcare Products Association

International Pharmaceutical & Medical Device Privacy Consortium

Medical Imaging and Technology Alliance

National Association of Chain Drug Stores

Pharmaceutical Research and Manufacturers of America

OPPOSITION: (Verified 8/21/20)

None received

ARGUMENTS IN SUPPORT: This bill is supported by a coalition of organizations that include Advanced Medical Technology Association (AdvaMed), the California Hospital Association, the California Life Sciences Association, the International Pharmaceutical & Medical Device Privacy Consortium, and the Association of Clinical Research Organizations (collectively, the Coalition). According to the Coalition, it supports this bill to incorporate additional technical but critical cleanup amendments to the CCPA. The Coalition states that the organizations that make up California’s world class health care system have been working since the law was last clarified in 2018 to identify areas for additional improvement for the health care system that are already regulated under complex existing federal and state medical privacy and confidentiality laws. The Coalition states that each of the amendments in this bill clarify existing provisions in the CCPA and are intended to reduce difficulties for health care and medical research entities in comply with federal and state laws.

ASSEMBLY FLOOR: 74-0, 5/28/19

AYES: Aguiar-Curry, Arambula, Bauer-Kahan, Berman, Bigelow, Bloom, Boerner Horvath, Bonta, Brough, Burke, Calderon, Carrillo, Cervantes, Chau, Chen, Chiu, Choi, Chu, Cooper, Cunningham, Dahle, Daly, Diep, Flora, Fong, Frazier, Friedman, Gabriel, Gallagher, Cristina Garcia, Gipson, Gloria, Gonzalez, Grayson, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Petrie-Norris, Quirk, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Salas, Santiago, Smith, Mark Stone, Voepel, Waldron, Weber, Wicks, Wood, Rendon

NO VOTE RECORDED: Cooley, Eggman, Eduardo Garcia, Gray, Blanca Rubio, Ting

Prepared by: Vincent D. Marchand / HEALTH / (916) 651-4111

8/24/20 15:00:06

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2019 - 2020 Regular Session

AB 713 (Mullin) - California Consumer Privacy Act of 2018

Bill Summary:

Assembly Bill would establish new exemptions from the California Consumer Privacy Act (CCPA) for certain types of medical information, including exemptions for patient information that has been de-identified under specified federal requirements, and medical information used in medical research. Would also require businesses to disclose how patient information was de-identified, prohibit re-identification of de-identified patient information except in certain circumstances, and place limitations on the sale and licensing of de-identified patient information.

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on August 20, 2020

Fiscal Impact:

• Department of Justice (DOJ). Staff estimates $317,000 General Fund in FY 2020-21, $360,000 GF in FY 2021-22 and FY 2022-23, and ongoing, for 2.0 positions (1.0 Deputy Attorney General and a the legal component of 1.0 Legal Secretary) for workload due to an anticipated increase in litigation in potential legal challenges. The positions would be authorized beginning September 1, 2020, and through June 30, 2023.
• Courts. Unknown, potentially-significant cost pressures to the court to adjudicate lawsuits filed by or on behalf of consumers against businesses who are alleged to have violated provisions of the CCPA. While the superior courts are not funded on a workload basis, an increased workload could result in delayed court services and place pressure on the General Fund to fund additional staff and resources.
• Department of Health Care Services (DHCS). Staff notes the department’s existing agreements contain similar language as the bill’s provisions, however to the extent DHCS may need to review existing contracts and templates, there may be one-time, workload pressures in the low thousands (General Fund).

Author Amendments:

The author’s amendments would clarify information that was collected, created, transmitted, or maintained by an entity regulated by the Health Insurance Portability and Accountability Act, the Confidentiality of Medical Information Act, or the Common Rule, is exempt from the CCPA.

-- END --

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2019 - 2020 Regular Session

AB 713 (Mullin) - California Consumer Privacy Act of 2018

Bill Summary:

Assembly Bill 713 would establish new exemptions from the California Consumer Privacy Act (CCPA) for certain types of medical information, including exemptions for patient information that has been de-identified under specified federal requirements, and medical information used in medical research. Would also require businesses to disclose how patient information was de-identified, prohibit re-identification of de-identified patient information except in certain circumstances, and place limitations on the sale and licensing of de-identified patient information.

Fiscal Impact:

• Department of Justice (DOJ). According to the DOJ, $317,000 General Fund in FY 2020-21, $360,000 GF in FY 2021-22 and FY 2022-23, and ongoing, for 2.0 positions (1.0 Deputy Attorney General and a the legal component of 1.0 Legal Secretary) for workload due to an anticipated increase in litigation in potential legal challenges. The positions would be authorized beginning September 1, 2020, and through June 30, 2023.
• Courts. Unknown, potentially-significant cost pressures to the court to adjudicate lawsuits filed by or on behalf of consumers against businesses who are alleged to have violated provisions of the CCPA. While the superior courts are not funded on a workload basis, an increased workload could result in delayed court services and place pressure on the General Fund to fund additional staff and resources.
• Department of Health Care Services (DHCS). According to the department, no fiscal impact. The department’s existing agreements already contain similar language as the bill’s provisions. Specifically, the requirement to identify information as de-identified patient information, the prohibition on re-identification, and limits on re-disclosure. To the extent, DHCS may need to review existing contracts and templates and templates, changes are anticipated to be minor and absorbable within existing budget.
• Office of Health Information Integrity (CalOHII). No fiscal impact. CalOHII ensures California state departments are compliant with the Health Insurance Portability and Accountability Act (HIPAA) and other related laws.

Background:

AB 375 (Chau, Chapter 55, Statutes of 2018) enacted the California Consumer Privacy Act, which, effective January 1, 2020, granted consumers a set or rights with regard to their personal information, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to restrict the sale of information, the right to request that a business delete any personal information collected, the right to direct a business not to sell their personal information, and protection from discrimination for exercising these rights.

Under the CCPA, “personal information” is information that identifies, describes, or could reasonably be linked with a particular consumer or household (e.g., identifiers such as a name or alias, commercial information, biometric information, internet activity information, geolocation data, and inferences from any personal information to create a profile about a consumer). Existing law requires a business that uses deidentified information to implement safeguards that prohibit reidentification the inadvertent release of deidentified information. In addition, the CCPA included the following exemptions as it pertains to health care: (1) medical information governed by the Confidentiality Medical Information Act (CMIA) or protected health information (PHI) that is collected by a “covered entity” or “business associate,” as defined under HIPAA and the Health Information Technology for Economic and Clinical Health Act; (2) a health provider, as defined; and (3) information collected as part of a clinical trial.

Proposed Law:

This bill would include the following provisions to amend the CCPA, among others:

• Exempts from the CCPA information collected by a covered entity or a business associate of a covered entity that meets both of the following conditions:
  • It is deidentified in accordance with the requirements for deidentification set forth in the Code of Federal Regulations.
  • It is derived from patient information.

Deidentified information but is subsequently reidentified must no longer be eligible for the exemption and is subject to applicable federal and state data privacy and security laws, including, but not limited to, the HIPPA, CMIA, and CCPA.

• Exempts from the CCPA information collected, used, or disclosed in research, as defined in federal regulations, including, but not limited to, a clinical trial, and that is conducted in accordance with applicable ethics, confidentiality, privacy, and security rules, as specified, good clinical practice guidelines, as specified, or human subject protection requirements of the United States Food and Drug Administration.
• Conforms in state law the following terms to those set definitions in federal regulations: “Business associate”, “Covered entity”, “Identifiable private information”, “Individually identifiable health information”, and “Protected health information”
• Prohibits a business or other person from reidentifying, or attempt to reidentify, specified information, except for one or more of the following purposes:
  • Treatment, payment, or health care operations conducted by a covered entity or business associate acting on behalf of, and at the written direction of, the covered entity;
  • Public health activities or purposes, as defined; and,
  • Research, as defined in federal regulation and statute.
• Exempts from the CCPA a contract where the lawful holder of the deidentified information collected by covered entity or a business associate of a covered entity engages a person or entity to reidentify the deidentified information in order to conduct testing, analysis, or validation of deidentification, or related statistical techniques.
• Requires, beginning January 1, 2021, any contract for the sale or license of deidentified information, where one of the parties is a person residing or doing business in the state, must include the following, or substantially similar, provisions:
  • A statement that the deidentified information being sold or licensed includes deidentified patient information.
  • A statement that reidentification, and attempted reidentification, of the deidentified information by the purchase or licensee of the information is prohibited pursuant to Section 1798.146 and this section.
  • A requirement that, unless otherwise required by law, the purchaser or licensee of the deidentified information may not further disclose the deidentified information to any third party unless the third party is contractually bound by the same or stricter restrictions and conditions.
• Provides the bill is an urgency as the bill would preserve access to information needed to conduct important health-related research that will benefit Californians.

Related Legislation:

• AB 873 (Irwin, 2019) loosens the definition of “deidentified” and narrows the definition of “personal information” in the CCPA. The bill limits the personal information subject to the protections of the CCPA. AB 873 failed passage in Senate Judiciary Committee, and was granted reconsideration.
• AB 874 (Irwin, Chapter 748, Statutes of 2019) expands the scope of "publicly available" information that is exempted from the "personal information" definition in the CCPA to ensure that "publicly available" information includes any information that is lawfully made available from government records.
• AB 981 (Daly, 2019) eliminates a consumer’s right to request a business delete or not sell the consumer’s personal information under the CCPA if the consumer’s personal information is needed to complete a specified insurance transaction. AB 981 is pending in the Senate Insurance Committee.
• AB 1416 (Cooley, 2019) establishes exceptions to the CCPA for a business that provides a consumer’s personal information to a government agency to carry out a government program or sell the personal information of a consumer who has opted-out of the sale. This bill is currently in pending consideration the Senate Judiciary Committee.
• SB 1121 (Dodd, Chapter 735, Statutes of 2018) amended the CCPA to include exemptions for medical information governed by the CMIA, PHI governed by HIPAA, and information collected as part of a clinical trial. SB 1121 also exempted providers of health care governed by CMIA and covered entities governed by HIPAA.

Staff Comments:

The fiscal impact of this bill to the court cannot be known with certainty, as the actual impact will be dependent on numerous factors, including, but not limited to, the frequency of alleged violations of the act, the complexity of alleged violations, if parties settle matters prior to litigation, and the factors unique to each case. In 2018, it cost the court a little over $2,600, on average, in personnel and resources to adjudicate a limited civil case and over $11,600, on average, to adjudicate an unlimited civil case. In FY 2019-20, it costs approximately $7,896 a day (or $987 an hour), on average, to operate a courtroom (exclusive of the judge’s salary). So if violations of the California Consumer Privacy Act of 2018 led to more than nineteen limited civil cases, more than four unlimited civil cases, or a few complex cases (such as class actions) that took longer than seven days that otherwise would not have been brought, the cost pressures of this bill to the court would surpass the Suspense File threshold.

-- END --

SENATE COMMITTEE ON HEALTH

Senator Dr. Richard Pan, Chair

BILL NO: AB 713

SUBJECT: California Consumer Privacy Act of 2018

SUMMARY:

Establishes new exemptions from the California Consumer Privacy Act with regard to certain types of medical information, including exemptions for information that has been deidentified under specified federal requirements, and medical information collected as part of regulated research activities.

Existing law:

1. Establishes the Confidentiality of Medical Information Act (CMIA), which among other things, generally prohibits a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient or enrollee without first obtaining an authorization.
2. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to the collection of personal information by businesses, including, among other rights, the right to request that a business disclose the categories and specific pieces of personal information it has collected, the right to request that a business delete any personal information that it has collected, and the right to direct a business not to sell their personal information. [CIV §1798.100, et seq.]
3. Defines “personal information,” for purposes of the CCPA, to include a long list of information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Includes within the definition of “personal information,” among other things, identifiers such as a name or alias or unique personal identifier, commercial information, biometric information, internet activity information, geolocation data, and inferences drawn from any personal information to create a profile about a consumer. [CIV §1798.140 (o)(1)]
4. Excludes “deidentified” information from the definition of “personal information,” and defines “deidentified” as information that cannot reasonably identify, relate to, describe, or be linked, directly or indirectly, to a particular consumer, and requires a business that uses deidentified information to implement technical safeguards that prohibit reidentification, implement business processes that specifically prohibit reidentification, and implement business processes to prevent inadvertent release of deidentified information. [CIV §1798.140 (h)]
5. Excludes “aggregate consumer information” from the definition of “personal information,” and defines “aggregate consumer information” as information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device, and excludes from the definition of “aggregate consumer information” one or more individual consumer records that have been deidentified. [CIV §1798.140 (a)]
6. Excludes “publicly available” information from the definition of “personal information,” if it is lawfully made available from federal, state, or local government records, but specifies that biometric information collected by a business without the consumer’s knowledge is not “publicly available.” [CIV §1798.140 (o)(2)]
7. Provides other specific exemptions from the provisions of the CCPA, including the following as it relates to health care:
   1. Medical information governed by the CMIA or protected health information (PHI) that is collected by a “covered entity” or “business associate,” as defined and governed by the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) [CIV §1798.145(c)(1)(A)];
   2. A provider of health governed by the CMIA or a covered entity governed by HIPAA [CIV §1798.145(c)(1)(B)]; and,
   3. Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects (Common Rule), good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the United States Food and Drug Administration (FDA). [CIV §1798.145 (c)(1)(C)]

This bill:

1. Exempts from the CCPA information that meets all of the following conditions:
   1. It is deidentified in accordance with the requirements for deidentification set forth under specified provisions of HIPAA;
   2. It is derived from PHI, medical information, individually identifiable health information, or identifiable private information, consistent with the Common Rule; and,
   3. A business or its business associates, as defined, does not attempt to reidentify the information.
2. Requires a business that sells or discloses information that is exempted from the CCPA pursuant to 1) above to disclose on its online privacy policy whether the business discloses deidentified health information derived from personal information, and if so, whether that deidentified health information was deidentified pursuant to one or more of the following: the deidentification methodology commonly known as the “HIPAA expert determination method,” as specified; or the deidentification methodology commonly known as the “HIPAA safe harbor method,” as specified.
3. Exempts from the CCPA a business associate of a covered entity governed by HIPAA, to the extent the business associate maintains, uses, and discloses patient information only in accordance with the legal requirements of the privacy, security, and breach notification rules applicable to PHI under HIPAA.
4. Exempts from the CCPA personal information that is collected for, or used in biomedical research subject to institutional review board standards and the ethics and privacy requirements of the Common Rule, good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the FDA.
5. Exempts from the CCPA personal information that is collected for, or used in research, subject to all applicable ethics and privacy laws, if the information is either individually identifiable health information, as defined under HIPAA, or medical information governed by the CMIA.
6. Defines “research,” for purposes of 4) and 5) above, as having the same meaning as a specified provision of HIPAA, which specifies that research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
7. Exempts from some of the provisions of the CCPA, including the requirement to delete personal information upon request, personal information collected by a business that meets all of the following conditions:
   1. The business uses the information only for the following purposes: product registration and tracking consistent with FDA regulations and guidance; public health activities and purposes as described in specified provisions of HIPAA; and activities related to quality, safety, or effectiveness regulated by the FDA;
   2. The information is subject to all confidentiality and privacy provisions applicable under federal or state law other than the CCPA and is not sold or used except as provided in a) above; and,
   3. The business discloses the categories and types of personal information that is collected, the categories of sources where the information was collected, the purpose of collecting the information, the categories of third parties with whom it shares the personal information, and disclosure of the business purposes for selling or disclosing personal information. Additionally, subjects the business to the civil enforcement provisions for violations of the CCPA.
8. Defines “patient information,” for purposes of all of the various medical information related exemptions to the CCPA, as all of the following:
   1. “Individually identifiable health information” as defined in HIPAA, as specified;
   2. “Identifiable private information” as defined in the Federal Policy for the Protection of Human Research Subjects, as specified; and,
   3. “Medical information” as defined in the CMIA.

FISCAL EFFECT:

This bill has not been analyzed by a fiscal committee.

PRIOR VOTES:

Not relevant.

COMMENTS:

1. Author’s statement. According to the author, this bill is an important measure to protect patient care in the health care system and limit unintended consequences for health care research and operations related to implementation of the CCPA. California is currently home to the largest, most innovative and productive life sciences ecosystem in the world. California’s life sciences now include over 3,000 companies that directly and indirectly employ almost 900,000 people and generate $147.7 billion in revenue. The innovations produced in California are saving lives and transforming health care through earlier disease detection, less invasive procedures and more effective treatments. This bill would provide an important clarification to the law by harmonizing the law with certain areas of health care information already covered under existing medical privacy and confidentiality regulations. Additional clarification is needed for the de-identification standards under HIPAA for the purpose of biomedical research, business associates that handle protected health information, human subject research that falls outside of the area clinical trials, and FDA product and patient safety standards. This bill will provide the necessary clarification in these areas to ensure that California’s life science industry and biomedical research are not adversely affected by the rollout of new privacy standards established by the CCPA.
2. Creation of the CCPA. Californians for Consumer Privacy is an organization that was founded and chaired by Alastair Mactaggart to protect and expand privacy rights for Californians. Californians for Consumer Privacy sponsored a ballot referendum that qualified for the November 2018 ballot to enact the CCPA. After the initiative qualified, the Legislature passed AB 375 (Chau, Chapter 55, Statutes of 2018), which enacted a version of the CCPA into law, and Californians for Consumer Privacy withdrew the ballot initiative. The CCPA grants a set of rights to consumers with regard to their personal information, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to delete certain information, the right to restrict the sale of information, and protection from discrimination for exercising these rights.
3. HIPAA Privacy Rule. The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information, and applies to health insurance plans, health care clearinghouses (which are organizations that process health information and convert data into types that conform to HIPAA standards), and health care providers such as hospitals, doctors and pharmacies that transmit health information electronically (collectively, these are called “covered entities”). HIPAA also applies to a business associate, which is defined as a person who, on behalf of a covered entity, creates, receives, maintains, or transmits protected health information for a function or activity regulated under HIPAA, including claims processing or administration, data analysis, quality assurance, billing, and other services. HIPAA sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization, and also gives patients certain rights over their health information, including rights to examine and obtain a copy of their health records.
4. Explanation for each of the major changes proposed by this bill. This bill makes four substantive changes to the CCPA: a) exempting information that was deidentified under HIPAA rules from the CCPA; b) exempting business associates regulated under HIPAA from the CCPA; c) broadening the exemption for clinical trials research to incorporate medical research more generally; and, d) exempting information related to product and patient safety. Context and the proponents rationale for each of these changes follows:
   1. HIPAA deidentification. The CCPA already exempts personal information that has been deidentified, as described in comment 5) below. However, because the specific language in the CCPA concerning deidentification is different than the language pertaining to deidentification in HIPAA, proponents are concerned that deidentified data sets under HIPAA might not meet the definition laid out under the CCPA, which would subject this data to the obligation under CCPA to delete the personal information. Proponents point out that if deidentified data becomes reidentified, it would once again be considered PHI, and subject to the penalties associated with unauthorized release of individually identifiable information. This bill does two things: it exempts information that has been deidentified under HIPAA standards, but it also requires that a business that discloses or sells information that is exempted because it has been deidentified to disclose on its online privacy policy the fact that the business discloses deidentified health information. Additionally, this bill requires the business to disclose which of the two HIPAA deidentification methods described in comment 5) below was used to deidentify the information.
   2. Business associates. The CCPA exempts covered entities under HIPAA (i.e., health plans and health care providers), but when it comes to business associates, it only exempts the PHI that collected by a business associate, not the business associate itself. Proponents point out that business associates sometimes handle a small percentage of health information that is technically not PHI under HIPAA, such as providers that do not take health insurance. However, because the bulk of the data they handle is subject to HIPAA protection, business associates will treat all information under the rules set by HIPAA. This bill exempts business associates, but only to the extent that they use and disclose patient information in accordance with the requirements of HIPAA.
   3. Medical research. There is currently an exemption in the CCPA for information that is collected as part of a clinical trial, but that is only a small portion of all regulated medical research. For example, proponents point out that there are long-term, observational drug safety studies, opioid abuse prevention and outcomes research, and observational drug comparative effectiveness studies, none of which fall under the clinical trial exemption. This bill exempts personal information from the CCPA that is collected for or used in biomedical research that is subject to the Federal Policy for the Protection of Human Subjects (Common Rule), good clinical practice guidelines issued by the International Council for Harmonisation, or human subject protection requirements of the FDA. Additionally, this bill exempts personal information collected for or used in research, if the information is individually identifiable health information subject to the applicable ethics and privacy laws of HIPAA or medical information subject to the protections of the CMIA.
   4. Product safety. Proponents point out that FDA-regulated manufacturers are required to track certain products, especially medical devices, from manufacturing through the distribution chain in the event they receive an order from the FDA to implement a tracking system to facilitate notifications and recalls. Similarly, the FDA mandates adverse event reporting for drug manufacturers, but this adverse event data may not otherwise be exempt from the CCPA because it is no longer clinical data subject to HIPAA during the adverse event reporting lifecycle. This bill provides a limited exemption for personal information collected by a business for product tracking under FDA regulations, and other federally regulated public health activities and purposes, but the exemption is only for some of the provisions of the CCPA, including those requiring deletion upon a patient request, and the specific prior notice requirements. This information would still be subject to the disclosure and enforcement provisions of the CCPA.
5. CCPA deidentification vs. HIPAA deidentification. Under the existing CCPA, personal information that is deidentified is exempt from the definition of personal information, and therefore exempt from the CCPA. Similarly, under HIPAA, information can be deidentified, and would therefore remove it from the privacy requirements applicable to PHI. However, the two laws define deidentification differently. Under CCPA, “deidentified” means “information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer.” Additionally, CCPA goes on to require that a business that uses deidentified information comply with the following: a) implement technical safeguards that prohibit reidentification of the consumer to whom the information may pertain; b) implement business processes that specifically prohibit reidentification of the information; c) implement business processes to prevent the inadvertent release of deidentified information; and, d) make no attempt to reidentify the information. Under HIPAA, on the other hand, health information that “does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual” is not individually identifiable health information. HIPAA permits a covered entity to determine that health information is not individually identifiable only if one of the following two deidentification methods are used:
   1. Expert determination. Under this method, a person with appropriate knowledge of and experience with generally accepted statistical principles and methods for rendering information not individually identifiable, applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information. The expert is required to document the methods and results of the analysis that justify such a determination; or,
   2. Safe harbor. Under this method, a long list of identifiers of the individual or of relatives, employers, or household members of the individual, are removed, including: all geographic subdivisions smaller than a State except for the initial three digits of a zip code; all elements of dates directly related to an individual, including admission or discharge date or dates of birth; device identifiers and serial numbers; health plan beneficiary numbers; and so on.

HIPAA also provides for a mechanism for reidentification by permitting a covered entity to assign a code or other means of record identification to allow information deidentified to be reidentified by the covered entity, provided that the code or other means of record identification is not derived from or related to information about the individual, and the covered entity does not use or disclose the code or other means of record identification for any other purpose and does not disclose the mechanism for reidentification.

1. HIPAA and CMIA definitions. This bill, as well as parts of the existing CCPA, cross-reference a number of terms defined elsewhere in federal or state law, including the following:
   1. Individually identifiable health information is defined under HIPAA as information that is a subset of health information, including demographic information collected from an individual, and that meets all of the following conditions: (1) it is created or received by a health care provider, health plan, employer, or health care clearinghouse; (2) it relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (3) it identifies the individual, or there is a reasonable basis to believe the information can be used to identify the individual.
   2. PHI is defined under HIPAA as individually identifiable health information that is transmitted by electronic media; maintained in electronic media; or is transmitted or maintained in any other form or medium. The definition of PHI excludes individually identifiable health information that is (1) in records covered by the Family Educational Rights and Privacy Act, as specified; (2) is in employment records held by a covered entity in its role as employer; or (3) is in regards to a person who has been deceased for more than 50 years.
   3. Medical information is defined under the CMIA as any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental or physical condition, or treatment. “Individually identifiable” is defined as medical information that includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the individual’s identity.
   4. Identifiable private information is defined under the Federal Policy for the Protection of Human Research Subjects (Common Rule) as private information, which is information that has been provided for specific purposes by an individual and that the individual can reasonably expect will not be made public, such as a medical record, for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information.
2. Referral to the Senate Committee on Rules. The most recent amendments to this bill deleted the prior contents and replaced it with a new bill. Should this bill pass out of this committee, it will be referred to the Senate Committee on Rules for consideration of additional committee referrals.
3. Related legislation. AB 873 (Irwin of 2019) loosens the definition of “deidentified” and narrows the definition of “personal information” in the CCPA. The bill thereby limits the personal information subject to the protections of the CCPA. AB 873 failed passage in Senate Judiciary Committee, and was granted reconsideration.
   
   AB 874 (Irwin, Chapter 748, Statutes of 2019) expands the scope of "publicly available" information that is exempted from the "personal information" definition in the CCPA to ensure that "publicly available" information includes any information that is lawfully made available from government records. AB 874 also revises the personal information definition so that it includes information that is "reasonably capable" of being associated with a particular consumer or household, as opposed to "capable" of being associated.
   
   AB 981 (Daly of 2019) eliminates a consumer’s right to request a business delete or not sell the consumer’s personal information under the CCPA if it is necessary to retain or share the consumer’s personal information to complete an insurance transaction requested by the consumer. It also strengthens privacy protections for the information of insureds. AB 981 is pending consideration the Senate Insurance Committee.
   
   AB 1146 (Berman, Chapter 751, Statutes of 2019) exempts from the opt-out and deletion protections and provisions of the CCPA vehicle information, including ownership information, shared between a new motor vehicle dealer and the vehicle’s manufacturer, if the vehicle information is shared for the purpose of effectuating, or in anticipation of effectuating, a vehicle repair covered by a vehicle warranty or a recall and is not sold, shared, or used for any other purpose.
   
   AB 1416 (Cooley of 2019) establishes exceptions to the CCPA for a business that provides a consumer’s personal information to a government agency solely for the purposes of carrying out a government program or sells the personal information of a consumer who has opted-out of the sale of the consumer’s personal information to another person for the sole purpose of detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity. This bill is currently in pending consideration the Senate Judiciary Committee.
4. Prior legislation. AB 375 (Chau, Chapter 55, Statutes of 2018) enacted the CCPA.
   
   SB 1121 (Dodd, Chapter 735, Statutes of 2018) amended the CCPA to make technical fixes and to address various stakeholder concerns. Among the changes to the CCPA made by SB 1121 were a series of exemptions for medical information, including medical information that is governed by the CMIA, PHI governed by HIPAA, and information collected as part of a clinical trial. SB 1121 also exempted providers of health care governed by CMIA and covered entities governed by HIPAA.
5. Support. This bill is supported by a coalition of organizations that include Advanced Medical Technology Association (AdvaMed), the California Hospital Association, the California Life Sciences Association, the International Pharmaceutical & Medical Device Privacy Consortium, and the Association of Clinical Research Organizations (collectively, the Coalition). According to the Coalition, it supports this bill to incorporate additional technical but critical cleanup amendments to the CCPA. The Coalition states that the organizations that make up California’s world class health care system have been working since the law was last clarified in 2018 to identify areas for additional improvement for the health care system that are already regulated under complex existing federal and state medical privacy and confidentiality laws. The Coalition states that each of the amendments in this bill clarify existing provisions in the CCPA and are intended to reduce difficulties for health care and medical research entities in comply with federal and state laws. Specifically, the Coalition states that this bill would expressly recognize the HIPAA deidentification standard as an acceptable standard for deidentification of health information under the CCPA, thereby eliminating potential uncertainty. The Coalition states that this bill would also supplement the existing clinical trial exemption by also exempting other biomedical research to the extent it is regulated under specified federal or international requirements. Additionally, the Coalition states that this would broaden the existing exemption for HIPAA-related business associates, but only to the extent that they handle any patient data outside HIPAA in accordance with the strict protections and operational controls of the HIPAA privacy, security, and breach notification rules. Finally, the Coalition states that this bill would add an exemption for information needed for FDA-regulated product registration and tracking and for other public health activities related to the qualify, safety, or effectiveness of an FDA-regulated product or activity.
6. Suggested clarifying amendment. In Section 2 of this bill, there is an exemption from the entirety of the CCPA for information that is deidentified under HIPAA. However, in Section 1, this bill requires a business that sells or discloses information “not subject to this title” to disclose which of two deidentification methods permitted under HIPAA it used to deidentify the information. This requirement added to the CCPA to disclose the method of deidentification conflicts with the provision exempting this type of information from the CCPA entirely. A similar conflict, where information related to product safety was exempted from some, but not all of the requirements of the CCPA, was resolved in the bill with “except for…” language, and the author may wish to consider an amendment along the same lines to clarify that the exemption for information deidentified under HIPAA is still subject to the disclosure requirements elsewhere in the bill.

SUPPORT AND OPPOSITION:

Support: Advanced Medical Technology Association

Association of Clinical Research Organizations

Biocom

Biotechnology Innovation Organization

California Hospital Association

California Life Sciences Association

International Pharmaceutical & Medical Device Privacy Consortium

Medical Imaging and Technology Alliance

Pharmaceutical Research and Manufacturers of America

Oppose: None received

-- END --

ASSEMBLY THIRD READING

ATR Bill Id:AB 713

Author:(Mullin)

As Amended Ver:March 28, 2019

Majority vote

SUMMARY:

Modifies parameters governing the Early Psychosis Intervention Plus (EPI Plus) Program authorized in statute. Specifically, this bill:

1. Deletes the requirement that implementation of the program be contingent on at least $500,000 of non-state funds into the Early Psychosis and Mood Disorder (EPMD) Detection and Intervention Fund (EPMD fund), thus allowing state funds to be the funding source for the program.
2. Deletes the prohibition on General Fund (GF) appropriations for purposes of the program.

COMMENTS:

Mental Health Services Act – Early Psychosis Intervention Efforts. With the passage of AB 1315 (Mullin), Chapter 414, Statutes of 2017, the Mental Health Services Oversight and Accountability Commission (MHSOAC) has taken steps to further the goal of establishing a program to enhance existing early psychosis programs and to expand the number of programs throughout California. MHSOAC has established the required Advisory Committee to assist the Commission in developing the program, the EPMD fund has been established to receive revenues and the MHSOAC has begun to work with state, local and national leaders on the issue of early psychosis treatment and interventions. As part of that work, MHSOAC has facilitated a multi-county collaborative that has resulted in the commitment of $10 million in public and private funds to support improvements in existing early psychosis programs and the development of a technical assistance, research and evaluation strategy to support those programs.

Early Psychosis Research and Treatment Funding. The Governor's proposed 2019-20 Budget includes a one-time augmentation of $25 million (including up to $1 million limited-term resources for state operations) to Department of Health Care Services (DHCS) to provide grants to qualified grantees to identify and support appropriate interventions for California youth experiencing the signs of early psychosis. Grantees must utilize grant funds to:

1. Improve access to youth, young adults and their families who are at risk or experiencing psychotic symptoms or diagnosed with a psychotic disorder;
2. Demonstrate programmatic effectiveness in client outcomes, including both clinical and non-clinical measures;
3. Support families with a family member (youth or young adult) with early psychosis or psychotic disorder through education, counseling and case management;
4. Improve an individual's experience in accessing services and building their capacity to support their own recovery and function;
5. Describe outreach strategies on identifying and reaching youth, young adults, and impacted families, including a diversity of California populations that reflect different ethnic, sexual orientation, racial, religious, economic status and other marginalized populations;
6. Demonstrate sustainability for the period after the grant monies have been expended, including a plan for linking patients with ongoing care needs to other public programs such as Medi-Cal; and,
7. Reduce a youth or young adult's unnecessary hospitalization or interaction with public safety officials such as juvenile hall or jail.

According to the Author:

This bill facilitates the implementation of the EPI Plus program established through AB 1315, by removing the original requirement for the inclusion of $500,000 in non-state funding into the EPMD fund before the program could begin and removing the prohibitions against the EPMD receiving GF monies. Removing this original funding requirement will allow counties to immediately start receiving funding from existing resources that will allow them to provide essential mental health services to residents.

Arguments in Support:

The Steinberg Institute, states that in 2017, the Governor signed AB 1315 seeking to expand resources for early psychosis intervention and serious mood disorder services. AB 1315 created a first-of-its-kind program in California dedicated to funding evidence-based intervention and treatments that have proven effective in arresting conditions such as schizophrenia, bipolar and other mood disorders before they become disabling. However, the legislation requires that non-state funding must be deposited first into the EPMD fund before implementation of the program. Unfortunately, this requirement has been an impediment to implementation.

Arguments in Opposition:

There is no registered opposition.

FISCAL COMMENTS:

According to the Assembly Appropriations Committee, ongoing cost pressure, likely in the millions of dollars annually, to fund program grants to eligible counties (Early Psychosis Detection and Intervention Fund, comprised of revenues potentially from the GF, federal funds, or private funds). The program allows for the donation of private and other funds for the purpose, but in absence of such funds, there would be cost pressure on the GF.

Further, administrative costs, potentially of about $100,000 to the MHSOAC (Early Psychosis Detection and Intervention Fund; Commission administrative funds pursuant to the Mental Health Services Act may be able to be transferred to the fund, or otherwise used to pay for the administrative costs).

VOTES:

ASM HEALTH: 15-0-0

YES: Wood, Mayes, Aguiar-Curry, Bigelow, Bonta, Burke, Carrillo, Flora, Limón, McCarty, Nazarian, Ramos, Rodriguez, Santiago, Waldron

ASM APPROPRIATIONS: 18-0-0

YES: Gonzalez, Bigelow, Bloom, Bonta, Brough, Calderon, Carrillo, Chau, Diep, Eggman, Fong, Gabriel, Eduardo Garcia, Maienschein, Obernolte, Petrie-Norris, Quirk, Robert Rivas

UPDATED:

VERSION: March 28, 2019

CONSULTANT: Judith Babcock / HEALTH / (916) 319-2097 FN: 0000579

Date of Hearing: April 10, 2019

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez, Chair

ABPCA Bill Id:AB 713

Author:(Mullin) – As Amended Ver:March 28, 2019

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill modifies parameters governing the Early Psychosis Intervention Plus (EPI Plus) Program authorized in statute. Specifically, this bill:

1. Deletes the requirement that implementation of the program be contingent on at least $500,000 of non-state funds into the Early Psychosis and Mood Disorder (EPMD) Detection and Intervention Fund (EPMD fund), thus allowing state funds to be the funding source for the program.
2. Deletes the prohibition on General Fund appropriations for purposes of the program.

FISCAL EFFECT:

1. Ongoing cost pressure, likely in the millions of dollars annually, to fund program grants to eligible counties (Early Psychosis Detection and Intervention Fund, comprised of revenues potentially from the GF, federal funds, or private funds). The program allows for the donation of private and other funds for the purpose, but in absence of such funds, there would be cost pressure on the GF.
2. Administrative costs, potentially of about $100,000 to the Mental Health Service Oversight and Accountability Commission (Early Psychosis Detection and Intervention Fund; Commission administrative funds pursuant to the Mental Health Services Act may be able to be transferred to the fund, or otherwise used to pay for the administrative costs).

COMMENTS:

1. Purpose. According to the author, this bill facilitates the implementation of the EPI Plus program established through AB 1315 (Mullin), Chapter 414, Statutes of 2017, by removing the original requirement for the inclusion of $500,000 in non-state funding into the EPMD fund before the program could begin. This will address an unmet need to provide evidence-based early psychosis detection and mood disorder intervention services and supports to transition-aged youth and young adults who are at risk of, or experiencing, psychotic symptoms or have psychotic disorders.
2. Background. According to the American Psychiatric Association, both international and U.S. programs expanding early intervention for young people with early psychosis show great promise and the potential for improved long-term outcomes. During early stages of psychosis, individuals often display unspecific symptoms, such as anxiety and depression, personality disorders, or abuse of alcohol or drugs. Untreated psychosis increases a person’s risk for suicide, involuntary emergency care and poor clinical outcomes and can initiate a trajectory of accumulating disability into later adulthood. Detecting and intervening early to treat psychosis can dramatically change a person's life course and improve quality of life for the person and their family.

AB 1315 (Mullin) established and authorized a framework for a competitive grant program to counties to provide matching funds to create or augment service capacity for early psychosis and mood disorder detection and intervention services. The bill put into place prohibitions on state funding, as the intent at the time was to launch the program with non-state funds.

1. Related Budget Proposal. The proposed 2019-20 Governor’s Budget includes a one-time augmentation of $25 million (including up to $1 million limited-term resources for state operations) to the Department of Health Care Services to provide grants to identify and support appropriate interventions for California youth experiencing the signs of early psychosis. Grants are proposed to be made available to qualified entities including, but not limited to, county mental health plans, nonprofit organizations, behavioral health providers and academic institutions.
2. Support. The Steinberg Institute in support of this bill states AB 1315 created a first-of-its-kind program in California dedicated to funding evidence-based intervention and treatments that have proven effective in arresting conditions such as schizophrenia, bipolar and other mood disorders before they become disabling. However, the legislation requires that non-state funding must be deposited first into the EPMD fund before implementation of the program. The Steinberg Institute notes this requirement has been an impediment to implementation.
3. Prior Legislation. AB 1315 (Mullin), described above, created the EPI Plus program to expand the provision of high-quality, evidence-based early psychosis detection and intervention services by providing funding to counties.
4. Staff Comment. If this EPI Plus program is to be state-funded, the special fund created pursuant to the original legislation, which contemplated private funding, may be unnecessary. Additionally, if the intent is to make this program eligible for funding proposed in the 2019-20 budget, changes to the program may be better addressed through the budget trailer bill process.

Analysis Prepared by: Lisa Murawski / APPR. / (916) 319-2081

ASSEMBLY THIRD READING

ATR Bill Id:AB 713

Author:(Mullin)

As Amended Ver:March 28, 2019

Majority vote

SUMMARY:

Deletes the requirement that implementation of the Early Psychosis Intervention Plus (EPI Plus) Program be contingent upon deposit of at least $500,000 of non-state funds into the Early Psychosis and Mood Disorder (EPMD) Detection and Intervention Fund (EPMD fund). Removes existing prohibition against monies from the General Fund being appropriated into the EPMD fund.

COMMENTS:

According to the National Institute of Mental Health (NIMH), mental health disorders are common among children in the United States. While mental disorders are widespread, the main burden of illness is concentrated among those suffering from a seriously debilitating mental illness. Over 20% (or one in five) children, either currently or at some point during their life, have had a seriously debilitating mental disorder. Fifty percent of all mental illness begins by the age of 14 and 75% by the age of 24, yet young people are often reluctant and afraid to seek help. About 100,000 adolescents and young adults experience first episode psychosis each year. Untreated psychosis increases a person's risk for suicide, involuntary emergency care, poor clinical outcomes, and can initiate a trajectory of accumulating disability into later adulthood. The average delay between onset of symptoms and intervention is eight to 10 years.

Clinical research conducted worldwide supports a variety of evidence-based interventions for ameliorating psychotic symptoms and promoting functional recovery-oriented treatment. Changing the paradigm from reactive to proactive early detection and treatment has demonstrated efficacy and is cost-beneficial as recognized by both the federal Substance Abuse and Mental Health Services Administration and the NIMH. The overarching goal is to intervene early, and to improve the client experience in accessing services and in working towards life-long recovery and wellness.

1. Mental Health Services Act – Early Psychosis Intervention Efforts. With the passage of AB 1315 (Mullin), Chapter 414, Statutes of 2017, the Mental Health Services Oversight and Accountability Commission (MHSOAC) has taken steps to further the goal of establishing a program to enhance existing early psychosis programs and to expand the number of programs throughout California. MHSOAC has established the required Advisory Committee to assist the Commission in developing the program, the EPMD fund has been established to receive revenues and the MHSOAC has begun to work with state, local and national leaders on the issue of early psychosis treatment and interventions. As part of that work, MHSOAC has facilitated a multi-county collaborative that has resulted in the commitment of $10 million in public and private funds to support improvements in existing early psychosis programs and the development of a technical assistance, research and evaluation strategy to support those programs.
2. Early Psychosis Research and Treatment Funding. The Governor's proposed 2019-20 Budget includes a one-time augmentation of $25 million (including up to $1 million limited-term resources for state operations) to the California Department of Health Care Services to provide grants to qualified grantees to identify and support appropriate interventions for California youth experiencing the signs of early psychosis. Grantees must utilize grant funds to:
   1. Improve access to youth, young adults and their families who are at risk or experiencing psychotic symptoms or diagnosed with a psychotic disorder;
   2. Demonstrate programmatic effectiveness in client outcomes, including both clinical and non-clinical measures;
   3. Support families with a family member (youth or young adult) with early psychosis or psychotic disorder through education, counseling and case management;
   4. Improve an individual's experience in accessing services and building their capacity to support their own recovery and function;
   5. Describe outreach strategies on identifying and reaching youth, young adults, and impacted families, including a diversity of California populations that reflect different ethnic, sexual orientation, racial, religious, economic status and other marginalized populations;
   6. Demonstrate sustainability for the period after the grant monies have been expended, including a plan for linking patients with ongoing care needs to other public programs such as Medi-Cal; and,
   7. Reduce a youth or young adult's unnecessary hospitalization or interaction with public safety officials such as juvenile hall or jail.

According to the Author:

This bill facilitates the implementation of the EPI Plus program established through AB 1315 of 2017, by removing the original requirement for the inclusion of $500,000 in non-state funding into the EPMD fund before the program could begin and removing the prohibitions against the EPMD receiving General Fund monies. Removing this original funding requirement will allow counties to immediately start receiving funding from existing resources that will allow them to provide essential mental health services to residents.

Arguments in Support:

The Steinberg Institute, states that in 2017, the Governor signed AB 1315 seeking to expand resources for early psychosis intervention and serious mood disorder services. AB 1315 created a first-of-its-kind program in California dedicated to funding evidence-based intervention and treatments that have proven effective in arresting conditions such as schizophrenia, bipolar and other mood disorders before they become disabling. However, the legislation requires that non-state funding must be deposited first into the EPMD fund before implementation of the program. Unfortunately, this requirement has been an impediment to implementation.

Arguments in Opposition:

There is no opposition on file.

FISCAL COMMENTS:

None

VOTES:

ASM HEALTH: 15-0-0

YES: Wood, Mayes, Aguiar-Curry, Bigelow, Bonta, Burke, Carrillo, Flora, Limón, McCarty, Nazarian, Ramos, Rodriguez, Santiago, Waldron

UPDATED:

VERSION: March 28, 2019

CONSULTANT: Judy Babcock / HEALTH / (916) 319-2097 FN: 0000076

Date of Hearing: March 26, 2019

ASSEMBLY COMMITTEE ON HEALTH

Jim Wood, Chair

ABPCA Bill Id:AB 713

Author:(Mullin) – As Introduced Ver:February 19, 2019

SUBJECT: Early Psychosis Intervention Plus (EPI Plus) Program.

SUMMARY: Deletes the requirement that implementation of the Early Psychosis Intervention Plus (EPI Plus) Program be contingent upon deposit of at least $500,000 of non-state funds into the Early Psychosis and Mood Disorder (EPMD) Detection and Intervention Fund (EPMD fund).

EXISTING LAW:

1. Establishes the EPI Plus program to create an early psychosis detection and intervention competitive selection process to expand the provision of high-quality, evidence-based early psychosis detection and intervention services by providing funding to counties.
2. Specifies implementation of EPI Plus program is contingent upon deposit of at least $500,000 of non-state funds and prohibits General Funds from being appropriated in the EPMD fund.
3. Establishes the Mental Health Services Act (MHSA), an initiative measure enacted under Proposition 63 to provide increased funding, personnel and other resources to support county mental health programs and monitor progress toward statewide goals for children, transition age youth, adults, older adults and families. Establishes the Mental Health Services Oversight and Accountability Commission (MHSOAC) to oversee various mental health programs funded by the MHSA.
4. Establishes within the MHSOAC, a 13 member advisory committee to do at a minimum all of the following: provide advice and guidance broadly on approaches to EPMD detection and intervention programs from an evidence-based perspective; review and make recommendations on the MHSOAC’s guidelines or any regulations in the development, design, selection of awards, and the implementation or oversight of the EPI Plus program competitive selection process, as specified; assist and advise the MHSOAC in the overall evaluation of the EPMD detection and intervention competitive selection process; provide advice and guidance as requested and directed by the chair; select a core set of standardized clinical and outcome measures, as specified; and inform funded programs about the potential to participate in clinical research studies.
5. Requires the Department of Health Care Services (DHCS), pursuant to the MHSA and in coordination with counties, to establish a program designed to prevent mental illnesses from becoming severe and disabling and requires the program to emphasize strategies to reduce the following negative outcomes that may result from untreated mental illness:
   1. Suicide;
   2. Incarcerations;
   3. School failure or dropout;
   4. Unemployment;
   5. Prolonged suffering;
   6. Homelessness; and,
   7. Removal of children from their homes.
6. Establishes the California Suicide Prevention Act of 2000 which permits DHCS, upon an appropriation in the annual Budget Act, to establish and implement a suicide prevention, education, and gatekeeper training program to reduce the severity, duration, and incidence of suicidal behaviors for a target population of junior high and high school students, as well as other selected populations known to be at high risk of suicide.
7. Requires the state, through the Department of Social Services and county welfare departments, to establish and support a public system of child welfare services to protect and promote the welfare of children.
8. Establishes Medi-Cal, administered by DHCS, through which eligible low-income individuals receive health care and mental health services, including foster youth and eligible recipients of the Adoption Assistance Program and the Kinship Guardianship Assistance Payment program.
9. Establishes the federal Early and Periodic Screening, Diagnosis and Treatment program to provide comprehensive and preventive health services including specialty mental health services to Medi-Cal beneficiaries under the age of 21.

FISCAL EFFECT: None

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, this bill facilitates the implementation of the EPI Plus program established through AB 1315 (Mullin), Chapter 414, Statutes of 2017, by removing the original requirement for the inclusion of $500,000 in non-state funding into the EPMD fund before the program could begin. This will address an unmet need to provide evidence-based early psychosis detection and mood disorder intervention services and supports to transition-aged youth and young adults who are at-risk of, or experiencing, psychotic symptoms or have psychotic disorders. The author notes removing this original funding requirement will allow counties to immediately start receiving funding from existing resources that will allow them to provide essential mental health services to residents.
2. BACKGROUND. According to the National Institute of Mental Health (NIMH), mental health disorders are common among children in the United States, and can be particularly difficult for the children themselves and their caregivers. While mental disorders are widespread, the main burden of illness is concentrated among those suffering from a seriously debilitating mental illness. Over 20% (or one in five) children, either currently or at some point during their life, have had a seriously debilitating mental disorder. Fifty percent of all mental illness begins by the age of 14 and 75% by the age of 24, yet young people are often reluctant and afraid to seek help. About 100,000 adolescents and young adults experience first episode psychosis each year. Psychosis is a serious mental disorder characterized by a loss of contact with reality. Untreated psychosis increases a person’s risk for suicide, involuntary emergency care, poor clinical outcomes, and can initiate a trajectory of accumulating disability into later adulthood. The average delay between onset of symptoms and intervention is eight to 10 years. New research from the NIMH shows that young people experiencing first episode psychosis have a much higher death rate than previously thought. Researchers analyzed data on approximately 5,000 individuals aged 16-30 with commercial health insurance who had received a new psychosis diagnosis, and followed them for the next 12 months. They found that the group had a mortality rate at least 24 times greater than the same age group in the general population, in the 12 months after the initial psychosis diagnosis.

Clinical research conducted worldwide supports a variety of evidence-based interventions for ameliorating psychotic symptoms and promoting functional recovery-oriented treatment. Changing the paradigm from reactive to proactive early detection and treatment has demonstrated efficacy and is cost-beneficial as recognized by both the federal Substance Abuse and Mental Health Services Administration and the NIMH, as well as independent evaluators. The overarching goal is to intervene early, and to improve the client experience in accessing services and in working towards life-long recovery and wellness.

• 1. MSHA – Early Psychosis Intervention Efforts. With the passage of AB 1315 the MHSOAC has taken steps to further the goal of establishing a program to raise funds to enhance existing early psychosis programs and to expand the number of programs throughout California. MHSOAC has established the required Advisory Committee to assist the Commission in developing the program, the EPMD fund has been established to receive revenues and the MHSOAC has begun to work with state, local and national leaders on the issue of early psychosis treatment and interventions. As part of that work, MHSOAC has facilitated a multi-county collaborative using operational funds and county innovation funding) that has resulted in the commitment of $10 million in public and private funds to support improvements in existing early psychosis programs and the development of a technical assistance, research and evaluation strategy to support those programs. The Universities of California at Davis, San Francisco and San Diego have partnered with MHSOAC on this work. MHSOAC also supports the university partners to connect these efforts with a federally funded strategy to build a national early psychosis data network that can support improved understanding of how best to respond to early psychosis and related mental health needs.
  2. Early Psychosis Research and Treatment Funding. The Governor’s proposed 2019-20 Budget includes a one-time augmentation of $25 million (including up to $1 million limited-term resources for state operations) to DHCS to provide grants to qualified grantees, including but not limited to county mental health plans, nonprofit organizations, behavioral health providers, or academic institutions to identify and support appropriate interventions for California youth experiencing the signs of early psychosis. Grantees must utilize grant funds to:
     1. Improve access to youth, young adults and their families who are at risk or experiencing psychotic symptoms or diagnosed with a psychotic disorder;
     2. Demonstrate programmatic effectiveness in client outcomes, including both clinical and non-clinical measures;
     3. Support families with a family member (youth or young adult) with early psychosis or psychotic disorder through education, counseling and case management;
     4. Improve an individual’s experience in accessing services and building their capacity to support their own recovery and function;
     5. Describe outreach strategies on identifying and reaching youth, young adults, and impacted families, including a diversity of California populations that reflect different ethnic, sexual orientation, racial, religious, economic status and other marginalized populations;
     6. Demonstrate sustainability for the period after the grant monies have been expended, including a plan for linking patients with ongoing care needs to other public programs such as Medi-Cal; and,
     7. Reduce a youth or young adult’s unnecessary hospitalization or interaction with public safety officials such as juvenile hall or jail.

1. SUPPORT. The Steinberg Institute, in support of this bill states that in 2017, the Governor signed AB 1315 seeking to expand resources for early psychosis intervention and serious mood disorder services. AB 1315 created a first-of-its-kind program in California dedicated to funding evidence-based intervention and treatments that have proven effective in arresting conditions such as schizophrenia, bipolar and other mood disorders before they become disabling. However, the legislation requires that non-state funding must be deposited first into the EPMD fund before implementation of the program. Unfortunately, this requirement has been an impediment to implementation. This bill simply allows the deposit of both private and public funds into the EPMD fund so that counties are able to scale up evidence-based early psychosis services across the state.
2. RELATED LEGISLATION.
   1. AB 895 (Muratsuchi) revises the School-Based Early Mental Health Intervention and Prevention Services for Children Act of 1991 to award grants rather than matching grants. Expands the definition of an eligible pupil to include a pupil who attends a preschool program at a contracting agency of the California state preschool program or a local educational agency, and a pupil who is in transitional kindergarten, and also includes charter schools. Requires implementation of the program to be contingent upon an appropriation in the annual Budget Act. AB 895 is double referred and upon passage in the Assembly Education Committee, will be referred to the Assembly Committee on Health.
   2. AB 916 (Muratsuchi) requires that the target populations identified in the California Suicide Prevention Act of 2000 be expanded to include community college, four-year College, and university undergraduate and graduate students for purposes of public awareness and education campaign on suicide prevention and treatment. AB 916 is pending in Assembly Health Committee.
   3. SB 10 (Beall) requires DHCS to establish, no later than July 1, 2020, a statewide peer, parent, transition-age, and family support specialist certification program, as a part of the state’s comprehensive mental health and substance use disorder delivery system and the Medi-Cal program. Requires four certification categories: adult peer support specialist, transition-age youth peer support specialist, family peer support specialist, and parent peer support specialist. SB 10 is pending in the Senate Health Committee.
   4. SB 12 (Beall) requires the MHSOAC, subject to the availability of funds to administer an Integrated Youth Mental Health Program for purposes of establishing local centers to provide integrated youth mental health services, as specified. Authorize MHSOAC to establish the core components of the program, subject to specified criteria, and to develop the selection criteria and process for awarding funding to local entities for these purposes. SB 12 is pending in the Senate Health Committee.
   5. SB 428 (Pan) requires an applicant for a clear multiple or single subject teaching credential to complete a course in youth mental health first aid. Authorize a teacher to provide youth mental health first aid to pupils, and would prohibit a teacher who provides youth mental health first aid from being held liable for any civil damages as a result of providing it. AB 428 is pending in the Senate Health Committee.
3. PREVIOUS LEGISLATION.
   1. AB 917 (Arambula) would have required the Board of Governors of the California Community Colleges and the Trustees of the California State University, and encourages the Regents of the University of California, to adopt policies on student suicide prevention. AB 971 was held in Assembly Appropriations.
   2. AB 1315 establishes the EPI Plus program to create an early psychosis detection and intervention competitive selection process to expand the provision of high-quality, evidence-based early psychosis detection and intervention services by providing funding to counties.
   3. AB 1372 (Levine) would have authorized a crisis stabilization unit designated by a mental health plan (MHP), at the discretion of the MHP, to provide medically necessary crisis stabilization services to individuals beyond the service time of 24 hours in those cases in which the individual needs inpatient psychiatric care or outpatient care and crisis stabilization beds or outpatient services are not reasonably available, as specified. AB 1372 was held on the Senate Floor.
4. AUTHOR’S AMENDMENTS: In order to meet the intent of this bill to allow the EPMD fund to receive both public and private funding, the author offers amendments to delete the existing prohibition against monies from the General Fund being appropriated to the EPMD fund.

REGISTERED SUPPORT / OPPOSITION:

Support

Mental Health Services Oversight and Accountability Commission

Children's Defense Fund-California
Steinberg Institute

Opposition

None on file.

Analysis Prepared by: Judth Babcock / HEALTH / (916) 319-2097