Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.

This bill would prohibit a participating entity of a closed-loop referral system (CLRS) from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration. consideration, except as specified. The bill would further prohibit a participating entity from using social care information stored in, or transmitted through, a CLRS for any purpose or purposes other than the social care purpose or purposes for which that social care information was collected or generated, except as specified. The bill would define social care to mean any care, services, goods, or supplies related to an individuals social needs, including, but not limited to, support and assistance for an individuals food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety. The bill would also define social care information to mean any information, in any form, that relates to the need for, payment for, or provision of, social care, and the individuals personal information, as specified.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.

This bill would prohibit a participating entity of a closed-loop referral system (CLRS) from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration. The bill would further prohibit a participating entity from using social care information stored in, or transmitted through, a CLRS for any purpose or purposes other than the social care purpose or purposes for which that social care information was collected or generated, except as specified. The bill would define social care to mean any care, services, goods, or supplies related to an individuals social needs, including, but not limited to, support and assistance for an individuals food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety. The bill would also define social care information to mean any information, in any form, that relates to the need for, payment for, or provision of, social care, and the individuals personal information, as specified.

Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes certain requirements relating to the provision of health insurance, including provisions relating to the confidentiality of health records. Existing state law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as provided.

This bill would, among other things, prohibit a participating organization of a closed-loop referral system (CLRS) from adding to, or accessing from, a CLRS an individuals personally identifiable information or social care information unless specified requirements are met, including that the individual provides consent. The bill would require a participating organization to have policies and controls in place defining staff roles necessary for the referral and provision of services and for the purpose of providing care coordination, as specified. would prohibit a participating entity of a closed-loop referral system (CLRS) from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration. The bill would further prohibit a participating entity from using social care information stored in, or transmitted through, a CLRS for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as specified. The bill would define social care to mean any care, services, goods, or supplies related to an individuals social needs, including, but not limited to, support and assistance for an individuals food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety. The bill would also define social care information to mean any information, in any form, that relates to the need for, payment for, or provision of, social care. social care, and the individuals personal information, as specified.

Existing law, the Local Agency Public Construction Act, sets forth the requirements for competitive bidding on various types of contracts awarded by local agencies. The act authorizes the 2nd lowest bidder to bring an action in superior court if the 2nd lowest bidder suffers damages as a result of the successful bidders violation of specified laws, but prohibits the action if the 2nd lowest bidder has been convicted of a violation of specified labor laws or unemployment insurance laws within one year prior to fulfilling the bid for public work and has failed to take affirmative steps to correct the violation.

This bill would make nonsubstantive changes to those provisions.

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

AB 1011 (Weber) - Social care: data privacy

Bill Summary:

AB 1011 would prohibit an entity participating in a closed-loop referral system (CLRS) from selling social care information and prohibit using the information for purposes other than those for which it was collected, except as provided.

Fiscal Impact:

One-time costs of approximately $1.25 million to the Center for Data Insights and Innovation (CDII) within the Health and Human Services Agency (HHS) (General Fund). See Staff Comments for additional detail.

Background:

Closed-loop referrals provide a means for healthcare professionals to send patient information to a community-based organization (CBO) to help address a patient’s needs that are typically better served outside of the clinical setting. A CBO can provide an array of different support programs within the community, including services that address a patient's social needs or address underlying causes of poor health outcomes with the goal of positively impacting the patient’s overall health outcomes. The CBO can then provide feedback on the outcome of that referral back to the referring individual/entity. CLRS allow for providers of services to specific populations to connect their clients to various services and goods within a network of fellow providers. As technology enhances this intercommunication between providers, concerns have arisen about the privacy of the sensitive information being exchanged.

The DxF is a statewide data sharing agreement that will accelerate and expand the exchange of health information among health care entities, government agencies, and social service programs beginning in 2024. To date, hundreds of experts and members of the public have worked to establish the DxF with the goal of every sharing information privately and securely among health and human services providers.

Proposed Law:

• Prohibits an participating entity in a CLRS from doing either of the following, except as specified by Federal Law:
  • Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a closed-loop referral system in exchange for monetary or other valuable consideration.
  • Using social care information stored in, or transmitted through, a closed-loop referral system for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated.
• Defines terms for purposes of the bill including “CLRS,” “participating entity,” and “social care information.”

Staff Comments:

According to CDII, approximately $1 million will be required to review and reconfigure the DxF to comply with AB 1011. CDII reports that it would need to re-establish rules for health, social services, and government entities on how to address the limitations on use of social services information. These rules would necessitate consideration of how information covered by this bill would be compartmentalized or flagged to ensure that the limitations on its use are complied with. This may require legal research, IT subject matter expertise, and policy work with stakeholders to understand the limitations on use of health and social services data within a closed loop system to determine whether this information can be legally shared and used in an efficient manner with all entities that have signed onto the HHS DxF Data Sharing Agreement. CDII’s reports that an additional $250,000 would be required to update the State Health Information Guide which health and social services entities use to understand the many laws that cover health and social services information and how to exchange this information legally and appropriately.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 1011 (Author:Weber)

Version: April 27, 2023

Hearing Date: June 27, 2023

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Social care: data privacy

DIGEST

This bill prohibits participating entities in a closed-loop referral system from selling social care information, as defined, and prohibits using the information for purposes other than the purposes for which it was collected, except as provided.

EXECUTIVE SUMMARY

Coordination of care for target populations is not a new concept. The idea being that information sharing within a contained system to identify and serve all the needs of those being served is an efficient and holistic way of carrying out the mission, whether this involves services for students or unhoused individuals or other populations.

With advances in technology, these closed-referral systems are becoming streamlined on platforms and networks that increase efficiencies, but as often is the case, bring some concerns regarding the privacy of those whose information is being shared.

This bill regulates “closed-loop referral systems” (CLRS), which are defined as technology platforms or networks that store and enable the sharing of social care information between “participating entities” for the purpose of referring individuals for social care and to track progress and outcomes of those referrals. “Social care” is defined as care, services, goods, or supplies related to an individual’s social needs.

Responding to privacy concerns about the data being shared within these CLRS, the bill prohibits the selling of social care information, as defined, and prohibits using the information for purposes other than the purposes for which it was collected, as provided. This bill is sponsored by Findhelp. It is opposed by several organizations, including Unite Us.

PROPOSED CHANGES TO THE LAW

Existing federal law:

1. Establishes the Health Insurance Portability and Accountability Act (HIPAA), which provides privacy protections for patients’ protected health information and generally prohibits a covered entity, as defined (health plan, health care provider, and health care clearing house), from using or disclosing protected health information except as specified or as authorized by the patient in writing. (45 C.F.R. § 164.500 et seq.)
2. Provides that if HIPAA’s provisions conflict with a provision of state law, the provision that is the most protective of patient privacy prevails. (45 C.F.R. § 164.500 et seq.)

Existing state law:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy. (Cal. Const., art. I, § 1.)
2. Establishes the CMIA, which establishes protections for the use of medical information. (Civ. Code § 56 et seq.)
3. Prohibits providers of health care, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10.)
4. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
5. Defines “personal information” pursuant to the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of that information, as provided. (Civ. Code §§ 1798.120-1798.121.)
7. Defines “selling” for purposes of the CCPA as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration. (Civ. Code § 1798.140(ad).)
8. Provides that a county may establish a homeless adult and family multidisciplinary personnel team (homeless MPT) to facilitate expedited identification, assessment, and linkage of homeless individuals to housing and supportive services within that county and to allow provider agencies to share confidential information for the purpose of coordinating housing and supportive services to ensure continuity of care. (Welf. & Inst. Code § 18999.8.)
9. Authorizes homeless MPT members engaged in the identification, assessment, and linkage of housing and supportive services to homeless adults or families to disclose to, and exchange with one another, information and writings that relate to any information that may be designated as confidential under state law if the member believes it is generally relevant to the identification, reduction, or elimination of homelessness or the provision of services. Designates any discussion relating to this information as confidential and inadmissible in court proceedings. Establishes clear and stringent information sharing protocols for MPTs. (Welf. & Inst. Code § 18999.8.)

This bill:

1. Prohibits a participating entity from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a closed-loop referral system in exchange for monetary or other valuable consideration.
2. Prohibits a participating entity from using social care information stored in, or transmitted through, a closed-loop referral system for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as required by federal law or as authorized or required by state law.

COMMENTS

1. Stated intent of the bill

According to the author:

Many of these social care networks use a new type of technology platform called a closed loop referral system, which allows organizations to seamlessly share information so that people in need are able to receive all the appropriate services available to them, allows social care and social services providers to send and receive referrals to each other and track outcomes of the care people receive.

This highly-personal information deserves a thoughtful and deliberate governance structure that will ensure the privacy of people going through difficult times. Because it is relatively new, there is currently no regulation of privacy in the social care information space specifically.

This bill addresses social care privacy by defining a “closed-loop referral system.” Closed loop referral systems have become the place where many social care providers create and transmit data, and therefore are an appropriate place to start regulating privacy in this space. This also allows us to regulate this data without putting undue burdens directly on the social care providers and nonprofits that were exempted from CCPA for a good reason.

1. Ensuring the privacy of clients in closed-loop referral systems

Closed-loop referral systems allow for providers of services to specific populations to connect their clients to various services and goods within a network of fellow providers. As technology enhances this intercommunication between providers, concerns have arisen about the privacy of the sensitive information being exchanged.

The bill seeks to be the first to regulate CLRS, which it defines as a technology platform or network that does all of the following:

• stores the social care information of one or more individuals;
• enables the sharing of social care information with and between participating entities for the purpose of referring individuals for social care; and
• provides information to participating entities regarding the progress and outcomes of referrals for social care.

“Social care” is defined as care, services, goods, or supplies related to an individual’s social needs. This includes support and assistance for an individual’s food, housing, transportation, economic stability, employment, education access, childcare and family relationship needs, and environmental and physical safety.

“Participating entities” are those that provide social care or refer individuals for social care and who have the ability to create, receive, or update social care information and referrals in a CLRS. It specifically includes examples of who may qualify as a participating entity: a public agency, nonprofit organization, charitable organization, provider of health care, health care service plan, or CLRS technology vendor.

The bill imposes two main privacy safeguards. The first is a prohibition preventing a participating entity from selling social care information. The CCPA provides a host of privacy rights for consumers and obligations on businesses, but many of the entities involved in these CLRS are not considered “businesses” and therefore are not subject to the CCPA. However, the bill borrows language from the CCPA for what is considered selling, namely: selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration.

The second safeguard is that a participating entity is prohibited from using social care information stored in, or transmitted through, a closed-loop referral system for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as provided.

These safeguards are intended to protect the information and ensure it is only used for the benefit of the individual clients to whom the information pertains. Bolstering the protection is the broad definition of “social care information,” which includes any information, in any form, that relates to the need for, payment for, or provision of, social care to the individual, as well as the individual’s personal information. The bill again directly borrows from the CCPA by cross-referencing its definition of “personal information.”

Some concerns have been raised that the use limitations laid out in the bill are not completely clear and may not provide the level of protection intended. To address these concerns, the author has agreed to amendments that limit the uses to only “social care purposes” to avoid doubt about the universe of purposes that are valid.

Additionally, the bill excepts from this limitation uses that are (1) required by federal or state law and (2) authorized by state law. While the former exception is straightforward, the latter seems to allow for this private information to be used in a variety of ways that seem to undermine the protections of the bill. The author has agreed to an amendment removing that specific exception.

Amendment

Amend Section 61(b) to read: “A participating entity shall not use social care information stored in, or transmitted through, a closed-loop referral system for any purpose or purposes other than the social care purpose or purposes for which that social care information was collected or generated, except as required by federal or state law.”

As discussed, there are other privacy laws that may apply to the data collected and shared through these CLRS. In order to ensure that this does not absolve any persons or entities from the obligations of other laws, the author has agreed to add a provision making that clear:

Amendment

Add: “Nothing in this part affects any obligations imposed by other applicable laws.”

Writing in support, Findhelp, the sponsor of the bill, makes the case:

Findhelp believes that privacy in social care is a vital issue to address through legislation. We believe that consumers must be in control of their personal information, and without guardrails around data privacy, many are left vulnerable at the whims of an unregulated industry and rogue vendors. AB 1011 addresses consumer privacy concerns specifically for organizations and consumers who use what is known as a ‘closed-loop referral system’, or CLRS. A closed-loop referral system is a technology platform that is used by constituents, healthcare entities, public agencies, and community-based organizations to streamline the coordination of care between health care and social care, and to send and receive referrals through a coordinated network.

1. Existing models with more stringent privacy protections

Regulating these types of interconnected groups of providers is not unprecedented in California law. For instance, California has clear legal structures around multidisciplinary personnel teams (MPT) that share information in order to serve certain vulnerable populations. As an example, existing law authorizes each county to establish a homeless adult and family multidisciplinary personnel team to facilitate expedited identification, assessment, and linkage of homeless individuals to housing and supportive services within that county and to allow provider agencies to share confidential information for the purpose of coordinating housing and supportive services to ensure continuity of care. (Welf. & Inst. Code § 18999.8.) These teams can include a wide variety of participating entities, including:

• mental health and substance abuse services personnel and practitioners or other trained counseling personnel;
• police officers, probation officers, or other law enforcement agents;
• legal counsel;
• medical personnel with training to provide health services;
• social services workers;
• case managers or case coordinators responsible for referral, linkage, or coordination of care and services provided to adults or families;
• veterans services providers and counselors;
• domestic violence victim service organizations;
• teachers; and
• housing or homeless services provider agencies.

Relevant here, there are explicit guidelines for how personal information about these clients can be shared and strict parameters on what it can be used for. Homeless MPT members can disclose to, and exchange with one another, information and writings that relate to any information that may be designated as confidential under state law if the member believes it is generally relevant to the identification, reduction, or elimination of homelessness or the provision of services. However, requirements are imposed that govern training and retention, protection, and destruction of the information. Every member of a homeless MPT who receives information or records regarding adults and families in their capacity as a member of the team is subject to the same privacy and confidentiality obligations and the same confidentiality penalties as the person disclosing or providing the information or records. Information or records obtained must be maintained in a manner that ensures the maximum protection of privacy and confidentiality rights. Additionally, civil and criminal penalties apply to the inappropriate disclosure of information held by the team members.

This bill takes the first step in placing some guardrails around the information that is being shared within CLRS.

1. Opposition

Writing in opposition, Unite Us writes:

As currently drafted, AB 1011 imposes unreasonable burdens on individuals seeking care — requiring them to re-tell their story to each provider from which they seek services, even after they have expressly consented to sharing information with their providers. This is not a trauma-informed approach to supporting individuals seeking services, and it contradicts best practices adopted by social care providers. Our focus on advancing care coordination to reduce the burdens on individuals seeking care and improve health outcomes closely aligns with California’s policy goals as well as recent proposed rules by the HHS Office of Civil Rights.

As drafted, this legislation will place burdensome requirements on all “public agencies, nonprofit organizations, charitable organizations, CLRS technology vendors, and other entities that provide social care” in the state. These organizations already must comply with myriad federal and state privacy laws, including HIPAA, CCPA, CPRA, 42 CFR Part 2, FERPA, VAWA, and VOCA. By adding to the burdens these organizations face—many of whom are resource-constrained nonprofits and CBOs—AB 1011 would prevent Californians from accessing the social care services they need.

SUPPORT

Findhelp (sponsor)

OPPOSITION

Infant/Child Enrichment Services

SCHIO

Unite Us

RELATED LEGISLATION

Pending Legislation:

SB 603 (Rubio, 2023) creates a process and standards for the release of recordings of interviews taken by a children’s advocacy center in the course of an investigation of a case of abuse. The children’s advocacy center or other identified multidisciplinary team member custodian shall ensure that all recordings of child forensic interviews be released only in response to a court order. This bill is currently in the Assembly Public Safety Committee.

AB 1194 (Wendy Carrillo, 2023) provides stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services. AB 1194 is in the Senate Appropriations Committee.

Prior Legislation:

SB 1342 (Bates, Ch. 621, Stats. 2022) allowed a county or Area Agency on Aging to establish an aging multidisciplinary team with the goal of facilitating the expedited identification, assessment, and linkage of older adults to services, and allowed provider agencies and members of the MDT to share confidential information for the purposes of coordinating services. It required a county or agency that establishes an aging MDT to adhere to a number of protocols surrounding the privacy, security, and confidentiality of the information and records shared.

AB 728 (Santiago, Ch. 337, Stats. 2017) created a five-year pilot program in the counties of Los Angeles, Orange, Riverside, San Bernardino, San Diego, Santa Clara, and Ventura that allows those counties to expand the scope of a homeless adult and family multidisciplinary teams to include serving individuals who are at risk of homeless.

AB 210 (Santiago, Ch. 544, Stats. 2017) allowed counties to develop homeless adult and family multidisciplinary teams in order to facilitate identification and assessment of homeless individuals, and link homeless individuals to housing and supportive services, and to allow service providers to share confidential information to ensure continuity of care.

PRIOR VOTES:

Assembly Floor (Ayes 74, Noes 0)

Assembly Appropriations Committee (Ayes 15, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

ASSEMBLY THIRD READING

ATR Bill Id:AB 1011

Author:(Weber)

As Amended Ver:April 27, 2023

Majority vote

SUMMARY

Defines a closed-loop referral system (CLRS). Prohibits the sale of information about an individual that a participating entity obtains from a CLRS. Requires that such information be used only for the purposes for which it was collected and generated.

Major Provisions

1. Defines the following terms:
   1. "Closed-loop referral system" or "CLRS" means a technology platform or network that does all of the following: i) stores the social care information of one or more individuals; ii) enables the sharing of social care information with and between participating entities for the purpose of referring individuals for social care; and iii) provides information to participating entities regarding the progress and outcomes of referrals for social care.
   2. "Social care" means care, services, goods, or supplies related to an individual's social needs. The term includes, but is not limited to, support and assistance for an individual's food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety.
   3. "Social care information" means both of the following regarding an individual: i)any information, in any form, that relates to the need for, payment for, or provision of, social care; and ii)an individual's personal information, as that term is defined under the California Consumer Privacy Act.
   4. "Participating organization" means an entity that meets all of the following requirements: i)provides social care or refers individuals for social care, including, but not limited to, a public agency, nonprofit organization, charitable organization, provider of health care, health care service plan, or CLRS technology vendor; and ii)has the ability to create, receive, or update social care information and referrals for social care in a CLRS.
2. Prohibits a participating entity from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration.
3. Prohibits a participating organization from using social care information stored in or transmitted through a CLRS for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as required by federal law, or as authorized or required by state law.

COMMENTS

Background. This bill would codify the concept of a "closed-loop referral system" (CLRS) and put into place baseline privacy protections for individuals' data that is shared on a CLRS.

A closed-loop referral system generally works as follows. Say, for example, that a domestic violence survivor, having escaped their abuser, goes to a nonprofit housing provider for help in finding a place to live. During the initial intake interview, the housing provider determines that the survivor is also in need of mental health services, legal aid, and food assistance. All of these needs—housing, mental health services, legal aid, and food assistance—fall under the bill's definition of "social care."

If the housing provider participates in a closed-loop referral system, it can then share information on the CLRS about the survivor, including a description of the survivor's social care needs and the survivor's contact information, among a network of other providers. Under the bill, the information being shared falls under the definition of "social care information"; the housing provider, the CLRS operator, and other participants on the CLRS fall under the definition of "participating entity."

Other participating entities on the CLRS will receive the survivor's social care information. If one of these entities determines it is able to help the survivor with one of the survivor's social care needs, it can contact the survivor using the information provided on the CLRS. If the survivor accepts the offer of assistance, the participating entity can make this fact known on the CLRS. Doing so "closes the loop" on that portion of the referral and ensures that (i)the referring organization knows one of the survivor's needs is being addressed, and (ii)the referral for addressing that need does not remain open on the network, allowing providers to focus on others’ needs.

As explained by the bill's sponsor, Findhelp, a public benefit corporation: "A closed-loop referral system is a technology platform that is used by [individuals in need], and a network of healthcare entities, public agencies, and community based organizations to streamline the coordination of care between health care and social care, and to send and receive referrals through a coordinated network."

What the bill does. This bill provides a definition of "closed-loop referral system" and puts into place basic, essential privacy standards for data shared on a CLRS.

The bill would prohibit a participating organization from selling or otherwise sharing an individual's social care information for money if the information was stored or transmitted through a CLRS.

The bill would also impose a "data minimization" requirement: an individual's social care information stored or transmitted through a CLRS can only be used for the purpose of meeting the individual’s social care needs, except as otherwise authorized or required by law.

Analysis. Barring sale of social care information and requiring data minimization with respect to social care information appear to be reasonable baseline standards for data shared through a CLRS. Putting these standards into law alleviates any fear a vulnerable individual might have that highly-sensitive information about their needs might fall into others' hands. Such protections are necessary because there is no way of knowing, before an individual's social care information is shared, what privacy laws might apply to a participating entity in a CLRS that receives the information.

It is critical to understand that closed-loop referral systems are operating in California right now. Absent this bill, participating organizations not subject to other privacy laws (such as the Confidentiality of Medical Information Act (CMIA) or the CCPA) are free to do as they wish with social care information they receive on closed-loop referral systems. This is particularly true of smaller and/or nonprofit technology vendors that may not fall under the CCPA definition of “business.” The selling of sensitive information about Californians' vulnerabilities obtained on a CLRS might be occurring right now, and it all may be perfectly legal.

Opposition argument. One opposition argument calls for a response. Unite Us, which describes itself as "the nation's leading software company bringing sectors together to improve the health and well-being of communities, "criticizes this measure as" a platform-specific bill that rejects the individual rights-based approach taken by the CCPA and CPRA[,]" i.e., the California Consumer Privacy Act.

Declining to adopt a CCPA-style consent model for sale of data is a deliberate policy choice in this bill. A person seeking social care from a participating organization in a CLRS should be able to expect that the information they are sharing will not be sold and will only be used to refer them for, and provide them with, social care. A person seeking social care is not in the position of, say, a person who opens a Google account in order to use Gmail and Google Docs. The former is likely in a highly vulnerable state. They do not expect, nor should they, that the information they are providing about themselves and their needs could be sold or used for purposes other than providing them with necessary care. They are exceedingly unlikely to know that in order to safeguard the privacy of the information they have shared, they may have to contact various entities to request that their data not be sold, that it be deleted, and so forth. By contrast, the new Google user is almost certainly aware that Google is going to collect, use, and sell the data it collects from their use of Gmail and Google Docs; if they are a Californian, there is a good chance they will also know that they have CCPA privacy rights they can exercise to restrict Google's use of their data. The two situations are not comparable.

According to the Author

By defining and creating protections for social care privacy specifically, this bill fills in the existing gap in California's privacy laws. The guardrails and regulations created in this AB 1011 provide individuals legal protections over their sensitive social care privacy [information].

Arguments in Support

Findhelp, the bill's sponsor, writes:

Strong privacy protections already exist that guide appropriate sharing of medical information under HIPAA and California's Confidentiality of Medical Information Act (CMIA). Additional consumer protections are covered by the California Consumer Privacy Act (CCPA). Unfortunately, there are no state or federal privacy protections that apply to social care information housed in closed-loop referral systems, leaving a growing number of consumers vulnerable.

Arguments in Opposition

Unite Us, a software company that operates in the social care space, writes:

AB 1011 runs counter to California's existing legal frameworks. It is a platform-specific bill that rejects the individual rights-based approach taken by the CCPA and [the California Privacy Rights Act].

FISCAL COMMENTS

No state costs.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-1

YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Mike Fong, Hart, Lowenthal, Mathis, Papan, Pellerin, Robert Rivas, Sanchez, Weber, Ortega

ABS, ABST OR NV: Dixon

UPDATED

VERSION: April 27, 2023

CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0000407

Date of Hearing: May 17, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 1011

Author:(Weber) – As Amended Ver:April 27, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill prohibits a “participating entity” from selling or exchanging “social care information” that is stored in or transmitted through a “closed-loop referral system.” The bill also prohibits the use of such information for any purpose other than the purpose for which that information was collected or generated.

The bill defines the following terms:

1. Social care information to mean any information, in any form, that relates to the need for, payment for, or provision of care, services, goods or supplies related to an individual’s social needs, such as support and assistance for an individual’s food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety.
2. Closed-loop referral system, or “CLRS,” as a technology platform or network that does all of the following: (a) stores the social care information of one or more individuals, (b) enables the sharing of social care information with and between participating entities for the purpose of referring individuals for social care, (c) provides information to participating entities regarding the progress and outcomes of referrals for social care.
3. Participating entity to mean an entity that meets all of the following: (a) provides social care or refers individuals for social care, including a public agency, nonprofit organization, charitable organization, provider of health care, health care service plan or CLRS technology vendor; (b) has the ability to create, receive or update social care information in a CLRS; and (c) has the ability to create, receive or update referrals for social care in a CLRS.

FISCAL EFFECT:

No state costs.

COMMENTS:

Existing law protects the confidentiality of personal information through the California Consumer Privacy Act and healthcare-related information through the federal Health Information Portability and Accountability Act and California’s Confidentiality of Medical Information Act. The author asserts there is a “gap” in the laws that protect the privacy of sensitive information and intends this bill to fill in that gap. The bill sponsor, Findhelp—a social care referral technology company that describes its mission as connecting all people in need with the programs that serve them with dignity and ease—contends “there are no state or federal privacy protections that apply to social care information housed in closed-loop referral systems.” Findhelp intends this bill to “ensure that self-navigation referrals remain private to the individual and the organization receiving the referral, and that there is consumer-directed control of who gets to see their private information as part of the referral process.”

Analysis Prepared by: Jay Dickenson / APPR. / (916) 319-2081

Date of Hearing: April 25, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 1011 (

Author:Weber) – As Amended Ver:March 16, 2023

As Proposed to be Amended

SUBJECT: Social care: data privacy

SYNOPSIS

This bill would codify the concept of a “closed-loop referral system” (CLRS) and put into place baseline privacy protections for vulnerable individuals’ data that is shared on a CLRS. A closed-loop referral system allows a participating entity, such as a health care provider, social services agency, or nonprofit, to share referral information about a client’s social needs, such as for housing, mental health care, or food assistance, on a computer network. Other entities participating in the CLRS can receive and review the referral information; if one of these entities determines that it can assist the client in meeting one or more of the client’s needs, the entity can update the referral to indicate it is assisting the individual with this issue, thereby “closing the loop” on the referral.

As currently in print, this bill would have established a comprehensive protocol to obtain a person’s informed consent for sharing their information each time a referral was made on a CLRS and each time a participating entity indicated that it might be able to assist the person. This protocol proved controversial; bill opponents argued that the steps required would be burdensome and interfere with the provision of care.

In response, committee amendments propose to amend the bill substantially, while still furthering the author’s goal of protecting individuals’ privacy. As amended, the bill would (i) forbid participating entities from selling information about a person obtained from a CLRS and (ii) require that any such information be used only for the purposes it was collected for, i.e., to provide care to the person. These appear to be baseline standards that ought to be the norm when providing health and other social services; certainly, an individual seeking housing, mental health care, or food does not expect that information about their needs could be sold or used for purposes other than assisting them.

SUMMARY: Defines a closed-loop referral system (CLRS). Prohibits the sale of information about an individual that a participating entity obtains from a CLRS. Requires that such information be used only for the purposes for which it was collected and generated. Specifically, this bill:

1. Defines the following terms:
   1. “Closed-loop referral system” or “CLRS” means a technology platform or network that does all of the following:
      1. Stores the social care information of one or more individuals.
      2. Enables the sharing of social care information with and between participating entities for the purpose of referring individuals for social care.
      3. Provides information to participating entities regarding the progress and outcomes of referrals for social care.
   2. “Social care” means care, services, goods, or supplies related to an individual’s social needs. The term includes, but is not limited to, support and assistance for an individual’s food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety.
   3. “Social care information” means both of the following regarding an individual:
      1. Any information, in any form, that relates to the need for, payment for, or provision of, social care.
      2. An individual’s personal information, as that term is defined under the California Consumer Privacy Act.
   4. “Participating organization” means an entity that meets all of the following requirements:
      1. Provides social care or refers individuals for social care, including, but not limited to, a public agency, nonprofit organization, charitable organization, provider of health care, health care service plan, or CLRS technology vendor.
      2. Has the ability to create, receive, or update social care information in a CLRS.
      3. Has the ability to create, receive, or update referrals for social care in a CLRS.
2. Prohibits a participating entity from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a closed-loop referral system in exchange for monetary or other valuable consideration.
3. Prohibits a participating organization from using social care information stored in or transmitted through a closed-loop referral system for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as required by federal law, or as authorized or required by state law.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
2. Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
3. Defines “personal information” under the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
   1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
   2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
   3. Biometric information.
   4. Internet activity information, including browsing history and search history.
   5. Geolocation data.
   6. Professional or employment-related information. (Civ. Code § 1798.140(v).)
4. Defines “consumer” as a natural person who is a California resident. (Civ. Code § 1798.140(i).)
5. Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Sale of the personal information of a consumer below the age of 16 is barred unless the minor opts-in to its sale.) (Civ. Code § 1798.120.)
   5. The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
   6. The right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services. (Civ. Code § 1798.121.(a))
6. Provides that the CCPA applies to any for-profit entity that collects consumers’ personal information, does business in California, and meets one or more of the following criteria:
   1. It had gross annual revenue of over $25 million in the previous calendar year.
   2. It buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices annually.
   3. It derives 50% or more of its annual revenue from selling California residents’ personal information. (Civ. Code § 1798.140(d).)
7. Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
8. Prohibits, under the state Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Background. This bill would codify the concept of a “closed-loop referral system” (CLRS) and put into place baseline privacy protections for individuals’ data that is shared on a CLRS.

A closed-loop referral system generally works as follows. Say, for example, that a domestic violence survivor, having escaped their abuser, goes to a nonprofit housing provider for help in finding a place to live. During the initial intake interview, the housing provider determines that the survivor is also in need of mental health services, legal aid, and food assistance. All of these needs—housing, mental health services, legal aid, and food assistance—fall under the bill’s definition of “social care.”

If the housing provider participates in a closed-loop referral system, it can then share information on the CLRS about the survivor, including a description of the survivor’s social care needs and the survivor’s contact information, among a network of other providers. Under the bill, the information being shared falls under the definition of “social care information”; the housing provider, the CLRS operator, and other participants on the CLRS fall under the definition of “participating entity.”

Other participating entities on the CLRS will receive the survivor’s social care information. If one of these entities determines it is able to help the survivor with one of the survivor’s social care needs, it can contact the survivor using the information provided on the CLRS. If the survivor accepts the offer of assistance, the participating entity can make this fact known on the CLRS. Doing so “closes the loop” on that portion of the referral and ensures that (i) the referring organization knows one of the survivor’s needs is being addressed, and (ii) the referral for addressing that need does not remain open on the network, allowing providers to focus on others’ needs.

As explained by the bill’s sponsor, Findhelp, a public benefit corporation: “A closed-loop referral system is a technology platform that is used by [individuals in need], and a network of healthcare entities, public agencies, and community based organizations to streamline the coordination of care between health care and social care, and to send and receive referrals through a coordinated network.”

2) Author’s statement. According to the author:

By defining and creating protections for social care privacy specifically, this bill fills in the existing gap in California’s privacy laws. The guardrails and regulations created in this AB 1011 provide individuals legal protections over their sensitive social care privacy [information].

3) Why the bill is being amended. As referred to this Committee, the bill would have established a comprehensive set of standards to regulate closed-loop referral systems, including requiring an individual to consent every time their information was shared on a CLRS and every time a participating entity sought to access it. Other social service providers protested that these consent requirements were overly burdensome and would interfere with the provision of care. For example, California 211 Providers Network wrote: “Requiring client consent for each referral instance would have a significant fiscal and capacity impact on 211 providers[.]” Health Center Partners of Southern California contended that repeatedly asking for consent might impair care, writing: “Consent protocols are essential for protecting patient privacy and creating shared understanding for the patient and provider. However, when patients are asked multiple times what appears to be same question they’ve previously answered, the therapeutic alliance can be negatively impacted and patient-centered becomes process-centered care. Administrative barriers then become access issues that negatively impact patient outcomes.”

In response to these concerns, the bill will be amended to remove the controversial consent provisions. As amended, the bill will only provide a definition of “closed-loop referral system” and put into place basic, essential privacy standards for data shared on a CLRS.

4) Committee amendments—replacing controversial consent provisions with essential privacy protections. Committee amendments would delete the existing provisions of the bill and replace it with the following provisions, which are reflected in the SUMMARY above:

Civil Code ###. (a) For purposes of this section, all of the following definitions apply:

1. “Closed-loop Referral System” or “CLRS” means a technology platform or network that does all of the following
   1. Stores the social care information of one or more individuals.
   2. Enables the sharing of social care information with and between participating entities for the purpose of referring individuals for social care.
   3. Provides information to participating entities regarding the progress and outcomes of referrals for social care.
2. “Participating entity” means an entity that:
   1. Provides social care or refers individuals for social care, including, but not limited to, a public agency, nonprofit organization, charitable organization, provider of health care, health care service plan, or CLRS technology vendor.
   2. Has the ability to create, receive, or update social care information in a CLRS.
   3. Has the ability to create, receive, or update referrals for social care in a CLRS.
3. “Social care” means care, services, goods, or supplies related to an individual’s social needs. “Social care” includes, but is not limited to, support and assistance for an individual’s food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, childcare and family relationship needs, and environmental and physical safety.
4. “Social care information” means both of the following regarding an individual:
   1. Any information, in any form, that relates to the need for, payment for, or provision of, social care to the individual.
   2. The individual’s personal information, as that term is defined in subdivision (v) of Section 1798.140 of the Civil Code.

(b) A participating entity shall not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, social care information stored in or transmitted through a closed-loop referral system in exchange for monetary or other valuable consideration.

(c) A participating entity shall not use social care information stored in or transmitted through a closed-loop referral system for any purpose or purposes other than the purpose or purposes for which that social care information was collected or generated, except as required by federal law, or as authorized or required by state law.

Subdivision (b) bars a participating organization from selling or otherwise sharing an individual’s social care information for money if the information was stored or transmitted through a CLRS. Subdivision (c) imposes a “data minimization” requirement: an individual’s social care information stored or transmitted through a CLRS can only be used for the purpose of meeting the individual’s social care needs, except as otherwise authorized or required by law.

Barring sale of social care information and requiring data minimization with respect to social care information appear to be reasonable baseline standards for data shared through a CLRS. Putting these standards into law alleviates any fear a vulnerable individual might have that highly-sensitive information about their needs might fall into others’ hands. Such protections are necessary because there is no way of knowing, before an individual’s social care information is shared, what privacy laws might apply to a participating entity in a CLRS that receives the information.

One opposition argument calls for a response. Unite Us, which describes itself as “the nation’s leading software company bringing sectors together to improve the health and well-being of communities,” criticizes this measure as “a platform-specific bill that rejects the individual rights-based approach taken by the CCPA and CPRA[,]” i.e., the California Consumer Privacy Act.

Declining to adopt a CCPA-style consent model for sale of data is a deliberate policy choice in this bill. A person seeking social care from a participating organization in a CLRS should be able to expect that the information they are sharing will not be sold and will only be used to refer them for, and provide them with, social care. A person seeking social care is not in the position of, say, a person who opens a Google account in order to use Gmail and Google Docs. The former is likely in a highly vulnerable state. They do not expect, nor should they, that the information they are providing about themselves and their needs could be sold or used for purposes other than providing them with necessary care. They are exceedingly unlikely to know that in order to safeguard the privacy of the information they have shared, they may have to contact various entities to request that their data not be sold, that it be deleted, and so forth. By contrast, the new Google user is almost certainly aware that Google is going to collect, use, and sell the data it collects from their use of Gmail and Google Docs; if they are a Californian, there is a good chance they will also know that they have CCPA privacy rights they can exercise to restrict Google’s use of their data. The two situations are not comparable.

It is critical to understand that closed-loop referral systems are operating in California right now. Absent this bill, participating organizations not subject to other privacy laws (such as the Confidentiality of Medical Information Act (CMIA) or the CCPA) are free to do as they wish with social care information they receive on closed-loop referral systems. This is particularly true of smaller and/or nonprofit technology vendors that may not fall under the CCPA definition of “business.” The selling of sensitive information about Californians’ vulnerabilities obtained on a CLRS might be occurring right now, and it all may be perfectly legal.

5) Related legislation. The author may wish to consider whether there is overlap between this bill and the following measures enacted to address provision of social services to homeless individuals.

AB 210 (Santiago, Chap. 544, Stats. 2017) authorized counties to develop homeless adult and family multidisciplinary teams (MDT) to facilitate identification and assessment of homeless individuals, link homeless individuals to housing and supportive services, allow service providers to share confidential information to ensure continuity of care.

AB 728 (Santiago, Chap. 337, Stats. 2019) built on AB 210 by establishing, until January 1, 2025, MDT pilot programs in Los Angeles, Orange, Riverside, San Bernardino, San Diego, Santa Clara, and Ventura Counties.

REGISTERED SUPPORT / OPPOSITION:

Support

Findhelp, a Public Benefit Corporation (sponsor)

Opposition

211 San Diego

California 211 Providers Network

Health Center Partners of Southern California

San Diego Regional Task Force on Homelessness

Unite Us

United Way of Ventura County

United Ways of California

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200